{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "slug": "dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload", "url": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/" }, "title": "Separate Configuration Manager analytics collection from cloud upload", "summary": "Does enabling local Endpoint analytics collection in Configuration Manager also authorize cloud upload?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:38+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 220, "potentially_affected": "Apply this review to Endpoint analytics for Configuration Manager-managed devices. Identify any co-management and custom client-settings assignments before following the corresponding configuration path.", "dse_recommendation": "Record local collection and cloud upload as separate configuration decisions.", "primary_source": { "name": "Configure Endpoint Analytics - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/endpoint-analytics/configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Configuration Manager’s Endpoint analytics client setting controls local collection, not whether that data is uploaded to the cloud. Cloud upload is configured separately. Enabling upload automatically updates the default client settings, but existing custom client settings may need updating and redeployment. Devices managed only by Configuration Manager do not require the Intune data collection policy. Microsoft Learn.

\n

Applicability

\n

Apply this review to Endpoint analytics for Configuration Manager-managed devices. Identify any co-management and custom client-settings assignments before following the corresponding configuration path.

\n

DSE recommendation

\n

Record local collection and cloud upload as separate configuration decisions. Have the service owner identify which devices should collect data, which should contribute to the cloud service and which client settings actually reach them. Inspect custom assignments instead of assuming a change to the default configuration reached every device. Keep the approved telemetry scope with the rollout record, and use the documented management path for each cohort.

\n

Verification

\n

In a controlled cohort, inspect the effective client setting, its deployment result and the separate upload configuration. Confirm that the intended devices produce the expected analytics data after processing. If data is missing, identify whether collection, assignment or upload is the unresolved step before broadening the target population. A local collection setting alone should not close the cloud-reporting acceptance check.

\n

Official references

\n

Microsoft Learn: Configure Endpoint Analytics.

", "content_text": "Source facts\nConfiguration Manager’s Endpoint analytics client setting controls local collection, not whether that data is uploaded to the cloud. Cloud upload is configured separately. Enabling upload automatically updates the default client settings, but existing custom client settings may need updating and redeployment. Devices managed only by Configuration Manager do not require the Intune data collection policy. Microsoft Learn.\nApplicability\nApply this review to Endpoint analytics for Configuration Manager-managed devices. Identify any co-management and custom client-settings assignments before following the corresponding configuration path.\nDSE recommendation\nRecord local collection and cloud upload as separate configuration decisions. Have the service owner identify which devices should collect data, which should contribute to the cloud service and which client settings actually reach them. Inspect custom assignments instead of assuming a change to the default configuration reached every device. Keep the approved telemetry scope with the rollout record, and use the documented management path for each cohort.\nVerification\nIn a controlled cohort, inspect the effective client setting, its deployment result and the separate upload configuration. Confirm that the intended devices produce the expected analytics data after processing. If data is missing, identify whether collection, assignment or upload is the unresolved step before broadening the target population. A local collection setting alone should not close the cloud-reporting acceptance check.\nOfficial references\nMicrosoft Learn: Configure Endpoint Analytics.", "content_markdown": "## Source facts\n\nConfiguration Manager’s Endpoint analytics client setting controls local collection, not whether that data is uploaded to the cloud. Cloud upload is configured separately. Enabling upload automatically updates the default client settings, but existing custom client settings may need updating and redeployment. Devices managed only by Configuration Manager do not require the Intune data collection policy. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/endpoint-analytics/configure).\n\n## Applicability\n\nApply this review to Endpoint analytics for Configuration Manager-managed devices. Identify any co-management and custom client-settings assignments before following the corresponding configuration path.\n\n## DSE recommendation\n\nRecord local collection and cloud upload as separate configuration decisions. Have the service owner identify which devices should collect data, which should contribute to the cloud service and which client settings actually reach them. Inspect custom assignments instead of assuming a change to the default configuration reached every device. Keep the approved telemetry scope with the rollout record, and use the documented management path for each cohort.\n\n## Verification\n\nIn a controlled cohort, inspect the effective client setting, its deployment result and the separate upload configuration. Confirm that the intended devices produce the expected analytics data after processing. If data is missing, identify whether collection, assignment or upload is the unresolved step before broadening the target population. A local collection setting alone should not close the cloud-reporting acceptance check.\n\n## Official references\n\n[Microsoft Learn: Configure Endpoint Analytics](https://learn.microsoft.com/en-us/intune/endpoint-analytics/configure)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "url": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate Configuration Manager analytics collection from cloud upload", "item": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "url": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/", "headline": "Separate Configuration Manager analytics collection from cloud upload", "description": "Does enabling local Endpoint analytics collection in Configuration Manager also authorize cloud upload?", "abstract": "Does enabling local Endpoint analytics collection in Configuration Manager also authorize cloud upload?", "articleBody": "Source facts\nConfiguration Manager’s Endpoint analytics client setting controls local collection, not whether that data is uploaded to the cloud. Cloud upload is configured separately. Enabling upload automatically updates the default client settings, but existing custom client settings may need updating and redeployment. Devices managed only by Configuration Manager do not require the Intune data collection policy. Microsoft Learn.\nApplicability\nApply this review to Endpoint analytics for Configuration Manager-managed devices. Identify any co-management and custom client-settings assignments before following the corresponding configuration path.\nDSE recommendation\nRecord local collection and cloud upload as separate configuration decisions. Have the service owner identify which devices should collect data, which should contribute to the cloud service and which client settings actually reach them. Inspect custom assignments instead of assuming a change to the default configuration reached every device. Keep the approved telemetry scope with the rollout record, and use the documented management path for each cohort.\nVerification\nIn a controlled cohort, inspect the effective client setting, its deployment result and the separate upload configuration. Confirm that the intended devices produce the expected analytics data after processing. If data is missing, identify whether collection, assignment or upload is the unresolved step before broadening the target population. A local collection setting alone should not close the cloud-reporting acceptance check.\nOfficial references\nMicrosoft Learn: Configure Endpoint Analytics.", "datePublished": "2026-09-10T00:28:38+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-198-separate-configuration-manager-analytics-collection-from-cloud-upload/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Configuration Manager analytics collection from cloud upload" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 220, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Endpoint Analytics - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/endpoint-analytics/configure" } } ] } }