Collect Intune Logs from macOS Devices

In this blog post, we will explore different methods for collecting Intune diagnostic logs from macOS devices. These logs are helpful for troubeshooting purpose and Identifying issues related to configuration, script or application deployment.

If you are troubleshooting an Issue related to Intune deployment. You can also try to manually force Initiate Intune sync on macOS and check if the issue is resolved. Refer to this guide for more information: Manually Sync macOS Devices with Intune.

Tip

The main log files which could help find the root cause of macOS Intune deployment issues are CompanyPortal.log, IntuneMDMDaemon*.log, and IntuneMDMAgent*.log. Let’s check the location of these files and what information is stored in these files.

1. Collect Intune logs from Company Portal App on macOS

You can collect logs from company portal app installed on your Mac. Log file name is CompanyPortal.log which contains information about the device, intune enrollment related information and Information about the registered user. If there are any issues with company portal app, then you can refer to this log file. CompanyPortal.log file contains below information:

  • Device Information
    • Device Build version
    • Device Model
    • Device Operating System Version
    • Device Azure AD ID
    • Device Compliant State
    • Device Last Contact Time
  • Enrollment Related Information
    • MDM Enrollment State of the device.
  • Registered User Information
    • User Account ID
    • Tenant ID
    • User ID

1.1 Save Company Portal Diagnostic Report Locally

If you get any issues with the company portal app on a macOS device, you can review the CompanyPortal.log file. To capture the issue/error in the log file, follow below steps:

  • Reproduce the Issue on the Mac.
  • Open the Company Portal App > Help > Save diagnostic report.
Save Company Portal app diagnostic report on Mac
Save Company Portal app diagnostic report
  • Click on Save.
Save Company Portal app diagnostic report on Mac
Save Company Portal app diagnostic report
  • Extract the contents of the Company Portal.zip file by right-clicking on the file > Open With > Archive Utility.
Extract the contents of Company Portal.zip file
Extract the contents of Company Portal.zip file
  • The CompanyPortal.log file will be extracted into the same folder – Double-click on the file to open it and search for errors.
CompanyPortal.log file
CompanyPortal.log file
  • You can search for keywords in the file to jump directly to the error message. For Example, you can search for Error, Failed, etc. in the file to see if any errors or failures.
CompanyPortal.log file contents
CompanyPortal.log file contents

1.2 Send Company Portal App diagnostic logs to Microsoft

To share a diagnostic report with Microsoft, start by reproducing the issue and promptly click the Send diagnostic report option to send the file directly to Microsoft.

  • Launch the Company Portal App on your device.
  • Go to Help > Send diagnostic report.
Send diagnostic report option in Company Portal app
Send diagnostic report option in the Company Portal app
  • As evident in the screenshot below, an incident ID is generated. You can also click the Email Logs button to email a Microsoft support engineer.
Send Company Portal App diagnostic logs to Microsoft
Send Company Portal App diagnostic logs to Microsoft

2. Collect Intune MDM Agent logs from a macOS device

If you have gone through companyportal.log file and found no issues, you can further investigate the problem using MDM Agent logs. MDM agent log files can be located at below locations on the Mac.

  • For system logs: /Library/Logs/Microsoft/Intune
  • For user logs: ~/Library/Logs/Microsoft/Intune

The log files are named IntuneMDMDaemon date–time.log and IntuneMDMAgent date–time.log.

2.1 Location of IntuneMDMDaemon date–time.log file

  • Go to Finder App > Go > Go to Folder...
  • Type /Library/Logs/Microsoft/Intune path and double-click on the searched location to open.
Search for IntuneMDMDaemon*.log files on macOS
Search for IntuneMDMDaemon*.log files on macOS
  • Find the most recent IntuneMDMDaemon log file using the Date Modified column and double-click on it to open the file.
IntuneMDMDaemon*.log file location on macOS
IntuneMDMDaemon*.log file location on macOS
  • To check real-time Intune Device check-in logs, you can manually Initiate Intune sync on the device. The logs will be in the IntuneMDMDaemon date–time.log file and updated in real time. Look for any errors during the sync process.
macOS device check-in process / logs in IntuneMDMDaemon*.log file
macOS device check-in process/logs in IntuneMDMDaemon*.log file

