{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "slug": "dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records", "url": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/" }, "title": "Build Intune log consumers for variable export times and duplicate records", "summary": "What timing and duplication assumptions should an Intune diagnostic-log consumer avoid?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:20+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 216, "potentially_affected": "Apply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.", "dse_recommendation": "DSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design.", "primary_source": { "name": "Route logs to Azure Monitor using Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Intune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. Microsoft Learn.

\n

Applicability

\n

Apply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.

\n

DSE recommendation

\n

DSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.

\n

Verification

\n

Test the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.

\n

Official references

\n

Microsoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics. Source reviewed September 17, 2026.

", "content_text": "Source facts\nIntune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. Microsoft Learn.\nApplicability\nApply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.\nDSE recommendation\nDSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.\nVerification\nTest the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.\nOfficial references\nMicrosoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nIntune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor).\n\n## Applicability\n\nApply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.\n\n## DSE recommendation\n\nDSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.\n\n## Verification\n\nTest the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.\n\n## Official references\n\n[Microsoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics](https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "url": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Build Intune log consumers for variable export times and duplicate records", "item": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "url": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/", "headline": "Build Intune log consumers for variable export times and duplicate records", "description": "What timing and duplication assumptions should an Intune diagnostic-log consumer avoid?", "abstract": "What timing and duplication assumptions should an Intune diagnostic-log consumer avoid?", "articleBody": "Source facts\nIntune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. Microsoft Learn.\nApplicability\nApply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.\nDSE recommendation\nDSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.\nVerification\nTest the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.\nOfficial references\nMicrosoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:20+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Build Intune log consumers for variable export times and duplicate records" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 216, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Route logs to Azure Monitor using Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor" } } ] } }