Build Intune log consumers for variable export times and duplicate records

Source facts

Intune sends audit and operational logs immediately, while device-compliance organizational and device-inventory exports run once per 24-hour period and can take up to 48 hours to be sent. Microsoft does not guarantee a fixed daily export time and warns that the pipeline can duplicate an entire day’s published data. Microsoft Learn.

Applicability

Apply this review to reporting or automation that consumes Intune diagnostic exports through Azure Monitor services. Identify the actual log category before deciding when an expected record is overdue.

DSE recommendation

DSE recommends documenting freshness expectations by category and making duplicate handling part of the consumer design. Keep source timestamps and ingestion timestamps available for investigation. Define how a report identifies its latest complete observation period, and require an explicit completeness check before automation acts on missing devices or apparent changes.

Verification

Test the consumer with delayed and repeated copies of a representative approved export. Confirm that duplicate input does not double the reported population or repeat an operational action. Review the freshness label when a new export has not arrived, and retain the expected behavior with the test evidence. Escalate a missed delivery against the documented window rather than a habitual clock time.

Official references

Microsoft Learn: Send Intune log data to Azure Storage, Event Hubs, or Log Analytics. Source reviewed September 17, 2026.