Skip to main content

007: Log Analytics

Implementation Effort: Medium – Requires diagnostic routing decisions, workspace governance, and coordination with security operations or SIEM owners.

User Impact: Low – End users are not directly affected; this is an administrative monitoring capability.

Overview​

Microsoft Intune diagnostic data can be sent to Azure Monitor so administrators and security teams can retain, query, alert on, and integrate device-management activity with broader operational and security monitoring. This is valuable for Zero Trust because device enrollment, compliance drift, administrative changes, and remediation activity should be observable and reviewable rather than hidden inside a single console. The goal is not just to collect logs, but to make device-management activity part of the organization’s monitoring and investigation workflow.

Implementation Guidance​

  1. Decide what questions the logging pipeline must answer, such as who changed a policy, which enrollments failed, which devices became noncompliant, or whether privileged actions occurred outside normal process.
  2. Configure Microsoft Intune diagnostic settings to send the required log categories to the correct Azure Monitor destination, such as Log Analytics, Storage, or Event Hubs, based on retention and integration requirements.
  3. Use Log Analytics when security or operations teams need searchable queries, workbooks, and alerts. Use Event Hubs when logs must flow into an external SIEM or downstream analytics platform.
  4. Restrict access to the workspace and exported data. Device and admin activity logs may contain sensitive operational details and should follow least-privilege reporting access.
  5. Build a small set of high-value alerts and saved queries first, such as privileged policy changes, spikes in enrollment failures, or sudden increases in noncompliant devices.
  6. Review retention, cost, and parsing strategy regularly. Logging is most useful when the organization knows which data is essential for investigations and compliance reporting.

Reference​