Intune Endpoint Analytics: Because ‘My Laptop Is Slow’ Isn’t a Diagnosis

Intune Endpoint analytics shows what your users are living with, rather than what your policies say they should be living with. Most of us spend our days in compliance policies, apps and Autopilot, because that’s where the tickets come from.

The trouble is that a device can be compliant, encrypted and fully patched, and still be miserable to use. Users never log a ticket saying “Group Policy added 55 seconds to my sign-in”. They say “my laptop is slow”, usually to Dave from accounts, who tells the whole second floor.

This guide walks through Intune Endpoint analytics using real numbers from my own reports: a startup score of 42, OneDrive crashing every 59 minutes of use, and 384 devices stuck waiting on Group Policy. It covers prerequisites, the July 2026 licensing change, how each score works and what to fix first.

Never miss a guide: subscribe here and check out my YouTube channel.

What is Intune Endpoint analytics?

Intune Endpoint analytics collects telemetry from Windows devices and turns it into scores from 0 to 100, with insights and recommendations underneath. You’ll find it in the Microsoft Intune admin centre under Reports > Endpoint analytics.

The overall score is a weighted average of Startup performance, Application reliability and Work from anywhere. Each is compared against a baseline, and the built-in one is All organizations (median), an anonymised median from other tenants.

Think of compliance as the MOT certificate and Intune Endpoint analytics as the test drive. The certificate says the car passed. The test drive tells you the clutch is slipping. Microsoft’s Endpoint analytics overview has the full reference.

Intune Endpoint analytics reports at a glance

Report	What it measures	Key detail	Licence
Startup performance	Boot and sign-in times, Group Policy delays, startup processes, restarts	Events kept for 29 days	Intune
Application reliability	App crashes, hangs and mean time to failure	Rolling 14-day window	Intune
Work from anywhere	Supported Windows, cloud management, cloud identity, cloud provisioning	Active means one event in 29 days	Intune
Resource performance	CPU and RAM spike time	Usage over 50% counts as a spike	Advanced Analytics (Cloud PCs included with Windows 365)
Battery health	Battery capacity and estimated runtime	Under 60% of design capacity is most impacted	Advanced Analytics
Anomalies	Spikes in app hangs, crashes and stop error restarts	Correlates issues with recent changes	Advanced Analytics

Intune Endpoint analytics prerequisites and licensing

Intune Endpoint analytics is mostly about getting telemetry off devices. If any of these are missing, the device never shows up.

Requirement	Detail
Windows edition	Pro, Pro Education, Enterprise or Education
Management	Intune-managed, co-managed, or Configuration Manager with tenant attach
Join type	Microsoft Entra joined or Microsoft Entra hybrid joined
Telemetry service	Connected User Experiences and Telemetry (DiagTrack) enabled and running
Network	Devices can reach https://*.events.data.microsoft.com
Device licence	A valid Intune licence for each enrolled device
Role to configure	An Intune role with Endpoint analytics write access, such as School Administrator or a custom role
Role to view reports	Read Only Operator, Help Desk Operator, Endpoint Security Manager, or Microsoft Entra Reports Reader

Intune Endpoint analytics licensing

Feature	Licence needed
Startup performance, Application reliability, Work from anywhere	Intune Plan 1 (in Microsoft 365 Business Premium, E3 and E5)
Resource performance, Battery health, Anomalies, Device timeline, Device query	Advanced Analytics: Intune Plan 2, the Intune Suite, or Microsoft 365 E3, E5 or E7 from July 2026
Remediations (to fix what you find)	Windows Enterprise E3 or E5 (in Microsoft 365 F3, E3 and E5), Windows Education A3 or A5, or Windows VDA per user

The July 2026 change is the big one. Microsoft 365 E3 now includes Intune Plan 2, Remote Help and Advanced Analytics, so plenty of tenants have the extra reports without anyone noticing. Business Premium still needs Plan 2 or the Intune Suite. See Microsoft Intune licensing and my Remote Help with Intune guide.

How to set up Intune Endpoint analytics in 6 steps

Step 1: Onboard devices with the Intune data collection policy

1. In the Microsoft Intune admin centre, go to Reports > Endpoint analytics.
2. On your first visit, choose where to Collect device data from: All cloud-managed devices, Selected devices, or I’ll choose later.
3. Select Start. Intune creates a Windows health monitoring profile called Intune data collection policy and assigns it.
4. To change the scope later, go to Devices > Manage devices > Configuration and edit the policy’s assignments.

