Microsoft Intune Compliance & Device Logs

Location

Description

Intune device management logs capturing device compliance state, configuration profile deployment results, app installation status, device enrollment events, remote action execution (wipe, lock, retire), and discovered application inventory.

Forensic Value

Intune logs reveal the security posture of endpoints during a breach. Non-compliant device status indicates missing patches, disabled encryption, or outdated antivirus that enabled the compromise. Device enrollment events from unexpected locations suggest attacker device registration. Remote wipe and lock action logs document containment actions taken during incident response. Application inventory identifies which apps were installed on compromised devices without requiring direct endpoint access.

Tools Required