(50) Audit logs to track and monitor events in Microsoft Intune

To ensure that an organisation can check what or who has made changes to the environment, you can implement the following: https://learn.microsoft.com/en-us/mem/intune/fundamentals/monitor-audit-logs

The steps are as follows to set this up:

1. Navigate to https://portal.azure.com, then in search enter in Log Analytics workspace

2. Select Create.

3. Then enter in the following:

Subscription: <Select if you more than one>

Resource group: intune-logs <use existing>

Name: intune-logs

Region: <Select the region>

4. Select Next then select Open resource.

5. Next navigate to https://endpoint.microsoft.com/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/diagnostics. Select Add diagnostic setting.

6. Then select the following.

Categories: AuditLogs and OperationLogs

Destintation details:

Tick "Send to Log Analytics workspace" with the following that was setup earlier.

Then select Save.

7. Now it is time to test, make any changes within your environment. Navigate to https://endpoint.microsoft.com/#view/Microsoft_Intune_DeviceSettings/TenantAdminMenu/~/auditing to view the logs