[ie-ops]

Executive summary

The managed_device ingest pipeline failed to parse date fields (InGracePeriodUntil, LastContact, CreatedDate) when Microsoft Intune delivered them in T-separated ISO 8601 format (e.g., '2026-06-26T16:57:05.0858748') instead of the space-separated format ('2026-06-26 16:57:05.0858748') the pipeline previously handled. The fix adds the 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' format as a second accepted pattern in all three date processors, allowing both variants to parse correctly. A new pipeline test fixture exercising the T-separated variant was added and all tests pass.

Proposed commit message

[microsoft_intune] Fix date formats for T-separated ISO 8601 timestamps.

Root cause

The three date processors (date_properties_InGracePeriodUntil, date_properties_LastContact, date_properties_CreatedDate) declare only the space-separated format 'yyyy-MM-dd HH:mm:ss.SSSSSSS', but Microsoft Intune DeviceComplianceOrg/DeviceCompliance category events send these fields in T-separated ISO 8601 format (e.g. '9999-12-31T23:59:59.9999999'), which does not match the declared format and causes the processor to fail.

Approach

Add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second entry in the formats list for all three date processors in default.yml: date_properties_InGracePeriodUntil (line 158), date_properties_LastContact (line 184), and date_properties_CreatedDate (line 82). The existing space-separated format covers the Devices category; the T-separated variant covers DeviceComplianceOrg/DeviceCompliance events from the same stream. Add the sanitized DeviceComplianceOrg event as a new pipeline test fixture to exercise all three T-separated date fields.

Implementation

1. Step 1: In packages/microsoft_intune/data_stream/managed_device/elasticsearch/ingest_pipeline/default.yml, edit the date_properties_CreatedDate processor (line 82) to add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second entry in its formats list, keeping the existing 'yyyy-MM-dd HH:mm:ss.SSSSSSS' entry.
2. Step 2: In the same file, edit the date_properties_InGracePeriodUntil processor (line 158-159) to add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second entry in its formats list.
3. Step 3: In the same file, edit the date_properties_LastContact processor (line 184-185) to add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second entry in its formats list.
4. Step 4: Append the sanitized DeviceComplianceOrg/DeviceCompliance event (with T-separated dates in InGracePeriodUntil, LastContact, and no CreatedDate field) as a new JSON line in packages/microsoft_intune/data_stream/managed_device/_dev/test/pipeline/test-managed-device.log.
5. Step 5: Add the corresponding expected output entry for the new fixture to packages/microsoft_intune/data_stream/managed_device/_dev/test/pipeline/test-managed-device.log-expected.json, with correctly parsed date values for in_grace_period_until and last_contact.
6. Step 6: Add a bugfix changelog entry to packages/microsoft_intune/changelog.yml under a new version 0.1.1 entry, and update the version field in packages/microsoft_intune/manifest.yml from 0.1.0 to 0.1.1.
7. Step 7: Run 'elastic-package test pipeline' from the package directory to confirm all existing and new fixtures pass.

Pipeline changes

• date_properties_CreatedDate processor (line 82): add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second format entry alongside existing 'yyyy-MM-dd HH:mm:ss.SSSSSSS'
• date_properties_InGracePeriodUntil processor (line 158): add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second format entry alongside existing 'yyyy-MM-dd HH:mm:ss.SSSSSSS'
• date_properties_LastContact processor (line 184): add 'yyyy-MM-dd'T'HH:mm:ss.SSSSSSS' as a second format entry alongside existing 'yyyy-MM-dd HH:mm:ss.SSSSSSS'

Field / mapping changes

—

Sanitized error message

Processor date with tag date_properties_InGracePeriodUntil in pipeline logs-microsoft_intune.managed_device-default failed with message: [on_failure_message]

Sanitized log (event_sanitized excerpt)

{
  "category": "DeviceComplianceOrg",
  "operationName": "DeviceCompliance",
  "properties": {
    "AADTenantId": "89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b",
    "AccountId": "89a1d5c2-2b3e-4f67-8a9b-0c1d2e3f4a5c",
    "BatchId": "89a1d5c3-2b3e-4f67-8a9b-0c1d2e3f4a5d",
    "ComplianceState": "1",
    "ComplianceState_loc": "Compliant",
    "DeviceHealthThreatLevel": null,
    "DeviceHealthThreatLevel_loc": "Unknown",
    "DeviceId": "89a1d5c4-2b3e-4f67-8a9b-0c1d2e3f4a5e",
    "DeviceName": "DEVICE-001",
    "DeviceType": 1,
    "IMEI": "",
    "InGracePeriodUntil": "9999-12-31T23:59:59.9999999",
    "IntuneAccountId": "89a1d5c2-2b3e-4f67-8a9b-0c1d2e3f4a5c",
    "LastContact": "2026-06-26T16:57:05.0858748",
    "ManagementAgents": 514,
    "ManagementAgents_loc": "Not Available",
    "OS": "Windows",
    "OSDescription": "Windows",
    "OSVersion": "10.0.26200.8655",
    "OS_loc": "Windows",
    "OwnerType": 1,
    "OwnerType_loc": "Company",
    "RetireAfterDatetime": null,
    "SerialNumber": "SN000000000001",
    "UPN": "user@example.com",
    "UserEmail": "user@example.com",
    "UserId": "89a1d5c5-2b3e-4f67-8a9b-0c1d2e3f4a5f",
    "UserName": "Alice Johnson"
  },
  "resultType": "None",
  "tenantId": "89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b",
  "time": "2026-06-27T01:36:30.5799000Z"
}

Reviewer concerns

• The SSSSSSS (7-digit sub-second) format pattern is used for both variants; if Microsoft Intune ever emits fewer than 7 fractional digits in the T-separated format (e.g., milliseconds only), parsing would still fail and a follow-up format entry would be needed.
• The changelog PR link is a placeholder (https://github.com/elastic/integrations/pull/1) and should be updated to the actual PR URL before merging.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: microsoft_intune.managed_device [MISSING_CASE]: Processor date with tag date_properties_InGracePeriodUntil in pipeline l…
• Pipeline case: ac2781af484c6b8d

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 21c80a8

cc @chemamartinez

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package microsoft_intune - 0.1.1 containing this change is available at https://epr.elastic.co/package/microsoft_intune/0.1.1/