Retrieve Intune device diagnostics before the collection expires

Source facts

Intune retains a device diagnostic collection for 28 days and permits up to ten stored collections per device. The device must be online and able to reach the service; failure to receive the action within 24 hours can cause collection failure. Regional upload endpoints must be reachable. Diagnostics can include identifiable user or device names. Microsoft Learn.

Applicability

This brief concerns the Windows corporate-owned device collection workflow. Review its platform and permission requirements separately from mobile application diagnostics, and identify the tenant’s region before investigating upload connectivity.

DSE recommendation

Give each collection a case owner, target device identity, and download deadline. Ask that owner to retrieve the package promptly rather than treating the portal as a permanent case archive. Store the download under the organization’s approved access and retention controls. Keep the raw package out of broadly visible tickets; describe the fault and collection status without copying personal information unnecessarily.

Verification

Check the action status and obtain the completed package through the device diagnostics view. Confirm that the archive opens and contains evidence relevant to the reported failure and device. For a failed collection, establish whether the device received the action and could reach the documented regional destination before repeating it. Record the collection and retrieval times so an investigator can distinguish missing evidence from a system that was actually examined.

Official references

Microsoft Learn: Device Action: Collect Diagnostics.