Intune change tracking - Implementation

This site describes the implementation of the Intune change tracking Azure Workbook solution. Related Links:

• General information
• Operations guide

Quick start

1. Deploy Azure Log Analytics Workspace
2. Configure Intune diagnostics data and send to Log Analytics Workspace
3. Create a new Workbook and insert the Intune change tracking source code

1. Deploy Azure Log Analytics Workspace

1. Create a new Log Analytics Workspace

• Specify your Subscription
• Specify an existing Resource group or use an existing
• Give it a Name (e.g. LAW-IntuneAuditLogs-Location)
• Specify a Region

2. Configure Intune diagnostics settings and send to Log Analytics Workspace

1. Navigate to Endpoint Manager admin center > Tenant administration > Diagnostics settings and add diagnostics setting

2. Configure the settings

• Specify a suitable Diagnostic setting name
• Choose AuditLogs from the Categories
• Choose Send to Log Analytics Workspace and select the previously created Log Analytics Workspace from Destination details

3. Don't forget to click on Save

All Intune AuditLogs will now be sent to the LAW. It may take a few minutes to see the first data.

3. Create a new Workbook and insert the Intune change tracking source code

1. Navigate to the previously created Log Analytics Workspace or choose an existing one that has Intune Audit Logs connected, go to Workbooks and click on new

2. Click on the Advanced editor at the top

3. Insert the code from the Intune change tracking and click on Apply

4. Save the workbook

• Give it a suitable Title
• Select a Subscription
• Choose the Resource group, that you created earlier
• Choose a corresponding Location