Collect Azure MDM Intune logs

This document explains how to collect Microsoft Azure Intune logs to Google Security Operations. You can configure ingestion using two methods: the Third Party API (recommended) or Microsoft Azure Blob Storage V2.

Microsoft Intune is a cloud-based endpoint management solution that manages user access to organizational resources and simplifies app and device management across devices including mobile devices, desktop computers, and virtual endpoints.

Before you begin

Ensure that you have the following prerequisites:

• A Google SecOps instance
• Privileged access to the Microsoft Azureportal
• A user with the Intune Administratoror Global AdministratorMicrosoft Entra role for the Intune tenant
• An active Intune license for the tenant

Method 1: Third Party API (recommended)

This method uses the Microsoft Graph API to retrieve Intune audit and operational logs directly from your Microsoft tenant.

Configure Microsoft Entra app registration

Create app registration

1. Sign in to the Microsoft Entra admin center or Azure portal .
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Provide the following configuration details:
   • Name: Enter a descriptive name (for example, Google SecOps Intune Integration ).
   • Supported account types: Select Accounts in this organizational directory only (Single tenant).
   • Redirect URI: Leave blank (not required for service principal authentication).
5. Click Register.
6. After registration, copy and save the following values from the Overviewpage:
   • Application (client) ID
   • Directory (tenant) ID

Configure API permissions

1. In the app registration, go to API permissions.
2. Click Add a permission.
3. Select Microsoft Graph > Application permissions.
4. Search for and select the following permissions:
   • DeviceManagementApps.Read.All
   • DeviceManagementConfiguration.Read.All
   • DeviceManagementManagedDevices.Read.All
   • DeviceManagementServiceConfig.Read.All
   • DeviceManagementRBAC.Read.All
5. Click Add permissions.
6. Click Grant admin consent for [Your Organization].

7. Verify that the Statuscolumn shows Granted for [Your Organization]for all permissions.

Required API permissions

Create client secret

1. In the app registration, go to Certificates & secrets.
2. Click New client secret.

3. Provide the following configuration details:

   • Description: Enter a descriptive name (for example, Google SecOps Feed ).

   • Expires: Select an expiration period.

4. Click Add.

5. Copy the client secret Valueimmediately.

Configure a feed in Google SecOps to ingest Microsoft Intune logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, Microsoft Intune Logs ).
5. Select Third Party APIas the Source type.
6. Select Microsoft Intuneas the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • OAuth Client ID: Enter the Application (client) IDfrom the app registration (for example, 1234abcd-1234-abcd-1234-abcd1234abcd ).
   • OAuth Client Secret: Enter the client secret valueyou copied earlier.
   • Tenant ID: Enter the Directory (tenant) IDfrom the app registration in UUID format (for example, 0fc279f9-fe30-41be-97d3-abe1d7681418 ).

   • API Full Path: Enter the Microsoft Graph REST API endpoint URL. Default value:

      graph.microsoft.com/beta/deviceManagement/auditEvents 
     

   • API Authentication Endpoint: Enter the Microsoft Active Directory authentication endpoint. Default value:

      login.microsoftonline.com 
     

   • Asset namespace: The asset namespace .

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalizescreen, and then click Submit.

After setup, the feed begins to retrieve Intune audit and operational logs from the Microsoft Graph API.

Regional endpoints

For Microsoft Intune deployments in sovereign clouds, use the appropriate regional endpoints:

Method 2: Microsoft Azure Blob Storage V2

This method collects Microsoft Intune logs by exporting diagnostic data to an Azure Storage Account and configuring a Google SecOps feed to ingest from Azure Blob Storage.

Configure Azure Storage Account

Create Storage Account

1. In the Azure portal, search for Storage accounts.
2. Click + Create.

3. Provide the following configuration details:

   Setting	Value
   Subscription	Select your Azure subscription
   Resource group	Select existing or create new
   Storage account name	Enter a unique name (for example, intunelogs )
   Region	Select the region (for example, East US )
   Performance	Standard (recommended)
   Redundancy	GRS (Geo-redundant storage) or LRS (Locally redundant storage)

4. Click Review + create.

5. Review the overview and click Create.

6. Wait for the deployment to complete.

Get Storage Account credentials

1. Go to the Storage Accountyou created.
2. In the left navigation, select Access keysunder Security + networking.
3. Click Show keys.
4. Copy and save the following:
   • Storage account name: The name you provided during creation.
   • Key 1or Key 2: The shared access key.

Get Blob Service endpoint

1. In the same Storage Account, select Endpointsfrom the left navigation.
2. Copy and save the Blob serviceendpoint URL.
   • Example: https://intunelogs.blob.core.windows.net/

Configure Microsoft Intune Diagnostic Settings

1. Sign in to the Microsoft Intune admin center.
2. Select Reports > Diagnostic settings.
3. Click Add diagnostic setting.
4. Provide the following configuration details:
   • Diagnostic setting name: Enter a descriptive name (for example, export-to-secops ).
   • In the Logssection, select the following categories:
     • AuditLogs
     • OperationalLogs
     • DeviceComplianceOrg
     • Devices
   • In the Destination detailssection, select the Archive to a storage accountcheckbox.
   • Subscription: Select the subscription containing your storage account.
   • Storage account: Select the storage account you created earlier.

5. Click Save.

Configure a feed in Google SecOps to ingest Microsoft Intune logs from Blob Storage

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, Microsoft Intune Blob Storage ).
5. Select Microsoft Azure Blob Storage V2as the Source type.
6. Select Microsoft Intuneas the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Azure URI: Enter the Blob Service endpoint URL with the container path. Create separate feeds for each log category:

     • For Audit Logs:

        https://<storage-account>.blob.core.windows.net/insights-logs-auditlogs/ 
       

     • For Operational Logs:

        https://<storage-account>.blob.core.windows.net/insights-logs-operationallogs/ 
       

     • For Device Compliance Organizational Logs:

        https://<storage-account>.blob.core.windows.net/insights-logs-devicecomplianceorg/ 
       

     • For Devices:

        https://<storage-account>.blob.core.windows.net/insights-logs-devices/ 
       

     Replace <storage-account> with your Azure storage account name.

   • Source deletion option: Select the deletion option according to your preference:

     • Never: Never deletes any files after transfers
     • Delete transferred files: Deletes files after successful transfer
     • Delete transferred files and empty directories: Deletes files and empty directories after successful transfer

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • Shared key: Enter the shared access key value from the Storage Account.

   • Asset namespace: The asset namespace .

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalizescreen, and then click Submit.

11. Repeat steps 1-10 to create additional feeds for each Intune log category container.

Configure Azure Storage firewall (if enabled)

If your Azure Storage Account uses a firewall, you must add Google SecOps IP ranges.

1. In the Azure portal, go to your Storage Account.
2. Select Networkingunder Security + networking.
3. Under Firewalls and virtual networks, select Enabled from selected virtual networks and IP addresses.
4. In the Firewallsection, under Address range, click + Add IP range.
5. Add each Google SecOps IP range in CIDR notation.
   • See IP Allowlisting documentation
   • Or retrieve them programmatically using the Feed Management API
6. Click Save.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.