Step 2: Restart devices and wait for data

Devices must restart at least once, and data can take up to 24 hours after that restart to appear. This is where you go and make a cup of tea. Possibly several.

You also need at least five reporting devices. Below that the score shows insufficient data, so a lab with two VMs and a laptop will just sit there looking blank.

Step 3: Create a baseline before you change anything

Under Settings > Baseline you can create your own baselines, up to 20 per tenant. Put the date in the name. A metric is flagged as regressed when it drops below the baseline by more than the regression threshold, 10% by default.

This is how you prove a change worked. “It feels faster” won’t impress the finance director, but “sign-in score up 20 points since the GPO clean-up” might.

Step 4: Read the Startup performance report

My startup score is 42 against a baseline of 50. The score tells you there’s room to improve. The breakdown tells you where.

The startup score is a weighted average of two parts. The boot score covers power-on to the sign-in screen. The sign-in score covers credential entry to a responsive desktop, meaning it has rendered and CPU usage has dropped below a moderate level.

That split matters. A slow boot points at hardware, firmware or drivers. A slow sign-in usually points at things you configured, such as Group Policy, logon scripts and startup apps.

The insight that jumped out: 384 devices have sign-in times slowed by Group Policy, averaging 55 seconds of policy processing. Nearly a minute, every sign-in, on every one of those machines, and not a single ticket about it.

The report also flags devices booting from hard disk drives, which typically take three to four times longer than SSDs. The Startup processes tab lists apps keeping the CPU above 50% after the desktop appears, and Restart frequency separates stop errors from update restarts.

Step 5: Drill into Application reliability

Application reliability lists desktop apps with real foreground use, showing active devices, crashes, mean time to failure and a reliability score. It all runs on a rolling 14-day window.

In my data, OneDrive.exe stood out: a reliability score of 37, 274 active devices, 17 crashes and a mean time to failure of 59 minutes. Other Microsoft apps on the same devices scored 100 with no crash events, so this was something specific.

Mean time to failure is total usage time divided by total crashes, where usage means active engagement time. Each app is capped at 10 crash events per device per day, so one broken machine can’t wreck a score on its own.

Selecting a device opens its Application reliability timeline. CADTB01 scores 40, with three OneDrive.exe crashes close together, all on version 26.55.323.4.

That’s the view I want when a user rings. No remote session into Event Viewer, and no asking them to remember what they clicked last Tuesday. Select the app name and the App versions tab shows whether that build crashes elsewhere.

If it’s one machine, look at the OneDrive cache, the profile, sync scope, free disk space and known folder move. If it’s many machines, treat it as an app problem.

The Model performance tab compares hardware. My OptiPlex 3000 fleet scored 83 across 263 devices, while the OptiPlex SFF 7010 scored 100 with no crash events across 20 devices.

That doesn’t make the 7010 a better machine, because 20 devices give you far less data than 263. If one model keeps scoring lower after driver or BIOS updates, though, that’s a lead worth following.

Step 6: Check Work from anywhere and the Advanced Analytics reports

Work from anywhere scores the percentage of devices on supported Windows, under cloud management, with cloud identity, and provisioned through Windows Autopilot or Windows 365. Its Windows flyout also shows Windows 11 hardware readiness per device.

With Advanced Analytics, Resource performance scores CPU and RAM spike time, and Battery health combines capacity and runtime scores. Both help with budget requests, because it’s hard to argue with a list of laptops whose batteries hold under 60% of their original charge.

Pull Intune Endpoint analytics data with PowerShell

Sometimes you want a list you can sort and drop into a change request. In Microsoft Graph, Intune Endpoint analytics data lives under its older name, user experience analytics.

This read-only script uses the Microsoft Graph PowerShell SDK to list the 20 devices losing the most time to Group Policy at sign-in, then the least reliable apps.

