MT.1100: Intune Diagnostic Settings should include Audit Logs


ID	`MT.1100`
Severity	High
Suite	Mito
Product	Intune
Feature	Tenant administration
Security area	Logging and detection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:AU-12` Audit Record Generation
MITRE ATT&CK	T1685.002
Reads from	Azure Resource Manager
Licence needed	`INTUNE_A`

What this checks and how to fix it

This test checks for the existence of Intune Diagnostic settings collecting Intune Audit Logs.

Test Prerequisites

For this test to run, the executing principal must have permissions to read Intune diagnostic settings in Azure (microsoft.intune/diagnosticSettings/read action). This typically requires at least the ‘Monitoring Reader’ or ‘Reader’ Azure role assigned at the subscription level (for example, with scope /subscriptions/$SubscriptionId), which provides access to the provider-level Intune diagnostic settings.

Alternatively, you can create a custom RBAC role with the following snippet:

# Get the subscription ID and user ID from the current context. Change if necessary.
$SubscriptionId = "$((Get-AzContext).Subscription.Id)"
$UserId = (Get-AzADUser -UserPrincipalName (Get-AzContext).Account.Id).Id

$CustomRole = @{
    Name = 'Intune Diagnostic Settings Reader'
    Description = 'Can read Intune diagnostic settings only'
    Actions = @('microsoft.intune/diagnosticSettings/read')
    NotActions = @()
    AssignableScopes = @("/subscriptions/$SubscriptionId")
}

New-AzRoleDefinition -Role $CustomRole

# Assign the custom role at subscription level
New-AzRoleAssignment -ObjectId $UserId -RoleDefinitionName 'Intune Diagnostic Settings Reader' -Scope "/subscriptions/$SubscriptionId"

Remediation action

Check the following Microsoft learn article to Send Intune log data to Azure Storage, Event Hubs, or Log Analytics.
Existing diagnostic settings can be viewed within the Intune Diagnostics settings blade.

Mito check. Author: nicolonsky; contributors: SamErde. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).