# Cis Azure Foundations 6.1.1.10

> Cis Azure Foundations 6.1.1.10 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure Intune logs are captured and sent to Log Analytics

- Skill name: `cis-azure-foundations-6.1.1.10`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-6.1.1.10/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure that Intune logs are captured and sent to Log Analytics

## Description

Ensure that Intune logs are captured and fed into a central log analytics workspace.

## Rationale

Intune includes built-in logs that provide information about your environments. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.

## Impact

A Microsoft Intune plan is required to access Intune. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size.

## Audit Procedure

### Using Azure Portal

1. Go to `Intune`.
2. Click `Reports`.
3. Under `Azure monitor`, click `Diagnostic settings`.
4. Next to each diagnostic setting, click `Edit setting`, and review the selected log categories and destination details.
5. Ensure that at least one diagnostic setting is configured to send the following logs to a Log Analytics workspace:
   - `AuditLogs`
   - `OperationalLogs`
   - `DeviceComplianceOrg`
   - `Devices`
   - `Windows365AuditLogs`

## Expected Result

At least one Intune diagnostic setting should exist that sends AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices, and Windows365AuditLogs to a Log Analytics workspace.

## Remediation

### Remediate from Azure Portal

1. Go to `Intune`.
2. Click `Reports`.
3. Under `Azure monitor`, click `Diagnostic settings`.
4. Click `+ Add diagnostic setting`.
5. Provide a `Diagnostic setting name`.
6. Under `Logs > Categories`, check the box next to each of the following logs:
   - `AuditLogs`
   - `OperationalLogs`
   - `DeviceComplianceOrg`
   - `Devices`
   - `Windows365AuditLogs`
7. Under `Destination details`, check the box next to `Send to Log Analytics workspace`.
8. Select a `Subscription`.
9. Select a `Log Analytics workspace`.
10. Click `Save`.

## Default Value

By default, Intune diagnostic settings do not exist.

## References

1. https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/review-logs-using-azure-monitor
2. https://www.microsoft.com/en-us/security/business/microsoft-intune-pricing
3. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs

## CIS Controls

| Controls Version | Control                    | IG 1 | IG 2 | IG 3 |
| ---------------- | -------------------------- | ---- | ---- | ---- |
| v8               | 8.2 Collect Audit Logs     | x    | x    | x    |
| v7               | 6.2 Activate audit logging | x    | x    | x    |

## Profile

Level 2 | Manual

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-foundations-6-1-1-10 (OpenParable). Cite the canonical URL above.