Endpoint Analytics & Remediations

Endpoint Analytics measures the experience, not the device

Simple explanation

Endpoint Analytics answers a question your monitoring tools usually can’t: “is this laptop annoying to use?”

A device can be fully compliant, fully patched, and still take four minutes to boot and crash Outlook twice a day. Endpoint Analytics scores that lived experience so you can find and fix it.

The scores you must recognise

Score	Measures	Typical remedy
Startup performance	Boot and sign-in time, broken into phases	Reduce startup apps, review GPO/CSP load, faster disks
Application reliability	App crashes and hangs per device	Update or replace the failing app
Work from anywhere	Cloud-readiness of devices (identity, management, provisioning)	Move to Entra join / Autopilot / cloud management
Restart frequency	How often devices restart, and why	Distinguish update restarts from stop errors

Baselines are the most misread part of Endpoint Analytics

A baseline is a comparison point, not a target that Intune enforces.

Two options exist: the all-organisations median (how you compare to everyone) and a custom baseline captured from your own tenant (how you compare to your past self). If a scenario says “we want to know whether last quarter’s change made things worse”, the answer is a custom baseline — comparing to other organisations cannot answer that question.

Nothing is remediated because a score is low. Scores inform; Remediations act.

Baseline analytics vs Advanced Analytics

This split is a favourite distractor, because both live under the same node.

Endpoint Analytics vs Advanced Analytics
Feature	Endpoint Analytics (included with Intune)	Advanced Analytics (extra entitlement)
Startup performance	Yes	Yes
Application reliability	Yes	Yes
Device query (real-time, on demand)	No	Yes
Anomaly detection	No	Yes
Battery health	No	Yes
Resource performance (CPU/RAM pressure)	No	Yes
Device timeline	No	Yes

If a question asks for on-demand, real-time data from a single device — “what is installed on this laptop right now” — that is Device query, and it needs an Advanced Analytics entitlement, available through the Intune Suite add-on, Intune Plan 2, or an eligible Microsoft 365 bundle. Standard Endpoint Analytics reports on collected telemetry, not live state.

Remediations (formerly Proactive Remediations)

Name change you will meet in both directions

Proactive Remediations has been renamed to Remediations, and it now lives in the Intune admin center under Devices → Manage devices → Scripts and remediations.

The blueprint and much existing documentation still say proactive remediations. Treat the two names as the same feature — and expect the exam to use either.

A remediation is a script package: a detection script, optionally a remediation script, plus metadata. You can deploy Microsoft’s built-in packages or write your own.

The exit code rule — memorise this

# Detection script
$svc = Get-Service -Name 'Spooler' -ErrorAction SilentlyContinue

if ($svc.Status -eq 'Running') {
    Write-Output "Compliant"
    exit 0      # healthy  -> remediation script does NOT run
} else {
    Write-Output "Spooler stopped"
    exit 1      # issue detected -> remediation script RUNS
}

The remediation script runs only when the detection script exits with exit 1. Exit 0 means healthy, and nothing further happens. Getting this backwards is the single most common mistake in this topic.

Requirements worth remembering

Requirement	Detail
Licensing	Windows Enterprise E3/E5 (incl. in M365 F3/E3/E5), Education A3/A5, or Windows VDA per user
Join state	Microsoft Entra joined or Microsoft Entra hybrid joined
Enrolment	MDM-enrolled in Intune (Enterprise, Pro or Education) — or co-managed
Script encoding	UTF-8, and not UTF-8 BOM when signature checking is enforced
Package limit	Up to 200 script packages
Output limit	Maximum 2,048 characters of output
Permissions	Rights under the Device configurations RBAC category

Scheduling

Script packages can run once, hourly, or daily. Choose the interval against the cost of the check — an hourly script across 20,000 devices is 20,000 executions per hour, and the output is capped at 2,048 characters regardless.

Remediation vs configuration profile vs platform script

Three things run “settings” at a device, and the exam separates them carefully:

Configuration profile — declares a desired setting and keeps it that way. Preferred whenever a native setting exists.
Platform script (Devices → Scripts) — runs PowerShell once, with no detection logic and no built-in repeat.
Remediation — detection + fix, on a schedule, with reporting on how many devices were found and fixed.

“Detect and fix on an ongoing basis, and show me the numbers” is uniquely a Remediation. “Apply this setting” should be a configuration profile — scripting a setting that has a native CSP is the wrong answer even when it would technically work.

Question

Which detection script exit code causes the remediation script to run?