Microsoft Intune Monitoring TryHackMe
The TryHackMe Microsoft Intune Monitoring Room is a subscriber/MAX only room from TryHackMe that focuses on using Splunk logs to monitor Intune for abuse. The room is available to subscribers at: https://tryhackme.com/room/msintunemonitoring
1.1 Is Intune a cloud-based or self-hosted MDM solution?
Answer: cloud-based
1.2 What identity platform does Intune closely integrate with?
Answer: Entra ID
2.1 What Entra ID and Intune feature controls access based on conditions?
Answer: Conditional Access
2.2 Which log field in SIEM shows if the device is managed or not?
Answer: deviceDetail
3.1 What is the device ID of the wiped device?
Answer: d66b71f3-a644–4392–89b2-d97ba5612356
3.2 What is the hostname of the wiped Windows device?
Get Muhammad Faizan’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer: LPT-08312
3.3 From which IP did the admin perform the remote wipe?
Answer: 149.40.62.43
4.1 What is the ID (resourceId) of the deleted Intune script?
Answer: c0709410-f1e0–4619-ac73-eca347ca1b8b
4.2 When was the other script deployed to the targets? Answer Example: 2026–01–15 12:30:45
Answer: 2026–03–17 18:57:57
4.3 What is the output of the deployed script? Note: Use the logs from the PC-096 device.
Answer: THM{hello_world_from_intune!}
5.1 Would you rather use a single shared Intune role in your company (A),
or create multiple focused roles for each team or job position (B)?
Answer: B
5.2 What Intune feature requires multiple users to approve a dangerous action?
Answer: Multi Admin Approval
THANKS AND FOLLOW ME.
