Intune Compliant Device with Missing Health Attestation and OS Version 0.0.0.0
Detects devices marked as 'Compliant' in Microsoft Intune despite having an implausible OS version (0.0.0.0) or 'Unknown' ownership type. This can indicate phantom device registrations where health attestation might be missing or misconfigured, leading to an incorrect 'Compliant' status instead of 'Non-Compliant'. Such devices might be used to bypass security policies or indicate a misconfiguration that could be exploited.
Microsoft Sentinel (KQL)
