Bulk Trigger Intune Device Diagnostics Collection

The Intune admin center does not support a true bulk "collect diagnostics" action — you must trigger it on each device individually. Use this path for a small number of devices (under ~20); for larger fleets, use the Graph API or PowerShell approach.

Per-device procedure

1. Sign in to the Microsoft Intune admin center with an account that has the Intune Administrator or Help Desk Operator role.
2. Navigate to Devices → All devices.
3. Use the filter bar to narrow the list (e.g., OS = Windows, Compliance = Not compliant) and locate the target device.
4. Click the device name to open its overview blade.
5. In the action bar at the top, click Collect diagnostics. (On Windows this appears as Collect diagnostics; on macOS it may be labeled Collect logs.)
6. Confirm the action in the prompt. The request is queued and the device will upload logs on its next check-in.
7. To retrieve the logs, wait for the request status to change to Complete, then open Device → Monitor → Device diagnostics and click Download on the relevant entry.

Tracking bulk requests

After triggering many requests via script/API, you can review their status centrally at Devices → Monitor → Device diagnostics. This view shows all pending and completed collection requests across the tenant, with download links for completed bundles.

Microsoft Graph exposes two endpoints you will use: one to enumerate devices, one to trigger the collection.

Step 1 — Enumerate target devices

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$select=id,deviceName,operatingSystem,complianceState&$filter=operatingSystem eq 'Windows'

Use $filter to narrow the targeting (by OS, compliance state, enrollment type, etc.) and $select to keep payloads small. The endpoint is paginated — follow @odata.nextLink until it is absent.

Sample response:

{
  "value": [
    {
      "id": "9f420691-1c67-4b46-b154-0e1b1342f4c4",
      "deviceName": "DESKTOP-EXOTIC-891",
      "operatingSystem": "Windows",
      "complianceState": "nonCompliant"
    }
  ],
  "@odata.nextLink": "https://graph.microsoft.com/beta/deviceManagement/managedDevices?$skiptoken=..."
}

Step 2 — Trigger diagnostics collection for each device

POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{managedDeviceId}/createDeviceLogCollectionRequest
Content-Type: application/json

{
  "templateType": "predefined"
}

Response: HTTP 200 OK with an empty body on success. A 400 typically means the device platform does not support the action; a 404 means the device ID is stale.

Step 3 — Check request status (optional)

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{managedDeviceId}/logCollectionRequests

Returns an array of past and pending requests with status (pending, completed, failed) and, for completed requests, a SAS URL to download the log bundle.

Throttling guidance

• Use concurrency of no more than 10 parallel POSTs.
• Retry on HTTP 429 using the Retry-After header.
• For fleets > 500 devices, expect the full rollout to take several minutes.

The script below uses the Microsoft.Graph.Beta.DeviceManagement module to enumerate devices, optionally filter them, and fan out createDeviceLogCollectionRequest calls in batches with throttle handling.

Prerequisites

• PowerShell 7+ (recommended) or Windows PowerShell 5.1
• Microsoft Graph PowerShell SDK: Install-Module Microsoft.Graph.Beta -Scope CurrentUser
• A signed-in account with Intune Administrator or equivalent role

Running the script

1. Save the script (below) as Invoke-IntuneBulkDiagnostics.ps1.
2. Connect to Graph: Connect-MgGraph -Scopes "DeviceManagementManagedDevices.PrivilegedOperations.All","DeviceManagementManagedDevices.Read.All"
3. Run with a filter: .\Invoke-IntuneBulkDiagnostics.ps1 -OperatingSystem Windows -WhatIf to preview.
4. Remove -WhatIf to actually trigger the collection.

What the script does

• Enumerates managed devices with optional filters (OS, compliance state, device name pattern)
• Shows a summary table and prompts for confirmation before firing POSTs
• Runs the POSTs with a configurable concurrency cap and automatic retry on HTTP 429
• Writes a CSV log of successes and failures to .\diagnostics-bulk-result-YYYYMMDD-HHmm.csv

After the script completes, monitor progress at Intune admin center → Devices → Monitor → Device diagnostics and download the log bundles from there as each device checks in.