Intune Diagnostics Workspace

The Intune workspace analyzes Intune Management Extension (IME) logs and produces a structured diagnostic view — timelines, download statistics, event summaries, and issue detection — so you don't have to read raw log text line by line.

Opening the Intune Workspace

Switch to the Intune workspace from the workspace selector in the toolbar.

Input Options

Single IME Log

Open a single IntuneManagementExtension.log file for analysis.

IME Logs Folder

Open the entire C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\ folder to analyze all IME logs together. This gives the most complete picture because it includes sidecar logs:

• AppWorkload.log — Win32 and WinGet download/install detail
• AppActionProcessor.log — assignment decisions and applicability
• AgentExecutor.log — script execution with command lines and exit codes
• HealthScripts.log — proactive remediation scheduling

Source Preset

Use the IME Logs source preset in the toolbar to open the default IME logs path without navigating to it manually.

What You Get

Event Timeline

A color-coded timeline showing:

• Win32 app installs and their phases
• WinGet app operations
• PowerShell script executions
• Proactive remediations
• ESP (Enrollment Status Page) progress
• Sync sessions

Each event shows its source file, status (success/failure/pending), and timing.

Download Statistics

For app installations that involved content download:

• Total download size
• Download speed
• Delivery Optimization percentage
• Download duration

Summary Dashboard

High-level counters including:

• Total events by type
• Success and failure rates
• Pending and timed-out items
• Log time span coverage
• Source file provenance

GUID Extraction

The analyzer automatically extracts Intune app and policy GUIDs from the logs. These are displayed alongside events so you can cross-reference with the Intune portal.

Issue Detection

The workspace clusters related failures and surfaces:

• Issue summary and severity
• Evidence from the logs
• Suggested next checks
• Recommended fixes where the evidence is strong enough

Tips

• Use the folder input instead of a single file for the most complete analysis
• Check the source provenance to see which files contributed to the analysis
• Use the event timeline to find the sequence of events leading up to a failure
• GUID extraction helps you map log entries back to specific apps in the Intune portal