> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/quick-start/step-8-intune-optional.md).

# Step 8 — Intune (Optional)

Microsoft Intune manages your organization's devices. It can push apps and scripts to every device, or wipe them remotely. That makes Intune admin access a powerful target: an attacker who gets it can take over or wipe every device at once.

We collect **only Intune audit logs**, which record admin actions. Compliance reports and device inventory are IT operations data, not security signals, so we leave them out.

{% hint style="info" %}
**Time:** about 5 minutes
{% endhint %}

### Before you start

* **Step 1 — Event Hub Setup** is complete
* **Intune Administrator** or **Global Administrator**
* **Contributor** (or Owner) on the Event Hub namespace

### 1. Add a diagnostic setting

1. Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com).
2. Go to **Reports** → **Diagnostic settings**. If prompted, turn the feature on.
3. Select **+ Add diagnostic setting**.
4. **Diagnostic setting name:** siem-intune
5. Under **Logs**, select **AuditLogs** only.
6. Check **Stream to an event hub**, then select:
   * **Event hub namespace:** your namespace from Step 1
   * **Event hub name:** **intune-logs**
   * **Event hub policy name:** **RootManageSharedAccessKey**
7. Select **Save**.

| Category                | Collect? | Why                                                           |
| ----------------------- | -------- | ------------------------------------------------------------- |
| **AuditLogs**           | **Yes**  | Admin actions such as wipes, scripts and policy changes       |
| **OperationalLogs**     | No       | Enrollment and compliance status, which is IT operations data |
| **DeviceComplianceOrg** | No       | Compliance reporting                                          |
| **Devices**             | No       | Device inventory                                              |

### What your SOC can detect with these logs

* **Remote wipes or retires**, especially many devices at once
* **Scripts or apps pushed** to devices by an unexpected admin
* **Compliance or security policies** changed or removed
* **Intune admin roles** granted to new accounts
* Intune changes made by an account that also shows risky sign-ins (Step 2)

{% hint style="info" %}
**Extra protection:** Intune's **Multi Admin Approval** requires a second admin to approve high-impact actions like wipes and script deployments. It's worth turning on so a single compromised account can't wipe every device.
{% endhint %}

### Verify

1. Make a harmless change in Intune, such as editing the description of a test policy.
2. In the Azure portal, open the Event Hub namespace → **intune-logs** → **Overview**, and confirm **Incoming Messages** shows activity.
3. In your SIEM, search for the change. It may take up to 30 minutes to appear.

## Related

* [Step 7 — Azure](/quick-start/step-7-azure-defender-for-cloud.md) — Defender for Cloud and the Azure Activity Log
* [Quick Start](/quick-start/getting-started.md) — Back to the full checklist
* [Get Extra Help](/get-expert-help/overview.md)— Want to harden Intune and Entra ID together? AOHWV can help


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://msdocs.aohwv.com/quick-start/step-8-intune-optional.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.