How To find out who sent remote commands in Microsoft Intune
1. Go to Activity Logs Open the Microsoft Intune Admin Center Navigate to Tenant administration > Audit logs. 2. Filter the Logs Use the filtering option to search for specific events, such as: Category: "Device actions" Activity: The specific action, e.g., "Reset passcode" or "Wipe device." Target: The device or user affected by the action. You can also specify a date range to narrow your search. 3. Check Who Sent the Command In the logs, you will find information about who initiated the action. This is displayed under the field Initiated by or similar. It includes: The username or email address of the administrator. The time the command was sent. 4. Alternative: Logs from the Device If it concerns a specific device, you can: ...