Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days

Contributed by Merill FernandoAll contributors →

Part of DISA · Intune · Tenant administration · All checks

Run this check

Invoke-Maester -TestId DISA.V-267334

Overview

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune. (DISA Microsoft Intune MDM Service Desktop STIG, V-267334, CAT II).

DISA asks that Intune logs are moved to another server at least every seven days. A diagnostic setting streams them continuously, which meets that.

This test runs MT.1100, which checks that an Intune diagnostic setting includes the audit logs. A site that exports the logs by hand must show that process instead.

Remediation action

1. In the Microsoft Intune admin center, go to Reports > Diagnostic settings.
2. Select Add diagnostic setting.
3. Select the AuditLogs category (and any other Intune logs you need) and send them to a Log Analytics workspace, a storage account, an event hub or a partner solution.
4. Select Save.

Related links

• DISA Microsoft Intune MDM Service Desktop STIG: V-267334
• Send Intune log data to storage, event hubs, or Log Analytics

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-267334
Severity	High
Suite	DISA
Product	Intune
Feature	Tenant administration
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267334
Supports controls	disa-stig-intune-desktop:V-267334, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2)
PowerShell test	Test-MtDisaIntuneDesktopLogExport
Services	Azure
Compatible licenses	INTUNE_A

Source

• Test: tests/disa/Test.DISA.V-267334.ps1
• Documentation: tests/disa/Test.DISA.V-267334.md