MCADDF

[COLLECT-POLICY-001]: Device Compliance Policy Collection

Metadata

Attribute Details
Technique ID COLLECT-POLICY-001
MITRE ATT&CK v18.1 T1123 - Audio Capture (Device enumeration variant)
Tactic Discovery / Collection
Platforms Entra ID / Intune / MDM
Severity High
Technique Status ACTIVE
Last Verified 2026-01-10
Affected Versions Entra ID all versions, Intune all versions, Windows 10/11 enrolled devices
Patched In N/A (Configuration API, no security patch)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 1.2.1 Device compliance policies must be regularly reviewed and enforced; exported policies must not be shared externally
DISA STIG V-225391 MDM policy configuration changes must be logged and retained for audit
CISA SCuBA MS.INTUNE.1 Device compliance policy assignment must exclude high-risk user groups; non-compliance must trigger automatic remediation
NIST 800-53 CA-7 (Continuous Monitoring), SI-4 (Information System Monitoring) Implement baseline configurations and monitor for policy violations; audit configuration changes
GDPR Art. 25 (Data Protection by Design) Device policies must implement privacy-by-default; exported policies must not expose personal device data
DORA Art. 16 (Operational Resilience) Financial institutions must enforce minimum device security standards via compliance policies
NIS2 Art. 21 (Risk Management), Art. 22 (Security Policies) Critical infrastructure operators must implement and enforce device security baselines
ISO 27001 A.12.1 (Operational Controls), A.12.2.1 (Change Management) Implement device configuration baselines; document and authorize all policy changes
ISO 27005 Risk Scenario: “Deviation from Baseline Configuration” Assess likelihood of non-compliant devices being exploited; implement compensating controls

2. TECHNICAL PREREQUISITES

Supported Versions:

Tools:

3. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

# Check if current user has Intune admin access
$Modules = Get-InstalledModule | Where-Object { $_.Name -match "Microsoft.Graph" }
if ($Modules) { Write-Host "✅ Microsoft.Graph modules installed" }

# Test Intune API connectivity
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"
$CompliancePolicies = Get-MgDeviceManagementDeviceConfiguration -All
Write-Host "Found $($CompliancePolicies.Count) compliance policies"

What to Look For:

Version Note: Windows 10/11 enrollment in Intune requires Azure AD join or hybrid join. Policies apply to enrolled devices only.

Command (Server 2016-2019):

# Legacy enumeration using Azure AD module
Import-Module AzureAD
Get-AzureADDeviceConfiguration | Select-Object DisplayName, DeviceId

Command (Server 2022+):

# Modern enumeration using Microsoft.Graph
Get-MgDeviceManagementDeviceConfiguration | Select-Object DisplayName, Id, CreatedDateTime

Linux/Bash / CLI Reconnaissance

# Test Intune API connectivity from Linux
curl -H "Authorization: Bearer $INTUNE_TOKEN" \
  "https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations"

What to Look For:

4. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Intune Admin Portal Policy Export (GUI-Based)

Supported Versions: Intune all versions, Windows 10/11

Step 1: Navigate to Compliance Policies in Intune Portal

Objective: Access the Intune compliance policy configuration page.

Version Note: All Intune versions support policy export through the web portal. The location may vary slightly between Intune service updates.

Manual Steps:

  1. Navigate to https://intune.microsoft.com
  2. Log in with Intune Administrator credentials
  3. In the left sidebar, select Devices
  4. Under Devices, click Configuration
  5. Click Device Configuration Profiles or Settings Catalog (depending on Intune version)
  6. You should now see a list of all deployed policies

Expected Output:

Policy Name Platform Type Status
Windows 10 Security Baseline Windows 10 Windows 10 and later Assigned
Firewall Policy Standard Windows 10 Custom Assigned
Encryption Baseline Windows 11 Windows 11 and later Assigned
Mobile Device Restriction iOS Custom Not Assigned

What This Means:

OpSec & Evasion:

Step 2: Export Compliance Policies as JSON

Objective: Download policy configurations in JSON format for analysis.

