Check audit logs of changes in policy config - intune

Question

Check audit logs of changes in policy config - intune

Aran Billen 941

Hi all,

Is it possible to check who has been removing groups from configuration policies set in intune? I need to see as far back as 60 days ago?

glebgreenspan 2,245

Yes, it is possible to check who has been removing groups from configuration policies set in Intune. 


1. Sign in to the Azure portal (https://portal.azure.com) with your Azure AD administrator account.

2. In the left-hand menu, search for "Azure Active Directory" and open it.

3. In the Azure AD portal, go to "Audit logs" under the "Monitoring" section.

4. In the Audit logs blade, you can filter the logs using the "Activity" and "Date and time" filters.

   - Activity: Select the operations related to group removal, such as "Delete device configuration user group assignment", "Delete device configuration group assignment", or any relevant activity based on the action you want to track.

   - Date and time: Specify the time range you want to search, up to the past 60 days.

5. Click on the search button to view the audit logs related to the specified filters.

Aran Billen 941 Reputation points

2023-12-21T14:58:42.2266667+00:00

Hi these dont exsist: "Delete device configuration user group assignment", "Delete device configuration group assignment" any ideas?

Accepted answer

1 additional answer

Your answer

glebgreenspan 2,245 Reputation points

2023-12-21T14:44:36.66+00:00

Yes, it is possible to check who has been removing groups from configuration policies set in Intune. 1. Sign in to the Azure portal (https://portal.azure.com) with your Azure AD administrator account. 2. In the left-hand menu, search for "Azure Active Directory" and open it. 3. In the Azure AD portal, go to "Audit logs" under the "Monitoring" section. 4. In the Audit logs blade, you can filter the logs using the "Activity" and "Date and time" filters. - Activity: Select the operations related to group removal, such as "Delete device configuration user group assignment", "Delete device configuration group assignment", or any relevant activity based on the action you want to track. - Date and time: Specify the time range you want to search, up to the past 60 days. 5. Click on the search button to view the audit logs related to the specified filters.
Aran Billen 941 Reputation points

2023-12-21T14:58:42.2266667+00:00

Hi these dont exsist: "Delete device configuration user group assignment", "Delete device configuration group assignment" any ideas?

Answer 1

@Aran Billen,Thanks for posting in Q&A.

From your description, I know you want to check who has remove groups from configuration policies set in Intune.

Based on my testing, you can check audit logs in Intune to find who has removed groups from configuration policies set and set Filters to check logs 60 days ago.

Location: Microsoft Intune portal > Tenant administration > Audit logs.

User's image

Hope this can be helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi Aran Billen

Microsoft Intune provides some audit capabilities to track activities within the service, Here are some steps you can take to check who has been removing groups from configuration policies in Microsoft Intune,

Go to the Microsoft 365 Compliance Center.

Navigate to "Solutions" > "Audit" > "Audit log search.

In the Audit log search, you can filter for specific activities related to Intune.

Use filters such as "Operations" and "User" to narrow down the search.

guess the retention period is 90 days, but this can change, and it's essential to verify the current settings.

If this helps kindly accept the answer thanks much.

Share via

Check audit logs of changes in policy config - intune

1 additional answer

Your answer