Intune knowme

Intune Know-Me Document Generator

When to Activate

Use this skill when the user asks to:

• "generate know-me for [Customer], tenant [ID]"
• "create intune knowme for ..."
• "generate onboarding doc for ..."
• "knowme for ..."

Extract Customer Name and Tenant ID from the user's message.

---

Step 1: Parallel Data Collection

Run ALL of these queries in parallel (single response, multiple tool calls):

1A. Core Intune Telemetry (PRIMARY SOURCE)

Tool: cxedataS360-kusto_query

• cluster_uri: https://cxedataplatformcluster.westus2.kusto.windows.net/
• database: cxedata
• query:

Intune_FactIntuneTelCommon
| where TenantId == '{TENANT_ID}'
| sort by SnapshotDate desc
| take 1
| project SnapshotDate, TenantId, CompanyName, AccountGuid,
    MDM_Android, MDM_iOS, MDM_Mac, MDM_WindowsTotal, MDM_Other, MDM_Pure_IntuneManaged,
    MDM_Windows11, MDM_Windows10_Only,
    MAM_Users, MAM_Users_TotalTargeted, MAM_UsersNotLicensed, MAM_Policies, MAM_DefaultPolicyOn,
    MAM_MAU, MAM_Android_MAU, MAM_iOS_MAU,
    MAM_MAD, MAM_Android_MAD, MAM_iOS_MAD,
    MAM_Edge_MAU, MAM_Edge_Users,
    MAM_OLM_MAU, MAM_OLM_Users,
    MAM_Teams_MAU, MAM_Teams_Users,
    MAM_Word_MAU, MAM_Excel_MAU, MAM_PowerPoint_MAU,
    MAM_OneNote_MAU, MAM_SharePoint_MAU, MAM_SkyDrive_MAU,
    ProtectedUsers, ProtectedDevices, ProtectedDevices_Android, ProtectedDevices_iOS,
    ProtectedDevices_Android_MDMonly, ProtectedDevices_Android_MDMandMAM, ProtectedDevices_Android_MAMWE,
    ProtectedDevices_iOS_MDMonly, ProtectedDevices_iOS_MDMandMAM, ProtectedDevices_iOS_MAMWE,
    DeviceScenario_NoDevice_MAM_TD, DeviceScenario_MAM_WE, DeviceScenario_MDM, DeviceScenario_MDM_MAM,
    IsCoManaged, IsCoManagedSwungOver, CoManagedDevices, CoManagedDevices_SwungOver, CoManagedDevices_NotSwungOver,
    TenantAttached, AutoPilot,
    TotalLicenses, AssignedUsers, AssignedUsersIntune, AssignedUsersO365,
    IntuneUsageMAU, LicensePaidReportedCXP,
    HasEMSSkuE3, HasEMSSkuE5, HasM365SKUE3, HasM365SKUE5, IsIntunePremium,
    JAMFActiveDeviceCount, MDM, PC, EAS,
    TPID, TenantState, VerticalName, IndustryName, SegmentName, SubSegmentName,
    CountryName, GeoRegion

1B. 6-Month Trend

Tool: cxedataS360-kusto_query (same cluster/database)

Intune_FactIntuneTelCommon
| where TenantId == '{TENANT_ID}'
| sort by SnapshotDate desc
| take 6
| project SnapshotDate, IntuneUsageMAU, MAM_Users, MAM_MAU, MDM_Android, MDM_iOS, MDM_WindowsTotal, ProtectedUsers, ProtectedDevices

1C. Device Detail Breakdown

Tool: cxedataS360-kusto_query (same cluster/database)

Intune_FactIntuneDevicesCommon
| where TenantId == '{TENANT_ID}'
| where SnapshotDate == toscalar(Intune_FactIntuneDevicesCommon | where TenantId == '{TENANT_ID}' | summarize max(SnapshotDate))
| summarize TotalDevices = sum(DeviceCount) by ClientOS_Platform, OwnerType, ManagementAgent, MDMCompliance, WorkplaceJoinStatus, EnrollmentTypeV1Name
| order by TotalDevices desc

1D. Security360 — Customer Profile

Tool: security360-mcp-get_customer_data

• filters: TenantId eq '{TENANT_ID}'

1E. Security360 — Product Metrics

Tool: security360-mcp-get_product_metrics

• tenant_id: {TENANT_ID}

1F. Security360 — Support Cases

Tool: security360-mcp-get_support_metrics

• tenant_id: {TENANT_ID}

1G. Security360 — CRM Engagements

Tool: security360-mcp-get_crm_metrics

• tenant_id: {TENANT_ID}

---

Step 2: Parse & Analyze Results

After all queries return:

1. Parse Kusto results — extract device counts, MAM metrics, licensing, co-management status
2. Parse Security360 results:
   • Customer data → company name, industry, segment, region
   • Product metrics → filter for Intune MAU trend
   • Support metrics → filter for Intune-related cases (keywords: Intune, MAM, MDM, Autopilot, Tunnel, compliance, enrollment, hybrid join, Entra, endpoint)
   • CRM → active engagements
3. Identify gaps — any NULL/0 fields become open questions
4. Score risks — based on CritSit hours, case patterns, adoption rates

---

Step 3: Generate the Know-Me Document

Write a markdown document with this EXACT 11-section structure:

