MT.1100 - Intune Diagnostic Settings should include Audit Logs

Contributed by Nicola Suter with Sam ErdeAll contributors →

Overview

This test checks for the existence of Intune Diagnostic settings collecting Intune Audit Logs.

Test Prerequisites

For this test to run, the executing principal must have permissions to read Intune diagnostic settings in Azure (microsoft.intune/diagnosticSettings/read action). This typically requires at least the 'Monitoring Reader' or 'Reader' Azure role assigned at the subscription level (for example, with scope /subscriptions/$SubscriptionId), which provides access to the provider-level Intune diagnostic settings.

Alternatively, you can create a custom RBAC role with the following snippet:

# Get the subscription ID and user ID from the current context. Change if necessary.
$SubscriptionId = "$((Get-AzContext).Subscription.Id)"
$UserId = (Get-AzADUser -UserPrincipalName (Get-AzContext).Account.Id).Id

$CustomRole = @{
    Name = 'Intune Diagnostic Settings Reader'
    Description = 'Can read Intune diagnostic settings only'
    Actions = @('microsoft.intune/diagnosticSettings/read')
    NotActions = @()
    AssignableScopes = @("/subscriptions/$SubscriptionId")
}

New-AzRoleDefinition -Role $CustomRole

# Assign the custom role at subscription level
New-AzRoleAssignment -ObjectId $UserId -RoleDefinitionName 'Intune Diagnostic Settings Reader' -Scope "/subscriptions/$SubscriptionId"

Remediation action

• Check the following Microsoft learn article to Send Intune log data to Azure Storage, Event Hubs, or Log Analytics.

• Existing diagnostic settings can be viewed within the Intune Diagnostics settings blade.

Test Metadata

Field	Value
Test ID	MT.1100
Severity	High
Suite	Maester
Product	Intune
Feature	Tenant administration
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports controls	nist-800-53-r5:AU-12
PowerShell test	Test-MtIntuneDiagnosticSettings
Services	Azure
Compatible licenses	INTUNE_A

Source

• Test: tests/maester/intune/Test.MT.1100.ps1
• Documentation: tests/maester/intune/Test.MT.1100.md