Treat a live Intune device query as evidence with a trust boundary

Source facts

Single-device query requests Windows state in real time and depends on Windows Push Notification Services. Microsoft warns that a local administrator may alter client information returned by the query. For a device with TPM 2.0, the query returns activated and enabled as true. Oversized results are truncated with an error indicating omitted rows. Microsoft Learn.

Applicability

Confirm the corporate-owned Intune device, supported join state, query permission, and required connectivity. Identify the precise property needed for the investigation before querying broader device data.

DSE recommendation

State what the returned value can support and what needs independent corroboration. Do not present client-reported properties as tamper-proof certification. For a high-impact security decision, ask the control owner to define an additional trusted observation. Keep investigation separate from any remote action available in the query interface; obtaining a result should not itself authorize a change.

Verification

Compare a narrowly scoped query with an approved observation of the target device. Check for errors or omitted rows before claiming the result is complete. For TPM interpretation, preserve the documented return-value limitation in the case notes rather than interpreting true as a fresh functional test. Retain the query, device identifier, time, and corroborating evidence. If communication fails, record that as a collection failure rather than assuming the requested property is absent.

Official references

Microsoft Learn: Device Query.