You have a Microsoft 365 E5 subscription with devices enrolled in Microsoft Intune. You plan to use Device query to get on‑demand information about device state and must minimize costs. What should you do first?

The correct answer is to purchase the Intune Advanced Analytics add-on. Device query is a feature of Intune Advanced Analytics, which provides on-demand querying of device state using KQL (Kusto Query Language). This add-on is specifically designed for advanced device diagnostics and reporting, directly enabling the functionality described in the question. Using the Collect diagnostics remote action gathers logs but doesn't offer on-demand querying of device state. The Intune Suite add-on includes Advanced Analytics but is a broader, more expensive suite; purchasing only Advanced Analytics minimizes costs as requested. Onboarding devices to Endpoint analytics provides performance and health insights but does not offer the real-time, on-demand device state querying capability of Device query.