Intune Diagnostic Settings supported in GCC High?

Question

Is Intune Diagnostic Settings supported in GCC High? In commercial we have Tenant Administration → Diagnostic Settings and can export AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices, and Windows365AuditLogs to Event Hub. The Diagnostic Settings menu is not present in our GCC High tenant. Is this expected, and what is the supported equivalent?

Answer 1

Hello Ryan Smith

Yes, Intune Diagnostic settings are fully supported in GCC High (and DoD). The feature is not missing from the service, it's just that the menu location and the destination requirements are slightly different from commercial. You should be able to export the same log categories (AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices, Windows365AuditLogs) to an Event Hub, Storage account, or Log Analytics workspace, as long as the destination lives in Azure Government.

1. Where the menu lives in GCC High:

The blade was moved in the Intune admin center a while back. It is no longer under Tenant administration. In both commercial and GCC High tenants, the current path is:

Microsoft Intune admin center → Reports → Diagnostics settings → Add diagnostic setting

For GCC High, sign in at https://intune.microsoft.us (not intune.microsoft.com). If you were looking under Tenant administration, that's why the menu appeared to be missing this is the same reason commercial admins sometimes report it "disappeared."

The supported log categories in GCC High are the same as commercial: AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices, and the Windows365AuditLogs category (for tenants with Windows 365 Cloud PC).

2. Prerequisites (important gotcha for GCC High):

• An Azure subscription the signed-in admin can access.
• The Intune Administrator Microsoft Entra role (or an Intune role with Audit data – Read).
• The destination resource:
• Storage account (with ListKeys) – for archival, or
• Event Hubs namespace – for SIEM streaming (Splunk, QRadar, Sentinel, etc.), or
  • Log Analytics workspace – for KQL/alerting.

The critical GCC High constraint: the destination Storage account / Event Hub / Log Analytics workspace must be in an Azure Government region (e.g., USGov Virginia or USGov Texas) and reached via portal.azure.us, not portal.azure.com. If an admin happens to have access to a commercial Azure subscription and picks a commercial workspace/Event Hub as the destination, the diagnostic setting can appear to save successfully but no data will flow. Always confirm the destination is an Azure Government resource.

This is consistent with Microsoft's Intune US Government service description, which notes that the GCC High and DoD offerings are built on Microsoft Azure Government Cloud and are designed to interoperate with Microsoft 365 GCC High/DoD environments, so Azure-side integrations (like diagnostic export to Event Hub / Log Analytics) must terminate in Azure Government.

3. Steps to configure in GCC High
4. Sign in to https://intune.microsoft.us as an Intune Administrator.
5. Go to Reports → Diagnostics settings → + Add diagnostic setting.
6. Give it a name.
7. Under Categories, select the logs you want (AuditLogs, OperationalLogs, DeviceComplianceOrg, Devices, Windows365AuditLogs).
8. Under Destination details, pick one or more:
   • Send to Log Analytics workspace → select your Azure Government subscription and a workspace in USGov Virginia / USGov Texas.
     • Stream to an event hub → select your Azure Government Event Hub namespace.
       • Archive to a storage account → select an Azure Government storage account.
9. Save, then validate ingestion (e.g., in Log Analytics: IntuneAuditLogs | take 10 after 15–30 minutes).

References:

• Send Intune log data to Azure Storage, Event Hubs, or Log Analytics
• Microsoft Intune for US Government GCC High and DoD service description

Thanks,
Suchitra.

Answer 2

Yes—Intune diagnostic export is supported in GCC High. Microsoft’s government service description explicitly lists sending Intune logs to Azure Storage, Event Hubs, or Log Analytics as supported. The current path is Reports > Diagnostics settings, not Tenant administration > Diagnostic settings.

Sign in to the GCC High Intune admin center, open Reports, and look for Diagnostics settings. Use an account with the Intune Administrator role and confirm it can access the Azure Government subscription and destination. Create the Event Hubs namespace, storage account, or Log Analytics workspace first; then add a diagnostic setting and select the required log categories. If the subscription is missing, use Switch directory and verify destination permissions.

If Reports still does not show Diagnostics settings, this is not the expected GCC High limitation. Capture the tenant ID, role assignments, and screenshots, then open Microsoft Intune support because tenant-specific provisioning or UI investigation is required.

Answer 3

Hi ,

Thanks for reaching out to Microsoft Q&A

This is expected. Intune Diagnostic Settings (the azure monitor based export to Event Hub/Log Analytics) is not currently available in GCC High. That capability relies on underlying Azure services and APIs that are only exposed in commercial and, in some cases, GCC environments, but not in GCC High due to compliance and service boundary constraints. In GCC High, the supported alternative is to use Microsoft 365 Unified Audit Logs (via Purview audit) for audit data and Graph API based reporting/export (including Intune reports and data warehouse exports where available) for operational/device insights. If you need SIEM integration, the typical pattern is pulling data via O365 management activity API or Graph and pushing it into your downstream system rather than using native Diagnostic Settings.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.