メインコンテンツへスキップ

170: Remote Log Collection

Implementation Effort: Low to Medium
User Impact: Low

Overview​

Remote log collection in Intune allows administrators to collect diagnostics from supported managed devices without requiring physical access. This is useful for troubleshooting enrollment failures, policy application issues, app deployment problems, and some security-control misconfigurations.

In a Zero Trust operating model, remote diagnostics should be treated as a controlled support action. Collected data can contain device identifiers, configuration details, and other sensitive information, so the process should be role-scoped and purpose-driven.

Implementation Guidance​

Define when to use it​

  • Use collect diagnostics for targeted troubleshooting when policy reports or standard troubleshooting steps are insufficient.
  • Confirm which platforms and log bundles are supported in the current Intune release before documenting the workflow.
  • Train support teams on what remote diagnostics can and cannot answer so it is used efficiently.

Control access and storage​

  • Restrict the ability to collect diagnostics to approved support or engineering roles through Intune RBAC.
  • Document where diagnostic files are stored, how long they are retained, and who may access them.
  • Avoid collecting logs broadly or routinely when a smaller device sample can answer the question.

Use diagnostics in incident and support workflows​

  • Pair log collection with device status, configuration profile results, and Endpoint security reporting to speed root-cause analysis.
  • Record why logs were collected and the incident or ticket number associated with the action.
  • Purge or archive collected logs according to internal retention and privacy requirements.

Reference​