Version Note: Intune portal includes an “Export” button (added in 2020) that exports policies to JSON. Older versions may require API or PowerShell.

Manual Steps:

  1. From the Device Configuration page, click Settings Catalog
  2. For each policy you want to export: a. Click the policy name b. In the top menu, click Export to JSON (or Export settings) c. Browser will download a .json file
  3. Save all exported JSON files to a local folder (e.g., C:\Intune_Export\)

Expected Output (JSON Structure):

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#deviceManagement/deviceConfigurations/$entity",
  "id": "12345678-1234-1234-1234-123456789012",
  "displayName": "Windows 10 Security Baseline",
  "description": "Enforces minimum security standards for Windows 10 devices",
  "version": 1,
  "roleScopeTagIds": ["0-0"],
  "settings": [
    {
      "name": "firewall.domainProfile.inboundNotificationsAllowed",
      "value": false
    },
    {
      "name": "deviceSecuritySettings.bitLocker.enabled",
      "value": true
    },
    {
      "name": "defender.scanScheduleTime",
      "value": "02:00"
    },
    {
      "name": "passwordPolicy.minimumPasswordLength",
      "value": 14
    }
  ]
}

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Analyze Policies for Security Gaps

Objective: Review exported policies to identify misconfigurations, weak settings, and compliance exceptions.

Manual Analysis Example:

# Load all exported JSON files
$PolicyFolder = "C:\Intune_Export\"
$AllPolicies = Get-ChildItem -Path $PolicyFolder -Filter "*.json" | ForEach-Object {
    Get-Content -Path $_.FullName | ConvertFrom-Json
}

# Identify weak policies (examples of security gaps)
$AllPolicies | ForEach-Object {
    $Policy = $_
    
    # Check for firewall disabled
    $FirewallDisabled = $Policy.settings | Where-Object { $_.name -match "firewall" -and $_.value -eq $false }
    if ($FirewallDisabled) { 
        Write-Host "⚠️  WEAK: $($Policy.displayName) - Firewall DISABLED"
    }
    
    # Check for password policy < 12 characters
    $WeakPassword = $Policy.settings | Where-Object { $_.name -match "minimumPasswordLength" -and $_.value -lt 12 }
    if ($WeakPassword) {
        Write-Host "⚠️  WEAK: $($Policy.displayName) - Password < 12 chars"
    }
    
    # Check for encryption disabled
    $NoEncryption = $Policy.settings | Where-Object { $_.name -match "bitLocker" -and $_.value -eq $false }
    if ($NoEncryption) {
        Write-Host "⚠️  WEAK: $($Policy.displayName) - Encryption DISABLED"
    }
}

Expected Output (Example of Security Gaps):

⚠️  WEAK: Legacy Mobile Policy - Firewall DISABLED
⚠️  WEAK: BYOD Devices - Password < 12 chars
⚠️  WEAK: Contractor Devices - Encryption DISABLED
⚠️  WEAK: Kiosk Mode - MFA NOT REQUIRED

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 2: PowerShell API-Based Policy Enumeration and Export

Supported Versions: All Intune versions, PowerShell 5.0+

Step 1: Authenticate to Microsoft Graph with Intune Permissions

Objective: Obtain OAuth token with DeviceManagementConfiguration.Read.All scope to access Intune API.

Version Note: Modern authentication uses Microsoft.Graph SDK; legacy uses Azure AD module.

