Logs and diagnostics¶
When the admin center says Failed, the device usually knows why. This page lists where to look on each platform.
Intune Management Extension logs¶
Folder: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\
| Log | Contains |
|---|---|
IntuneManagementExtension.log |
Agent check-ins, policy processing, general activity |
AppWorkload.log |
Win32 and Store app downloads, installs, detection and results |
AppActionProcessor.log |
Which apps the agent decided to act on, and why |
AgentExecutor.log |
PowerShell script execution, including detection and requirement scripts |
HealthScripts.log |
Remediations: schedules, detection and remediation results |
ClientHealth.log |
Health checks of the agent itself |
Open them with CMTrace or OneTrace (from Configuration Manager's tools) for highlighting and live updates.
Event logs¶
Under Applications and Services Logs > Microsoft > Windows:
| Log | Use for |
|---|---|
| DeviceManagement-Enterprise-Diagnostics-Provider > Admin | MDM policy errors, enrollment (event 75 success, 76 failure for automatic enrollment) |
| ModernDeployment-Diagnostics-Provider > Autopilot | Autopilot profile download and deployment |
| AAD > Operational and User Device Registration > Admin | Entra join, registration and token problems |
| BitLocker-API | Encryption and key backup |
| LAPS > Operational | LAPS password rotation and backup |
| Windows Defender > Operational | Antivirus, ASR and tamper protection events |
Diagnostic report¶
- Settings > Accounts > Access work or school > Export your management log files writes a report to
C:\Users\Public\Documents\MDMDiagnostics. - Or run
MdmDiagnosticsTool.exe -out C:\Temp\MDMDiagfor an HTML report of every applied policy, enrollment and certificate. - From the admin center, the Collect diagnostics device action uploads a bundle of logs you can download from the device page, without bothering the user.
Useful commands and locations¶
| Item | Shows |
|---|---|
dsregcmd /status |
Entra join state, PRT, MDM URLs |
HKLM\SOFTWARE\Microsoft\Enrollments |
Enrollment records |
HKLM\SOFTWARE\Microsoft\PolicyManager\current\device |
The policy values MDM actually applied |
HKLM\SOFTWARE\Microsoft\IntuneManagementExtension |
Agent state for apps and scripts |
C:\Windows\IMECache |
Downloaded app content during installs |
| Item | Location or command |
|---|---|
| Intune agent (root) | /Library/Logs/Microsoft/Intune/IntuneMDMDaemon*.log |
| Intune agent (user) | ~/Library/Logs/Microsoft/Intune/IntuneMDMAgent*.log |
| Installed profiles | sudo profiles show -type configuration |
| MDM activity in the unified log | log show --style compact --last 1h --predicate 'subsystem == "com.apple.ManagedClient"' |
| Platform SSO state | app-sso platform -s |
| Company Portal logs | Company Portal > Help > Save diagnostic report (or Send diagnostic report to Microsoft) |
- Settings > General > VPN & Device Management shows the management profile and the profiles and apps it installed.
- Company Portal > Help > Send logs (or Upload logs) sends logs to Microsoft and gives you an incident ID for support cases.
- For app protection, open Microsoft Edge and go to
about:intunehelpto see the policies applied to each app and collect app logs. - For deep issues Apple support may ask for a sysdiagnose.
- Work profile (BYOD): Company Portal > menu > Settings > Diagnostic logs > save or send logs.
- Corporate devices: the Microsoft Intune app > menu > Help > send logs.
- For app protection, open Microsoft Edge and go to
about:intunehelp. - Sign-in issues often need Microsoft Authenticator logs too (Authenticator > Help > Send logs).
In the admin center¶
| View | Shows |
|---|---|
| Troubleshooting + support > Troubleshoot | One user's devices, groups, assignments, app protection and enrollment failures |
| Device > Device diagnostics | Bundles uploaded with Collect diagnostics |
| Devices > Monitor | Enrollment failures, assignment failures, certificates, encryption and more |
| Apps > Monitor > App protection status | App protection check-ins per user and app |
| Tenant administration > Audit logs | Admin changes and remote actions |
Before you send logs to anyone¶
Logs contain user names, device names, IP addresses and sometimes file paths. Share them only through your support case or a secure channel, and follow your organization's data handling rules.