topic Re: Microsoft Intune Data in All Apps and Add-ons

Is there a way to get Microsoft Intune (Azure) data into Splunk?

davidblizzard — Thu, 23 Mar 2023 14:15:32 GMT

Is there a way to get Microsoft Intune (Azure) data into Splunk? Things like compliance, inventory, last check-in, etc.

Thanks!

Re: Microsoft Intune Data

hijacob — Wed, 05 Dec 2018 13:31:32 GMT

Hello David,

maybe you get some help on the following link https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureazureappaccount

Best wishes,
Jacob

Re: Microsoft Intune Data

hijacob — Tue, 11 Dec 2018 09:43:37 GMT

Does it work now?

Re: Microsoft Intune Data

davidblizzard — Tue, 11 Dec 2018 18:25:46 GMT

Sorry for the delayed response.

Thanks for the response. I've had that working for a while. However I just don't see any way to get Intune data specifically. I'm still on the hunt.

Thanks!

Re: Microsoft Intune Data

pmprabu — Mon, 23 Mar 2020 15:32:27 GMT

Hi David, Please let me know whether you are able to send the Intune logs to Splunk?

Re: Microsoft Intune Data

robert_miller — Fri, 17 Apr 2020 14:33:53 GMT

I am also looking for Intune logs.

Re: Microsoft Intune Data

ashisrma — Mon, 11 May 2020 07:04:37 GMT

Hey guys. have you all able to ingest intune logs into splunk i have been looking for the same.

Regards

Re: Microsoft Intune Data

shivanshu1593 — Mon, 11 May 2020 08:46:30 GMT

Everyone looking for Intune's integration with Splunk, this is one of the ways, with which you can do it. If you don't want to do it via azure monitor, then you can use storage accounts to dump Intune's data and get it from there via REST APIs calls.

Step 1: Send you Intune logs to Azure Monitor using this link: https://docs.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor

Step 2: Start monitoring logs from Azure Monitor into Splunk. You can refer to this link to monitor them: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-splunk

Let me know if it helps.

Re: Microsoft Intune Data

triest — Thu, 18 Jun 2020 14:53:44 GMT

Not an answer, but potentially of interest.

The current Splunk mobile app does not (June 2020) officially support being wrapped by InTune, but there is a feature request on ideas to support it. https://ideas.splunk.com/ideas/CONNID-I-13

Re: Microsoft Intune Data

hansuleberg — Mon, 25 Jan 2021 13:57:50 GMT

Hi. Did anyone found a solution?
We are also interested in getting the windows intune audit and compliance logs + we would like End Point Manager Center devices, discovered apps and security settings etc.

I found these Microsoft Docs:

Device inventory: https://docs.microsoft.com/en-us/mem/intune/remote-actions/device-inventory
Use Graphs API: https://docs.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0
Article from MVP dated 2018: https://msendpointmgr.com/2018/10/10/export-microsoft-intune-audit-data-to-log-analytics-using-graph-api-and-azure-automation/

Anyone done this, or haveing info on spluink addon/apps to request this data?

We might try the last link, to get the events into Azure Event Hub, and poll them there.

Re: Microsoft Intune Data

jkens — Thu, 23 Mar 2023 01:20:19 GMT

Im also trying to get Intune data to splunk. any luck?

Re: Microsoft Intune Data

JRW — Tue, 18 Jul 2023 16:59:26 GMT

Intune logs can be sent to an Event Hub - https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor - and then Splunk Add-on for Microsoft Cloud Services to ingest the Intune events into Splunk