# Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune.

Source: https://maester.dev/docs/tests/DISA.V-273868

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Intune · Tenant administration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-273868
```

## Overview

An Intune diagnostic setting sends the Intune audit logs to a log store outside Intune. (DISA Microsoft Intune MDM Service Desktop and Mobile STIG, V-273868, CAT II).

Intune keeps its audit logs for a limited time and only in the Intune admin center. Sending them to Azure Monitor or a SIEM keeps them and lets the security team review and alert on changes.

The STIG accepts a third-party log server or Azure Monitor. This test runs [MT.1100](https://maester.dev/docs/tests/MT.1100), which checks that an Intune diagnostic setting includes the audit logs; logs sent another way must be checked by hand.

#### Remediation action

1. In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Reports** > **[Diagnostic settings](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/DiagnosticsSettingsBlade)**.
2. Select **Add diagnostic setting**.
3. Select the **AuditLogs** category (and any other Intune logs you need) and send them to a Log Analytics workspace, a storage account, an event hub or a partner solution.
4. Select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop and Mobile STIG: V-273868](https://cyber.trackr.live/stig/Intune_MDM_Service_Desktop_&_Mobile/1/2/V-273868)
* [Send Intune log data to storage, event hubs, or Log Analytics](https://learn.microsoft.com/intune/intune-service/fundamentals/review-logs-using-azure-monitor)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-273868 |
| Severity | High |
| Suite | DISA |
| Product | Intune |
| Feature | Tenant administration |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop and Mobile STIG (version V1R2), requirement V-273868 |
| Supports controls | disa-stig-intune-mdm:V-273868, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2) |
| PowerShell test | [Test-MtDisaIntuneLogExport](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273868.ps1) |
| Services | Azure |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-273868.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273868.ps1)
- Documentation: [`tests/disa/Test.DISA.V-273868.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-273868.md)