# {CUSTOMER_NAME} — Intune Know-Me

**Customer:** {Full Legal Name}
**Tenant ID:** {TENANT_ID}
**Region:** {CountryName} ({GeoRegion})
**Segment:** {SegmentName} — {SubSegmentName}
**Industry:** {IndustryName} | {VerticalName}
**Intune MAU:** {IntuneUsageMAU} | **MAM Protected Users:** {MAM_Users} | **Total Licenses:** {TotalLicenses}
**Data Snapshot:** {SnapshotDate}
**Generated:** {today's date}

---

## 1. Intune Role & Importance
## 2. Tenant & Architecture Model
## 3. Device Enrollment & Provisioning
## 4. Device Mix, Ownership & MAM
## 5. Join State & Lifecycle
## 6. RBAC, Identity & Privileged Access
## 7. Compliance, Updates & Patching
## 8. Networking, VPN & Certificates
## 9. Reporting, Telemetry & Trust
## 10. macOS & Non-Standard Devices
## 11. Key Risks & Awareness Notes

Section → Data Mapping

Section	Primary Data Fields
1. Role & Importance	IntuneUsageMAU, MAM_Users, TotalLicenses, IndustryName, SegmentName, trend data
2. Tenant & Architecture	TenantId, IsCoManaged, TenantAttached, GeoRegion, CountryName, HasEMS/M365 SKUs
3. Enrollment & Provisioning	AutoPilot, EnrollmentTypeV1Name, MDM totals, MDM_Pure_IntuneManaged
4. Device Mix & MAM	MDM_, MAM_, ProtectedDevices_, DeviceScenario_, per-app MAU
5. Join State	WorkplaceJoinStatus from device detail, support cases (hybrid join keywords)
6. RBAC & Identity	(mostly open questions — limited telemetry)
7. Compliance & Updates	MDMCompliance from device detail, support cases (compliance keywords)
8. Networking & VPN	Support cases (Tunnel, VPN, certificate keywords)
9. Reporting & Telemetry	Support cases (reporting, mismatch keywords), data freshness
10. macOS & Non-Standard	MDM_Mac, JAMFActiveDeviceCount, MDM_Other
11. Risks	Derived from all above — CritSit hours, adoption gaps, case patterns

Writing Style Rules

• Bold key phrases inline (not entire sentences)
• Declarative engineering tone — direct, factual, no hedging
• Short sentences — one idea per sentence
• Bullet lists for enumeration, tables for numeric breakdowns
• Cite specific data — SR numbers, CritSit hours, exact counts from Kusto
• End each section with a blockquote: > **🔲 Open Questions:**
• Include 3–5 targeted open questions per section based on data gaps

Risk Scoring (Section 11)

🔴 Critical:

• CritSit case open > 30 days
• Total CritSit hours > 50 on single topic
• 3+ related support cases showing a pattern

🟡 High:

• Active open CritSit case
• MAM policy bypass signals
• MDM adoption < 10% of AssignedUsersIntune
• CoManagedDevices_NotSwungOver > 50% of CoManagedDevices

🟢 Awareness:

• Industry/segment-specific regulatory implications
• Cross-product dependencies from CRM engagements
• Licensing gaps (users not licensed but using MAM)

---

Step 4: Save & Export

1. Save the generated markdown to the session files directory as {CustomerName}-Intune-KnowMe.md
2. Auto-generate the .docx file by running the converter located in the skill directory:

   node C:\Users\menglin\.copilot\skills\intune-knowme\md2docx.js "{session_files_dir}\{CustomerName}-Intune-KnowMe.md" "{session_files_dir}\{CustomerName}-Intune-KnowMe.docx"
   

   This produces a formatted Word document with headings, tables, bullet lists, and styled text.
3. Display a brief summary to the user showing key metrics found and confirm both .md and .docx files were created

---

Data Field Reference

Field	Meaning
MAM_Users	Active MAM protected users (≥1 APP check-in in period)
MAM_Users_TotalTargeted	All users targeted by MAM policies (includes inactive)
MAM_MAU	Monthly Active Users with MAM activity
MAM_MAD	Monthly Active Devices with MAM activity
DeviceScenario_MAM_WE	Devices with MAM Without Enrollment (BYOD, no MDM)
DeviceScenario_MDM	MDM-enrolled devices without MAM
DeviceScenario_MDM_MAM	Devices with both MDM + MAM protection
DeviceScenario_NoDevice_MAM_TD	MAM-targeted users with no device record
ProtectedUsers	Users protected by MDM or MAM (deduplicated)
MDM_Pure_IntuneManaged	Intune-only managed devices (not co-managed)
CoManagedDevices_SwungOver	Co-managed devices with workloads moved to Intune
CoManagedDevices_NotSwungOver	Co-managed but workloads still on MECM
IntuneUsageMAU	Monthly Active Users (any MDM or MAM activity)
AutoPilot	Autopilot-registered device count
TenantAttached	MECM tenant-attached device count
IsIntunePremium	Whether tenant has Intune Plan 2 / premium add-ons

---

Error Handling

• If Kusto query fails → report the error, ask user to verify MCP connection with /mcp
• If Security360 fails → proceed with Kusto data only (it's the primary source)
• If a field is NULL or 0 → generate an open question for that topic area
• If tenant not found → ask user to verify the Tenant ID (try AccountGuid if TenantId fails)
• Always produce a document even with partial data — open questions fill gaps

---

Prerequisites for Team Members

To use this skill, ensure these MCP servers are connected (/mcp to check):

1. cxedataS360 — Kusto MCP server for cxedataplatformcluster.westus2.kusto.windows.net
2. security360-mcp — Security360 API server (customer data, support cases, CRM)

Optional: 3. m365-copilot — M365 Copilot enterprise search (for additional context enrichment)

If missing, use /mcp add to configure them before generating.