Control: 7.1.1.10 Ensure that Intune logs are captured and sent to Log Analytics

Description

Ensure that Intune logs are captured and fed into a central log analytics workspace.

Intune includes built-in logs that provide information about your environments. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.

Remediation

From Azure Portal

Go to Intune.
Click Reports.
Under Azure monitor, click Diagnostic settings.
Click + Add diagnostic setting.
Provide a Diagnostic setting name.
Under Logs > Categories, check the box next to each of the following logs:

AuditLogs
OperationalLogs
DeviceComplianceOrg
Devices
Windows365AuditLogs

Under Destination details, check the box next to Send to Log Analytics workspace.
Select a Subscription.
Select a Log Analytics workspace.
Click Save.

Default Value

By default, Intune diagnostic settings do not exist.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v400_7_1_1_10

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v400_7_1_1_10 --share

SQL

This control uses a named query:

select
  id as resource,
  'info' as status,
  'Manual verification required.' as reason,
  display_name as subscription
from
  azure_subscription;