Skip to content
PS Script
4/6 checks passed

Intune Log Collector

Intune Log Collector is an Azure-based solution that collects logs from Intune-managed devices, including files, directories, and event logs. It deploys a Function App, Storage Account, and Key Vault, with the Remediation script driving log collection per LogsGatherRules.json and uploading a compressed archive to the logs container. Deployments support Azure Template Spec (Bicep/ARM) or direct ARM templates, with optional UI and post-deployment steps.

Works with
WindowsmacOSGraph APIAzure Automation
View on GitHub

Screenshots

Security Analysis

4of 6
2 Issues Found

12 files scanned on Aug 16, 2026

Issues Detected
No Credential Theft
No token or credential harvesting code
Generates and returns a SAS token with UploadLogs permission for a storage container. This token can be misused if captured (e.g., to upload arbitrary data or tamper logs). Although time-bound, exposure to clients increases the risk surface for log data exfiltration or storage abuse.
No Data Exfiltration
No suspicious outbound data transfers
The endpoint fetches a blob from Azure Storage and returns the blob contents in the HTTP response as JSON. If an attacker can bypass strict device validation or access control, this directly enables exfiltration of potentially sensitive blob data (e.g., logs, credentials, or other sensitive payloads) to a caller.
Passed Checks
No Obfuscated Code
No Remote Execution
No Malicious Patterns
No Hardcoded Secrets
AI Analysis

The codebase contains legitimate Intune/Graph-oriented functionality, but presents notable security considerations. Data exposure risk exists in GetBlobContent by returning blob payloads to the caller. GetSASUri provides a write-capable SAS token to clients, which can be abused if token leakage occurs. Logging of sensitive header data when DebugLogging is enabled and environment-stored storage keys introduce additional risk. Recommendations: redact sensitive values in all logs, minimize and tightly scope SAS tokens (short lifetimes, IP restrictions, read-only where possible), move secrets to a secure store (e.g., Key Vault), and ensure strong device attestation and access control prior to token issuance.

You might also like

PS Script

Intune Device Details GUI

A PowerShell-based GUI tool for visualizing comprehensive Intune device information. Shows Azure AD group memberships, Intune filter assignments, application and configuration targeting, BitLocker recovery keys, LAPS passwords, Autopilot profiles, and remediation script status with color-coded assignment states.

Petri PaavolaPetri Paavola
PS Script

Intune Remote Help Launcher

Intune Remote Help Launcher is a PowerShell WPF tool for IT admins to search Intune-managed devices by name or primary user, view device details, and launch Microsoft Remote Help sessions from one interface. It supports Windows, Android, iOS, and macOS devices, displays OS, compliance, ownership, model and last sync, and can issue sync or restart commands or open the device in the Intune admin center. It uses Microsoft Graph delegated authentication (auto-installs the Graph module if needed) and requires Remote Help licensing to be configured.

Mert Efe KanlikilicMert Efe Kanlikilic
PS Script

Endpoint Analytics Remediation Scripts

A community-driven repository of 86+ PowerShell detection and remediation scripts for Microsoft Intune Endpoint Analytics. Includes scripts for system health, security hardening, device management, application management, optimization, and diagnostics.

Jannik ReinhardJannik Reinhard
PS Script

Get-AutopilotDiagnosticsCommunity

A PowerShell diagnostic script for analyzing Windows Autopilot deployments. Provides comprehensive details about Autopilot profile settings, policies, apps, and certificate profiles tracked via Enrollment Status Page, with support for local PC analysis and captured log files.

Andrew TaylorAndrew Taylor