Accenture MDR Quick Start Guide for Microsoft Intune

This quick start guide will help Accenture MDR customers configure Microsoft Intune to collect logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Microsoft Intune
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	Azure Blob Storage/Event Hub	443 (TCP)	Default port

Configuring Microsoft Intune

Prerequisites

An Azure subscription that you can sign in to.

A Microsoft Intune environment (tenant) in Azure

A user who's a Global Administrator or Intune Service Administrator for the Intune tenant.

Reference URLs

How to create storage account?
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal

How to configure Event Hub?
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-create

Device Configuration Steps

Sign in to the Microsoft Endpoint Manager admin center.
Select Reports > Diagnostics settings. The first time you open it, turn it on. Otherwise, add a setting.

Name: Enter a name for the diagnostic settings. This setting includes all the properties you enter. For example, enter Route audit logs to storage account.

3. On the next Window, Provide appropriate Name and select AuditLogs, OperationalLogs, DeviceComplianceOrg.

4. As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. MxDR supports log collection from both the options.

a) Archive to a storage account

To store logs in Storage Account, select Archive to a storage account as shown in below screenshot and Choose an existing Subscription and Storage account.

Note: MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies

b) Stream logs to an event hub

1.To stream logs to Event Hub, select Stream to an event hub as shown in below screenshot.
2.Select Subscription, event hub namespace , event hub name and event hub policy name created during Event Hub as part of pre-requisite.

5. Use below link to get credentials for Azure Storage and Azure Event HUB.

Accenture MDR Quick Start Guide to Get Credentials for Azure Storage and Azure Event HUB

LCP Configuration Parameters

Table 1-2: Microsoft Intune Event collector (API - 5020) properties to be configured by MDR are given in the table.

Property	Value If Using EventHub	Value If Using Storage

Property	Value If Using EventHub	Value If Using Storage
Logging Source	Select EventHub	Select Storage
eventHubConnectionString	Event hub connection string	N/A (keep blank)
consumerGroupName	Optional and used if consumer Group is other than default	N/A (keep blank)
Account Key	Access Key to access storage account	Access Key to access storage account
Blob Container	Storage blob Container name	Storage blob Container name insights-logs-auditlogs insights-logs-devicecomplianceorg insights-logs-operationallogs
Storage Account Name	Azure storage account name	Azure storage account name
Subscription	Set Eventhub name	Tenant ID that customer wants to be monitored
initialReadPolicy	N/A (keep default selection)	Select Beginning to start reading from beginning and End to start reading logs from the end

Note: In case of EventHub logging source, storage Account Key/SAS Token, Blob Container, and Storage Account Name are required because the marker for the event hub gets stored in the storage account.

Note: In case of Storage logging source, for each blob container created under storage account there should be separate sensor configuration created in the Log collection platform.