Command:

# Install Microsoft.Graph module (if not present)
Install-Module -Name Microsoft.Graph.DeviceManagement -Force

# Authenticate with Intune API permissions
Connect-MgGraph -Scopes @(
    "DeviceManagementConfiguration.Read.All",
    "DeviceManagementManagedDevices.Read.All",
    "Organization.Read.All"
)

# Verify authentication
$Context = Get-MgContext
Write-Host "✅ Authenticated as: $($Context.Account)"
Write-Host "✅ Scopes: $($Context.Scopes -join ', ')"

Command (Server 2016-2019):

# Legacy authentication using Azure AD module
Import-Module AzureAD
$Cred = Get-Credential
Connect-AzureAD -Credential $Cred

# Get Intune token (requires additional configuration)
$TenantId = (Get-AzureADTenantDetail).ObjectId

Command (Server 2022+):

# Modern Graph authentication
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All" -NoWelcome
Get-MgContext | Select-Object TenantId, AuthType, Scopes

Expected Output:

✅ Authenticated as: user@tenant.onmicrosoft.com
✅ Scopes: DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All, Organization.Read.All

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Enumerate All Compliance Policies via API

Objective: Retrieve all device compliance policies using Graph API.

Version Note: /deviceManagement/deviceCompliancePolicies endpoint available on all versions. Beta endpoint provides additional metadata.

Command:

# Enumerate all compliance policies
$Headers = @{
    Authorization = "Bearer $(Get-MgToken)"
    "Content-Type" = "application/json"
}

$CompliancePolicies = @()
$Uri = "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies?`$select=id,displayName,description,createdDateTime,lastModifiedDateTime,platformType,assignmentFilterId"

do {
    $Response = Invoke-RestMethod -Method GET -Uri $Uri -Headers $Headers
    $CompliancePolicies += $Response.value
    $Uri = $Response.'@odata.nextLink'
} while ($Uri)

Write-Host "Found $($CompliancePolicies.Count) compliance policies"
$CompliancePolicies | Select-Object displayName, platformType, createdDateTime | Format-Table

Expected Output:

displayName                              platformType    createdDateTime
-----------                              -----------     ---------------
Windows 10 Standard Security             Windows10       2024-06-15T10:30:00Z
iOS Device Restrictions                  IOS             2024-07-20T14:15:00Z
macOS Encryption Policy                  MacOS           2024-08-10T09:00:00Z
Android Enterprise Baseline               Android         2024-09-05T16:45:00Z

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Export Complete Policy Configurations with Settings

Objective: Download full policy details including all configuration settings.

Version Note: Complete policy details available via /deviceManagement/deviceCompliancePolicies/{id} endpoint.

Command:

# For each compliance policy, retrieve complete configuration
$ExportFolder = "C:\Exfil\Intune_Policies"
New-Item -ItemType Directory -Path $ExportFolder -Force | Out-Null

$CompliancePolicies | ForEach-Object {
    $PolicyId = $_.id
    $PolicyName = $_.displayName -replace '[<>:"/\\|?*]', '_'  # Sanitize for filename
    
    # Get full policy details including settings
    $PolicyDetails = Invoke-RestMethod -Method GET `
        -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/$PolicyId" `
        -Headers $Headers
    
    # Get assignment information
    $Assignments = Invoke-RestMethod -Method GET `
        -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies/$PolicyId/assignments" `
        -Headers $Headers
    
    # Combine policy details + assignments
    $ExportObject = @{
        Policy = $PolicyDetails
        Assignments = $Assignments.value
    }
    
    # Export to JSON file
    $ExportPath = "$ExportFolder\$PolicyName.json"
    $ExportObject | ConvertTo-Json -Depth 10 | Out-File -FilePath $ExportPath -Encoding UTF8
    
    Write-Host "✅ Exported: $PolicyName"
}

Write-Host "All policies exported to: $ExportFolder"
Get-ChildItem -Path $ExportFolder | Select-Object Name, Length

Expected Output:

✅ Exported: Windows 10 Standard Security
✅ Exported: iOS Device Restrictions
✅ Exported: macOS Encryption Policy
✅ Exported: Android Enterprise Baseline
All policies exported to: C:\Exfil\Intune_Policies

Name                                    Length
----                                    ------
Windows 10 Standard Security.json       45623
iOS Device Restrictions.json            23451
macOS Encryption Policy.json            34521
Android Enterprise Baseline.json        12345

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 3: IntuneManagement Tool - Automated Bulk Export

Supported Versions: All Intune versions, Windows 10/11

Step 1: Download and Install IntuneManagement Tool

Objective: Use open-source tool for automated, bulk policy export with minimal manual effort.