# Read-only: needs the Microsoft.Graph.Authentication module
# Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All" -NoWelcome

function Get-AllPages {
    param([string]$Uri)
    $results = @()
    while ($Uri) {
        $page = Invoke-MgGraphRequest -Method GET -Uri $Uri -OutputType PSObject
        $results += $page.value
        $Uri = $page.'@odata.nextLink'
    }
    $results
}

$base = "https://graph.microsoft.com/v1.0/deviceManagement"

# Devices losing the most time to Group Policy at sign-in (over 30 seconds)
$devices = Get-AllPages -Uri "$base/userExperienceAnalyticsDevicePerformance"
$devices |
    Where-Object { $_.groupPolicyLoginTimeInMs -gt 30000 } |
    Sort-Object groupPolicyLoginTimeInMs -Descending |
    Select-Object -First 20 deviceName, model,
        @{ Name = 'GPSignInSec'; Expression = { [math]::Round($_.groupPolicyLoginTimeInMs / 1000, 1) } },
        @{ Name = 'CoreSignInSec'; Expression = { [math]::Round($_.coreLoginTimeInMs / 1000, 1) } },
        loginScore, startupPerformanceScore |
    Format-Table -AutoSize

# Least reliable apps over the last 14 days
$apps = Get-AllPages -Uri "$base/userExperienceAnalyticsAppHealthApplicationPerformance"
$apps |
    Where-Object { $_.appCrashCount -gt 0 } |
    Sort-Object appHealthScore |
    Select-Object -First 15 appName, appPublisher, activeDeviceCount, appCrashCount, meanTimeToFailureInMinutes, appHealthScore |
    Format-Table -AutoSize

It needs the DeviceManagementManagedDevices.Read.All permission. Adjust the 30000 millisecond threshold to suit your estate. With an average of 55 seconds in my data, the first batch picked itself.

Prove Intune Endpoint analytics is working

• Reports > Endpoint analytics > Settings shows the Intune data collection policy as Connected.
• The Intune data collection policy shows your devices succeeding.
• The Startup performance Device performance tab lists your pilot devices after a restart.
• The Overview page shows a score rather than insufficient data.
• On a missing device, check the telemetry service is running:

Get-Service -Name DiagTrack | Select-Object Status, StartType

If a device is still missing after a restart and 24 hours, check DiagTrack and your proxy first. The Endpoint analytics troubleshooting page covers proxy authentication.

What to do with your Intune Endpoint analytics results

Intune Endpoint analytics won’t fix anything by itself. It gives you evidence, and evidence gets changes approved.

• Group Policy delays: import GPOs into Group Policy analytics (Devices > Manage devices > Group Policy analytics) and migrate supported settings to a Settings Catalog policy. My Intune Windows 11 25H2 settings guide is a good start.
• Startup processes: remove or delay apps that hold the CPU after sign-in, and deploy Windows apps with Intune properly.
• Crashing apps: find the bad build in App versions, then update or roll back. Intune App Inventory shows which versions are out there.
• Repeat offenders: Intune Remediations run detection and fix scripts on a schedule, such as clearing a corrupt cache before the user notices.
• Old hardware: use model scores, the hard disk insight and Battery health to back up refresh requests.

Then compare against your baseline in a fortnight. If the number went up, screenshot it for your next management report. If it went down, at least you found out before the head teacher did.

Intune Endpoint analytics gotchas

Insufficient data. Fewer than five reporting devices means no score. It isn’t broken, just lonely.

Sleepy laptops. Startup data needs at least one restart after the policy lands, and startup performance drops devices with no boot or sign-in event in 29 days.

Scope tags. Device-level tabs respect scope tags, but aggregated scores use every enrolled device unless you set up device scopes, an Advanced Analytics feature.

Revoking consent. Untick consent to share anonymised data and reports such as startup performance insights are disabled. Historical data stays visible for up to 60 days.

Not real time. Data typically refreshes about once a day. For live troubleshooting, Device query or a remote session is quicker.

Should you use Intune Endpoint analytics?

Yes. If you have Intune, the core reports cost nothing extra, take five minutes to switch on and a day to populate. Few Intune features give you that much for so little effort.

Don’t chase the score. Start with the biggest pain, which for me was 384 devices losing nearly a minute to Group Policy at every sign-in. Fix one thing, compare against your baseline, and repeat.

And if you have Microsoft 365 E3, check whether Resource performance and Battery health have quietly appeared. You may already be paying for them.

Intune Endpoint analytics FAQs

Further reading

• Configure endpoint analytics (Microsoft Learn)
• Startup performance report (Microsoft Learn)
• Application reliability report (Microsoft Learn)
• Advanced Analytics overview (Microsoft Learn)
• Intune device clean-up rules
• Secure Boot 2026 certificate updates

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.