Where to Find Intune and Windows 10 MDM Logs
Question details
Intune administrators need to locate activity, audit, sign-in, and local device logs for Windows 10 computers enrolled via MDM for troubleshooting and monitoring purposes.
- Product
- Microsoft Intune / Windows 10 MDM
- Device & OS
- Windows 10
- Scenario
- Administrators need to track user activity, diagnose device enrollment issues, and monitor compliance using system logs.
- Observed behavior
- Administrators are looking for the exact paths and portals to view Intune audit logs, local MDM diagnostics, and user sign-in events.
Ensure you have administrator access to the Microsoft Intune admin center and proper permissions to access local files on the target Windows 10 device.
View Intune Audit Logs in the Admin Center
Use the Microsoft Intune admin center to track administrative activities and audit logs.
The Microsoft Intune admin center is the primary portal for viewing tenant-wide administrative activities and audit logs. Note that a trial licensing status does not necessarily prevent access to these logs.
Open your web browser and sign in to the Microsoft Intune admin center with your administrator credentials.
In the left-hand navigation pane, select 'Tenant administration', then click on 'Audit logs'.
Use the built-in filters to find specific activities, dates, or administrative actions. You can also export these logs for further analysis.
Locate Local MDM and Intune Logs on the Windows Device
Check local directories on the Windows 10 device for MDM diagnostics and Intune Management Extension logs.
Check User Sign-in Events via Microsoft Entra ID
Standard Intune logs do not show user sign-ins; you must use Microsoft Entra ID or Log Analytics for these events.
Deploy WPS Office as a Lightweight Alternative for Your Managed Devices
While troubleshooting Intune and MDM logs, consider optimizing your Windows device deployments by packaging WPS Office. It's a free, highly compatible alternative to Microsoft Office that is exceptionally easy to deploy via Microsoft Intune.
- 1. Download the Installer: Get the offline installer for WPS Office from the official website.
- 2. Package for Intune: Wrap the installer into an .intunewin file using the Microsoft Win32 Content Prep Tool.
- 3. Deploy to Devices: Assign the app to your device groups in the Intune admin center for silent installation.
Frequently Asked Questions
Does an Intune trial license restrict my access to audit logs?
No, having a trial licensing status does not necessarily prevent administrators from accessing available Intune activity and audit logs in the Microsoft Intune admin center.
Why can't I see user sign-in events in the standard Intune audit logs?
User sign-in and sign-out events are generally handled by Microsoft Entra ID rather than Intune. You need to review the Microsoft Entra ID sign-in logs or connect your tenant to an Azure Log Analytics workspace to view user authentication events.
Where is the Intune Management Extension log located on a local Windows PC?
The Intune Management Extension logs, which track Win32 app deployments and PowerShell scripts, can be found locally on the device at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
