As we have moved to Intune, we have "managed" nearly everything. Making Intune the only local administrator needed on most of our PCs.
Reaching the edges of this policy, I would like to make it possible for a technician to customize a PC. While somehow knowing which PCs may have been customized. The assumption being, any PC found to have had an administrator logon and/or elevate should be considered "customized".
I am aware of enabling Sensitive Privilege Use auditing, then watching for Security log event ID 4673. For my purposes, an Azure AD SID (starting S-1-12-1-) is likely a human. However, I only need to find one entry to know this has happened. Besides, the added audit entries are noisy, scanning the Security log is slow and prone to failure due to logs rolling and the entries are not useful, in that they do not capture the information you would expect.
Is there any other way to detect when a human has elevated on a PC?