Azure logs related with Windows Updates

Get info about all updates on specific device - go to Azure Portal then Monitor \ Logs:

let SnapshotTime = datetime(2024-12-18T22:00:00Z);

UCClientUpdateStatus

| where TimeGenerated == SnapshotTime

| where DeviceName  == xxx

| project UpdateInstalledTime, UpdateDisplayName

 

Get info about alerts, e.g. Safeguard:

UCUpdateAlert

| where DeviceName  ==xxx

| where UpdateCategory != 'DriverUpdate'

 

 

UCUpdateAlert

| where AlertSubtype == 'SafeguardHold'

| project TimeGenerated,DeviceName,AlertData