2.2 Location of IntuneMDMAgent date–time.log file

To find the location of the IntuneMDMAgent*.log file, follow the below steps:

  • Go to Finder App > Go > Go to Folder...
  • Search for ~/Library/Logs/Microsoft/Intune path and double-click on the searched location to open.
Location of IntuneMDMAgent*.log file
Location of IntuneMDMAgent*.log file

3. Collect Intune Logs for macOS from Intune admin center

Intune script agent can remotely collect the logs from a macOS device and make it available for download from Intune admin center. This really helps administrators who do not have access to the device and still want to review the logs for troubleshooting purpose. First step is to initiate Collect logs task and then download logs task once the logs are available.

Collect Logs

To collect the logs for a specific deployment e.g. a shell script. follow below steps:

  • Sign in to the Intune admin center > Devices > macOS > Shell scripts.
  • Click on any Script deployment name.
  • Go to either Device status or User status under Monitor.
  • Click on the Device Name or User name > A Pane will open on the right-hand side.
  • Click on Collect logs.
Collect Logs option for macOS device
Collect Logs option for macOS device
  • You’ll need to input the absolute file path for each log to collect the logs. To separate multiple log files, use a semicolon (;).
  • Collect logs option supports file types such as .log, .zip, .gz, .tar, .txt, .xml, .crash, and .rtf. It’s important to note that the combined size of all the log files you want to collect remotely should not exceed 60 MB or 25 files in total, whichever limit is reached first.
  • For Example, if you want to remotely collect the IntuneMDMAgent*.log, IntuneMDMDaemon*.log, and CompanyPortal.log files from a macOS device, you should add the following file path for log collection: “/users/<username>/downloads/CompanyPortal.log” This will result in the collection of the CompanyPortal.log file, as well as the Intune Agent log files.
  • It’s important to note that even if you specify only one log file for collection, such as CompanyPortal.log, the process will automatically include the most recent IntuneMDMAgent*.log and IntuneMDMDaemon*.log log files.
  • You can separate file paths with semicolons to add multiple paths for log collection. For Example: <LogfilePath1>;<LogfilePath2>;<LogfilePath3>…. and so on.

If you specify /Library/Logs/Microsoft/Intune/*.log path for collection of logs – This will fetch IntuneMDMAgent*.log, IntuneMDMDaemon*.log files from macOS device.

Note

Collect logs file path to collect logs remotely for a macOS device
Collect logs file path to collect logs remotely for a macOS device

Download Logs

Now that you’ve initiated the log collection request, it’s expected to be completed in less than 8 hours. After successfully completing the log collection process, you can download the requested logs from the Intune admin center.

If you have access to the macOS device, you can request that the user initiate a device check-in with Intune. This will trigger the log collection immediately, and you’ll be able to download the logs from the Intune admin center within a few minutes, eliminating the need to wait for a couple of hours.

  • Sign in to the Intune admin center > Devices > macOS > Shell scripts.
  • Click on any Script deployment name.
  • Go to either Device status or User status under Monitor.
  • Click on the Device Name or User name > A Pane will open on the right-hand side.
  • Click on Download logs.
Download Logs option for macOS device on Intune admin center
Download Logs
  • A window will pop up once you click Download logs, allowing you to save the log files in a zip format. The zip file will be named ScriptTroubleshootingLogs_<date>.zip. Extract this zip file to access and inspect the log files.
Downloaded Intune log files from mac device
Downloaded Intune log files from a Mac device

Conclusion

We have seen various methods to collect Intune logs from macOS device for trobleshooting purpose. If you have direct access to the device, you can locate the log files and go through them to find any issues. When you don’t have access to the device, in that case you can Initiate Log collection request remotely from Intune admin center as well. Please note that for remote log collection, the device needs to be switched on and connected to Internet.

Leave a Comment