Ingest Microsoft Intune logs into Microsoft Sentinel

Last updated on 5. December 2022

---

Introduction

With Microsoft Intune you can manage most of your endpoints like Windows 10/11, Android, iOS, macOS and the newest operating systems: Chrome and Linux Ubuntu. For security purposes it is a good idea to monitor changes, onboardings and compliance of devices. We will go through the configuration of redirecting the diagnostic settings into Log Analytic workspace. Once we are done with the setup, we take a look at the tables that have been created. Last but not least I will provide some KQL queries you can use for your environment.

---

Table of Contents

• Introduction
• Prerequisites
• Configuration
• KQL
• Conclusion

---

Prerequisites

Before we dive into the configuration, you have to check, if you have the following preparations:

• An Intune license
• Permission for Intune tenant (Global Administrator or Intune Service Administrator)
• An Azure subscription
• A Log Analytic workspace (we assume that Microsoft Sentinel is in use)
  • Permission to Log Analytic workspace

---

Configuration

Open Microsoft Intune under https://endpoint.microsoft.com, navigate to Reports 🡪 Diagnostic settings and click on Add diagnostic settings.

On the next page you enter the needed information. Enter a Diagnostic setting name. If you have multiple destinations, it is a good idea to define in the name, where the logs are going to. At Categories section I choose all, because the number of logs will not be so high, that I must care about costs. On Destination details choose your Log Analytic workspace in which the Microsoft Sentinel solution is installed.

After you completed the configuration, the data will flow into your chosen Log Analytic workspace. Next we will look at the tables that will be generated and which data we can find there.

---

KQL

The following tables get filled with data:

• IntuneAuditLogs
  • Shows everything that generates a change in Intune
• IntuneDeviceComplianceOrg
  • Shows details about compliant and non-compliant devices in organization
• IntuneDevices
  • Shows information about status and inventory of Intune enrolled and managed devices
• IntuneOperationalLogs
  • Information about failed and successful enrollments of devices and compliance state. Including user information

Getting information, which operations (create, delete, …) were performed the last 7 days:

IntuneAuditLogs
| where TimeGenerated >= ago(7d)
| extend SplitOperationName = split(OperationName, " ")
| project-away OperationName
| extend Operation = tostring(SplitOperationName[0]), OperationName = SplitOperationName[1]
| project-away SplitOperationName
| summarize count() by Operation
| render barchart 

Check which operation (ClientCertificate, MobileApp, …) occurred the last 7 days:

IntuneAuditLogs
| where TimeGenerated >= ago(7d)
| extend SplitOperationName = split(OperationName, " ")
| project-away OperationName
| extend Operation = tostring(SplitOperationName[0]), OperationName = tostring(SplitOperationName[1])
| project-away SplitOperationName
| summarize count() by OperationName
| render barchart 

Check the compliance state of the last 30 days:

IntuneDeviceComplianceOrg
| where TimeGenerated >= ago(30d)
| summarize count() by ComplianceState, bin(TimeGenerated, 1d)
| render timechart 

If you want to filter the compliance state by operating system, you can use the following query:

let FilterOS = "Windows"; //Possible Windows, iOS, Android,
IntuneDeviceComplianceOrg
| where TimeGenerated >= ago(30d)
| where OSDescription == FilterOS
| summarize count() by ComplianceState, bin(TimeGenerated, 1d)
| render timechart 

Checking Autopilot enrollment for the last 30 days:

IntuneOperationalLogs 
| where TimeGenerated >= ago(30d)
| extend Autopilot = tostring(parse_json(Properties).IsAutopilot)
| where Autopilot =~ "True"
| summarize count() by Result
| render piechart 

If you want to check the successful enrollments of the last 30 days including user information:

IntuneOperationalLogs 
| where TimeGenerated >= ago(30d)
| where OperationName == "Enrollment" and Result == "Success"
| extend DeviceId = tostring(parse_json(Properties).IntuneDeviceId)
| join kind=leftouter IntuneDevices on DeviceId
| project DeviceName, DeviceId, UPN, OS, Result, CompliantState, Ownership, Manufacturer, Model, SerialNumber

To check out the code examples, you can find them at my GitHub: Andreas Rogge SentinelKQL

---

Conclusion

You can get a lot of information from the logs and it is even better to create your own workbooks to keep track of changes inside your environment. To get a better understanding of Microsoft Intune, I want to recommend you the blog of my good friend Daniel Reinartz: Cloudodidactic.com. There you’ll find everything about Endpoint Management and Microsoft Intune. Check it out or connect with him directly at LinkedIn and Twitter.

Finally, you can also connect with me on LinkedIn, Twitter and Mastodon. If you have questions or recommendations, please contact me or leave a comment 😊.

📢 By the way: I’m running out of ideas for new blog posts and need your help. Feel free to suggest your topics you’re interested in. Thx in advance 😊.