# Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune. (DISA Microsoft Intune MDM Service Desktop STIG, V-267334, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-267334

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Intune · Tenant administration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-267334
```

## Overview

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune. (DISA Microsoft Intune MDM Service Desktop STIG, V-267334, CAT II).

DISA asks that Intune logs are moved to another server at least every seven days. A diagnostic setting streams them continuously, which meets that.

This test runs [MT.1100](https://maester.dev/docs/tests/MT.1100), which checks that an Intune diagnostic setting includes the audit logs. A site that exports the logs by hand must show that process instead.

#### Remediation action

1. In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Reports** > **[Diagnostic settings](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/DiagnosticsSettingsBlade)**.
2. Select **Add diagnostic setting**.
3. Select the **AuditLogs** category (and any other Intune logs you need) and send them to a Log Analytics workspace, a storage account, an event hub or a partner solution.
4. Select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop STIG: V-267334](https://cyber.trackr.live/stig/Intune_Service_Desktop/1/1/V-267334)
* [Send Intune log data to storage, event hubs, or Log Analytics](https://learn.microsoft.com/intune/intune-service/fundamentals/review-logs-using-azure-monitor)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-267334 |
| Severity | High |
| Suite | DISA |
| Product | Intune |
| Feature | Tenant administration |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267334 |
| Supports controls | disa-stig-intune-desktop:V-267334, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2) |
| PowerShell test | [Test-MtDisaIntuneDesktopLogExport](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267334.ps1) |
| Services | Azure |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-267334.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267334.ps1)
- Documentation: [`tests/disa/Test.DISA.V-267334.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267334.md)