AUDITING MICROSOFT DEFENDER AND INTUNE CONFIGURATION CHANGES

Summary from the TLDR InfoSec newsletter

Microsoft's unified Defender SecOps portal contains a critical logging gap: changes to security-critical settings, such as Tamper Protection and Intune device policies, do not generate default alerts. To maintain a reliable audit trail of configuration changes, security teams must manually engineer custom detections. This requires enabling Unified Audit Log integration, forwarding Purview audit data into the CloudAppEvents table via Defender for Cloud Apps, and actively routing Intune operational logs to Log Analytics for KQL-based hunting.