TenuVaultDesktopPractical guide
How to document Intune configuration for an audit
An auditor usually wants to see what your Intune configuration is, who it applies to, how it changed over time, where you deviate from your standard on purpose and how it maps to the framework being audited. Intune can export some policies and keeps audit logs, but it has no single evidence report. Build the pack from dated backups with assignments, change history, a framework comparison and a register of deliberate exceptions. TenuVault produces each of these, with framework reports included in the free Community plan.
At a glance
- Intune has no single configuration evidence report; Windows Settings Catalog policies can be exported to JSON one at a time.
- Microsoft documents that Graph returns two years of Intune audit events, and that audit logs can be sent to Azure Monitor for longer retention.
- TenuVault framework comparisons produce PDF, CSV and JSON reports that state the collection date, coverage, unknowns and limitations, and are included in Community.
- TenuVault Governance on Pro and MSP exports baseline scores and hygiene findings as CSV or JSON, and records deliberate customizations with a reason and an owner.
- A configuration report is evidence for an auditor to review, not a certification or proof of device enforcement.
What an auditor typically asks for
Confirm the exact scope with your auditor first. The list below is a common pattern, not a requirement of any framework.
- The current configuration: every policy with its settings, as of a stated date.
- Scope: which users and devices each policy is assigned to.
- Change history: what changed, when and by whom, over the audit period.
- Exceptions: where you deliberately differ from your standard, why, who approved it and until when.
- Mapping: how the configuration supports the controls of the framework being audited, such as ISO 27001, NIST or the Essential Eight.
What Intune provides
Windows Settings Catalog policies can be exported to JSON from the admin center, one policy at a time. Intune audit logs record who changed which object and which properties changed; Microsoft documents that Graph returns two years of audit events and the admin center filter covers up to the previous year, and you can send them to Azure Monitor for longer retention. Device and policy reports show deployment status.
What is missing is a single dated view of the whole configuration with assignments, and a mapping to a framework. That is the part you assemble.
Build the evidence pack with TenuVault
Each report states its collection date, what it covers and what it could not evaluate. Protect downloaded backups like the configuration itself: the ZIP is not encrypted. Keep Intune's own audit logs alongside, because TenuVault's audit log only records actions taken through TenuVault.
| Evidence | Where it comes from | Plans |
|---|---|---|
| Configuration as of a date, with assignments | A complete backup, downloadable as a ZIP of JSON files | Community, Pro and MSP |
| What changed between two dates | Drift detection between two backups, exported as CSV or JSON | Community, Pro and MSP |
| Mapping to a framework | Framework comparison reports as PDF, CSV or JSON | Community, Pro and MSP |
| Baseline adherence | OpenIntuneBaseline validation reports as PDF or CSV | Community, Pro and MSP |
| Baseline scores, hygiene findings and documented customizations | Governance exports as CSV or JSON, and customization records with reason and owner | Pro and MSP |
| What TenuVault did, and who did it | The TenuVault audit log export | Pro and MSP |
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can Intune export all policies for an audit?+
Not in one step. Windows Settings Catalog policies can be exported to JSON one at a time, and Microsoft publishes Graph sample scripts for some policy types. A backup tool that reads every policy type with its assignments gives you a complete, dated copy.
How long does Intune keep audit logs?+
Microsoft documents that the Graph API returns two years of Intune audit events, while the admin center date filter covers up to the previous year. Send audit logs to Azure Monitor if you need them for longer.
Is a framework comparison report proof of compliance?+
No. It shows how your Intune configuration maps to a framework's technical controls as of a date. It does not prove device enforcement or compliance with the full framework, which also covers processes and systems outside Intune.
Can I produce audit reports for free?+
Yes. TenuVault Community includes backups, drift reports and framework comparison reports for one tenant. Governance exports and the TenuVault audit log export need Pro or MSP.