Single-device query requests Windows state in real time and depends on Windows Push Notification Services. Microsoft warns that a local administrator may alter client information returned by the query. For a device with TPM 2.0, the query returns activated and enabled as true. Oversized results are truncated with an error indicating omitted rows. Microsoft Learn.
\nConfirm the corporate-owned Intune device, supported join state, query permission, and required connectivity. Identify the precise property needed for the investigation before querying broader device data.
\nState what the returned value can support and what needs independent corroboration. Do not present client-reported properties as tamper-proof certification. For a high-impact security decision, ask the control owner to define an additional trusted observation. Keep investigation separate from any remote action available in the query interface; obtaining a result should not itself authorize a change.
\nCompare a narrowly scoped query with an approved observation of the target device. Check for errors or omitted rows before claiming the result is complete. For TPM interpretation, preserve the documented return-value limitation in the case notes rather than interpreting true as a fresh functional test. Retain the query, device identifier, time, and corroborating evidence. If communication fails, record that as a collection failure rather than assuming the requested property is absent.
\n