Core Infrastructure and Security Blog

5 MIN READ

Analyse Intune Diagnostics Logs with GitHub Copilot

Microsoft

Jun 11, 2026

Hello everyone! I’m Stefan Röll, Cloud Solution Architect at Microsoft Germany for Cloud Endpoints. I work closely with IT Admins to improve their experience with everything around Intune, W365 and Windows. I know that troubleshooting an issue can be time consuming and challenging. In this blog I would like to show you how your troubleshooting skills can be supercharged with AI.

TL;DR

The way I troubleshoot issues has completely changed with GitHub Copilot. I just provide it with Intune Diagnostics Logs, network traces etc. and let the magic happen. The output still requires deep technical skills, but finding the root cause of an issue is just way faster and easier now.

GitHub Copilot – not only for developers

GitHub Copilot is best known for helping developers to write and fix code.

But it also has tremendous debugging and troubleshooting skills. And the best part is that it only takes two minutes to set up and you will never go back trying to manually find an issue if you must work through a lot of log files.

Getting started in two minutes

Let’s get started:

Go to https://github.com/features/copilot/plans and get a GitHub Copilot Subscription. If you are interested in Business or Enterprise subscriptions, please reach out to your Customer Success Account Manager (CSAM) or sales team to get started. It is also likely that you company already has subscriptions that you can get internally.

Once you’ve got your subscription, Install GitHub Copilot CLI via terminal:

winget install GitHub.Copilot

Now you can start Copilot via the command:

copilot

Next, type

/login

and log in with your GitHub account.

Now you should add the Microsoft Learn MCP Server and the included skills. This helps Copilot to search through the Microsoft documentation.

You can do this with:

/plugin install microsoftdocs/mcp

Copilot is ready for your first troubleshooting session! 🎉

Example #1 – Why did our PCs restart during the day?

Let’s start with a typical scenario: “All our PCs restarted during business hours. Can you please find the root cause for this?”

Before Copilot, you had to manually check multiple places to find the root cause. Was it triggered by a Windows update, an app update, a driver issue, or another hidden background process?

Now the only thing we need are Intune Diagnostics logs. Simply go to your Intune Console and collect diagnostics:

Once they are uploaded, download the .zip file to a local folder like C:\Temp\CopilotAnalysis.

Next, open a command prompt and go to the folder with the extracted files and start Copilot

cd C:\Temp\CopilotAnalysis
copilot

With “Shift + TAB” we switch over to the “Autopilot” mode of GitHub Copilot. This will tell Copilot to do its magic without asking for confirmation for each step. You can find more information about this mode here: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/autopilot

If you don’t want that, you can also continue in normal mode, but expect a lot of confirmation prompts.

With a simple prompt, we can create a deep root cause analysis, and Copilot will use the provided diagnostics logs:

Based on the provided Intune Diagnostics logs, find out why the Windows 11 PC rebooted automatically during business hours. Once you have found the issue, confirm your findings with the configured Microsoft Learn MCP Server. Then create a Root Cause Analysis Report and save it as HTML in the same folder. Include a timeline with relevant events in the report. Extract all needed files like .zip, .cab that you need for the analysis.

Now you can watch Copilot working through the logs and after some minutes you will get a report like this:

Here we go. You can see that the reboot was caused by a misconfigured Intune app deployment.

⚠️Please be aware that AI can make mistakes. Never blindly trust the output, especially any recommendations for how to fix an issue. ⚠️

However, now we have a fantastic starting point. In this case, Copilot correctly identified the root cause and we can fix this in Intune

It also created the requested timeline

Example #2 – Why did the Autopilot deployment fail?

When Autopilot deployments fail, it can be hard to troubleshoot as you may not have the affected device in front of you. Therefore, it is great that Intune automatically uploads diagnostics logs when this happens. In this example, an Autopilot deployment failed, and we are going to analyse the logs with Copilot.

I downloaded the logs to a new folder, opened the terminal, navigated to the folder, and started Copilot:

Now I am going to analyse this with a different prompt:

Analyse the provided Intune Diagnostics logs and find out why this Windows 11 Autopilot deployment failed. Once you have found the issue, confirm your findings with the configured Microsoft Learn MCP Server. Then create a Root Cause Analysis Report and save it as HTML in the same folder. Include a timeline with relevant events in the report. Extract all needed files like .zip, .cab that you need for the analysis.

After a beverage of choice, I had much more clarity on what happened:

Root cause: Enrollment Status Page (ESP) remained blocked in Account setup by a required user-targeted WinGet app that did not complete download/install during the observed log window. The blocking app was Sysinternals Suite - Req - All Users (Win32App_9c514d25-f55e-4177-af53-ca5ebbcf2619, package 9P7KNL5RWT25).

Remarks

In this blog, I did not cover different models, credits, better prompting, and other improvements you can make to optimise the analysis. I wanted to give IT Pros a quick start with GitHub Copilot CLI.

Summary

I highly recommend that you try GitHub Copilot yourself the next time you need to troubleshoot an issue. You will be amazed at how good it is at finding the root cause of an issue. This works with all kinds of log files, network traces, and more.

GitHub Copilot does not replace endpoint expertise, but it can dramatically reduce the time needed to move from raw diagnostics to a validated root-cause hypothesis.

I hope this blog helped you get started😊

Stefan Röll

Cloud Solution Architect – Microsoft Germany