Request fresh client events before reloading a tenant-attached device timeline

Source facts

Microsoft states that the timeline initially shows the last 24 hours and that devices normally send events to the admin center once a day. Sync requests recent client data; Refresh reloads the page to display events already collected. Configuration Manager must have Endpoint analytics data collection enabled to expose this timeline. Microsoft Learn.

Applicability

Apply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.

DSE recommendation

DSE recommends recording the event window and collection action in the investigation notes. Request a synchronization when recent client activity is needed, then reload the view and check the returned event times. Review the selected time range, event levels and provider filters before deciding that an expected event is absent.

Verification

On an approved test device, compare the most recent displayed event before and after a collection request. Record the request time and the event timestamps that actually arrive. If the desired period remains missing, retain that evidence gap and investigate the collection path before using the timeline to rule out activity.

Official references

Microsoft Learn: Configure tenant attach to support endpoint security policies from Intune. Source reviewed September 17, 2026.