ServiceNow Intune most recent discovery not correct

[Ahmet1]

We are using Service Graph Connector Microsoft Intune application.

We have configured it and its importing assets correctly however under the "Most Recent Discovery" field, the date and time is not correct (its not matching what its supposed to be transform mapped to).

The field Most Recent Discovery is mapped to "lastsyncdatetime" under IntegrationHub ETL , when I go into IntegrationHub ETL and do Test and rollback Integration results, I can see lastsyncdatetime correct however when the scheduled import runs the most recent discovery field is showing something different , it is showing a date and time nearly identical to the "Updated" field. not the last sync date time from Intune.

See below screenshots

Screenshot from IntegrationHub ETL Transform Map to CMDB configuration 

Transform configuration

When viewing the CMDB Table , the most recent discovery is is showing different values

[Dwayne N]

Ahmet, the new version of the Service Graph Connector for Intune seems to have fixed the issue. See second bullet point on release notes below for v2.3.1

Once I upgraded and ran the import, the Most Recent Discovery matched the last synch time we see coming over in the Intune data.

Release Notes

Fixed

• SG - Intune Computer data source was not updating the discovery source in the Network Adapter [cmdb_ci_network_adapter] table
• SG-Intune Software data source was updating the most recent discovery of computers to the scheduled import time"

[AsfaqueA]

Hi, We are facing the same issue. Can you please elaborate this in detail with example on what kind of custom field you are describing here? That will help us in resolving it by following the same workaround you have implemented.

[_ChrisHelming]

I'm going to make a blog post on this, but it comes down to "Source Recenecy Timestamp" on the transform. Source recency timestamp will override whatever you have in "most recent discovery" and has two behaviors:

If source recency timestamp is empty, the record will get updated every sync and set the last_discovered ("most recent discovery") to the time the record was transformed.

If source recency timestamp is populated with a date time object, last_discovered ("most recent discovery") will be set to that time. But there's a caveat! (I'll explain with an example)

Let's say the device last checked in to Intune (u_lastsyncdatetime) 30 days ago. If you populate source recency timestamp with u_lastsyncdatetime, last_discovered will be the date that the device last checked in to Intune. BUT, the record won't ever get updated until the device checks in again with Intune and the date is more recent than the value in last_discovered. If you update your transform to pull in additional information, the record won't update with that new info if the source recency timestamp matches last_discovered on the record. So, if you need to change your transform and you want all that data to get pulled in, you'll need to either temporarily clear source recency timestamp on the transform or clear last_discovered on all the CIs.

The method we're currently going with is leaving source recency timestamp empty and mapping the last check-in to a new field. This gives us the benefit of knowing the most recent time ServiceNow saw the device during a sync as well as having the info on the most recent check-in to the config management system (Intune in this case).

[Ahmet1]

@AsfaqueA We implemented a custom solution to this which fixed the problem however It's possible that a recent version of the plugin may have already fixed it.

Anyway our current custom solution in place is as follows:

Created a new field "Last Seen"

Created additional ETLHub transformation 

Mapped this to the new field 

All working correct data coming.

I can't remember what the script operation does or where I got it from. All I know is that it works..

[AsfaqueA]

Thanks Ahmet1. This is of huge help in implementing the work around for now. Unfortunately, the day light saving affects in the configuration as we are deducting the added hours in the transform script to be updated in 'Most Recent discovery' field. We have opened a ServiceNow case as well. If we get an update from them, I will update it below here. 

Thanks again 🙂