Intune collects a ton of logs from MDM Diagnostics, but what about the other logs that aren't in collected as standard?
Add an entry under this key
HKLM\SOFTWARE\Microsoft\MdmDiagnostics\Area\DeviceProvisioning\FileEntry
example
%windir%Temp\*Installer* REG_DWORD 0x000000ff (255)
This makes the diagnostics collect files matching the wild cards.
In the diagnostics they are compressed in a mdmlogs-<date>.cab file in the folder which includes the name ...MDMDiagnostics_mdmlogs-<date reference>
