# Build Intune log consumers for variable export times and duplicate records

> What timing and duplication assumptions should an Intune diagnostic-log consumer avoid?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:20+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

What timing and duplication assumptions should an Intune diagnostic-log consumer avoid?

## Potentially affected

Apply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.

## DSE recommendation

DSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design.

## Article

## Source facts

Intune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor).

## Applicability

Apply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.

## DSE recommendation

DSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.

## Verification

Test the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.

## Official references

[Microsoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics](https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor). Source reviewed September 17, 2026.

## Primary reference

- Name: Route logs to Azure Monitor using Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/governance/integrate-azure-monitor
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Build Intune log consumers for variable export times and duplicate records,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-040-build-intune-log-consumers-for-variable-export-times-and-duplicate-records/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.