Command:

# Clone IntuneManagement from GitHub
git clone https://github.com/Micke-K/IntuneManagement.git
cd IntuneManagement

# Run the PowerShell script
.\Invoke-IntuneManagement.ps1

Manual Steps (If Git Not Available):

  1. Download IntuneManagement from GitHub: https://github.com/Micke-K/IntuneManagement/releases
  2. Extract ZIP file to C:\IntuneManagement\
  3. Open PowerShell as Administrator
  4. Navigate to folder: cd C:\IntuneManagement\
  5. Execute: .\Invoke-IntuneManagement.ps1

Expected Output:

IntuneManagement v2.1.0
========================

Select Action:
[1] Export All Configurations
[2] Import Configurations
[3] Compare Tenants
[4] Generate Documentation

Enter Selection: 1

What This Means:

Step 2: Execute Bulk Policy Export

Objective: Export all Intune configurations (policies, profiles, apps, scripts) to a local folder.

Manual Steps:

  1. From IntuneManagement menu, select Export All Configurations (Option 1)
  2. When prompted, select export scope:
    • Device Configurations: ✓ (Check all)
    • Compliance Policies: ✓
    • Settings Catalog: ✓
    • Apps & Assignments: ✓
  3. Select export location: C:\Exfil\Intune_Export
  4. Tool will prompt for authentication; log in with Intune Admin credentials
  5. Wait for export to complete (1-5 minutes depending on tenant size)

Expected Output:

Exporting Device Configurations...  [████████████] 100% (45/45)
Exporting Compliance Policies...    [████████████] 100% (12/12)
Exporting Settings Catalog...       [████████████] 100% (28/28)
Exporting Applications...           [████████████] 100% (150/150)

✅ Export Complete!
Location: C:\Exfil\Intune_Export

Exported Files:
- DeviceConfigurations/ (45 profiles)
- CompliancePolicies/ (12 policies)
- SettingsCatalog/ (28 settings)
- Applications/ (150 apps)
- Assignments.csv (2145 assignments)

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

5. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: Command: 
    # Revoke admin's session tokens
Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -SearchString "admin@tenant").ObjectId
   
# Remove admin from Intune Administrator role
Remove-AzureADGroupMember -ObjectId (Get-AzureADGroup -Filter "displayName eq 'Intune Administrators'").ObjectId -MemberId (Get-AzureADUser -SearchString "admin@tenant").ObjectId
  2. Collect Evidence: 
    # Export Intune audit log
$StartDate = (Get-Date).AddHours(-24)
$EndDate = Get-Date
Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations "Update-DeviceConfiguration", "Remove-DeviceConfiguration" | Export-Csv -Path "C:\Evidence\intune_audit.csv"
  3. Remediate: 
    # Reset all Intune policies to default secure configuration
Get-MgDeviceManagementDeviceConfiguration | ForEach-Object {
    Update-MgDeviceManagementDeviceConfiguration -DeviceConfigurationId $_.Id -DisplayName "$($_.DisplayName) [RESET]"
}

6. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Step Phase Technique Description
1 Initial Access IA-PHISH-001 Phishing for Intune admin credentials
2 Collection [COLLECT-POLICY-001] Device Compliance Policy enumeration (THIS TECHNIQUE)
3 Discovery REC-CLOUD-005 Identify non-compliant devices via Azure Resource Graph
4 Exploitation EXPLOIT-DEVICE-001 Target non-compliant devices for malware deployment

8. REAL-WORLD EXAMPLES

Example 1: Lazarus Group - Intune Policy Enumeration (2023)

Example 2: FIN7 - Policy Analysis for Lateral Movement (2024)

This site is open source. Improve this page.