Monitoring, telemetry and update management

These are the agent’s newest capabilities and the least visible ones. Everything here runs quietly on the device and surfaces in the control panel, so it is worth knowing what is being collected — not least because customers ask.

Digital employee experience

DEX monitoring watches the Windows event log for conditions that indicate a user is having a bad time — crashes, hangs, failures that never reach the helpdesk because people work around them.

The agent subscribes to event-log channels and matches events against rules issued from the control panel. A rule identifies events by publisher and severity, not by event ID alone: the same numeric ID means different things in different Windows components, so matching on the ID by itself would produce false positives.

Matched events are buffered on the device and sent in batches over the device’s IoT connection.

Batching means the panel lags the device slightly

Batches are only sent when they are reasonably full, so a device producing a slow trickle of events holds them rather than sending one message at a time. A partial batch is force-sent after 30 minutes at the latest, so the panel is never more than about half an hour behind. Do not read a short delay as a fault.

The buffer holds up to 5,000 events, batches are capped at 200 events or roughly 200 KB, and the agent backfills up to seven days of history when monitoring first starts — so a newly enrolled device arrives with recent context rather than nothing.

The device records when it last synchronized DEX data, which is the value to check if a device looks quiet.

Telemetry

Separate from DEX, general telemetry can be enabled or disabled per device, with a configurable batch size. When disabled, the agent stops sending it.

What else the agent reports about a device:

• Hardware and warranty — warranty lookup, where enabled
• Location — geolocation, where enabled
• Network — the device’s external IPv4 and IPv6 addresses
• Compatibility — Windows 11 readiness
• Security posture — BitLocker key escrow state, Windows Autopilot registration, Intune ownership classification

Geolocation, warranty lookup and telemetry each have their own switch. If a customer objects to a specific collection, it can be turned off without disabling management.

Answering the question customers actually ask

DEX collects Windows event-log entries matching the configured rules — not documents, keystrokes or screen content. Telemetry, warranty and geolocation are separately controlled, and Log Analytics forwarding only happens where a workspace has been configured.

Windows Update management

The agent tracks update health rather than just installing updates, and records:

• current health status and when it was last checked
• whether remediation has already been attempted
• the last error encountered
• which updates last failed
• whether a reboot is pending after an update
• when the last automatic scan ran

This distinguishes the three cases that matter: a device that is up to date, a device that is behind, and a device whose update stack is broken and will stay behind until something repairs it. The remediate Windows update command exists for the third case.

The overdue-update notification

When a device is behind on updates, the agent can notify the person using it — not just report to the panel. They see:

Updates Required — Your machine is missing critical updates. Click here to initiate Windows Updates now.

Clicking it starts the installation immediately, the same operation as the panel’s install-updates command. Once running, the user sees a second message confirming updates are in progress.

The agent records when it last showed this prompt, so the same user is not nagged repeatedly about the same condition.

This is the one agent feature that talks directly to your customer's staff

The user acts without involving you, and the machine may restart as a result. Make sure the customer knows the prompt is legitimate — an unexpected “your machine is missing critical updates” pop-up is exactly what a phishing attempt looks like. The tray application guide is written for them and can be shared as-is.

Application updating

Applications are updated through Windows Package Manager. The agent runs the update via a scheduled task with elevation, so it works whether or not anyone is signed in. Behaviour is configured at the organization level and can be triggered on demand with the run winget updates command.

This covers applications the package manager knows about — it is not a substitute for a deployment tool for line-of-business software.

Housekeeping

Disk cleanup can be run on demand. It is worth knowing about ahead of an Entra ID migration: insufficient free space is one of the preflight checks that will block one, because the user’s profile is copied before it is moved.

Related

• Device settings and commands reference
• The Autopilot icon on your computer