A solution is disclosed for intelligent configuration management of user devices that includes: receiving application performance data for a plurality of applications from each of a first plurality of tenant environments or cloud services or both, the application performance data including a program ID for at least one application of the plurality of applications; receiving incident alerts related to the first program ID from each of a second plurality of tenant environments; based at least on receiving the incident alerts, determining whether a count of the second plurality of tenant environments meets a threshold; and based at least on the count of the second plurality of tenant environments meeting the threshold, requesting incident reports related to the program ID from each of a third plurality of tenant environments, wherein the third plurality of tenant environments has a smaller count than the count of the second plurality of tenant environments.