Intune collects a ton of logs from MDM Diagnostics, but what about the other logs that aren't in collected as standard?
Add an entry under this key
HKLM\SOFTWARE\Microsoft\MdmDiagnostics\Area\DeviceProvisioning\FileEntry
example
%windir%Temp\*Installer* REG_DWORD 0x000000ff (255)
This makes the diagnostics collect files matching the wild cards.
In the diagnostics they are compressed in a mdmlogs-<date>.cab file in the folder which includes the name ...MDMDiagnostics_mdmlogs-<date reference>
Alternatively configure log files to write to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
that way they will automatically be collected by a Diagnostics Collection.
C:\Windows\SoftwareDistribution\ReportingEvents.log this is a useful file to track Windows Update operations.
