Is it possible to capture a Windows Image using MDE or Intune

Copper Contributor

Or will it be possible sometime in the future??  We sometimes have to do this for legal purposes, and I was just curious if it's possible now or may be sometime in the future.  I am aware of some of the things you can do over Live Response as well as collecting an investigation package from a device, but was curious if a full image capture was possible?  And perhaps even sending that data to an Azure Storage Account?  Perhaps wishful thinking... 

Perhaps this question is better suited for Purview...?

2 Replies

@musekmkr not quite what you are looking for, but the Purview insider risk management forensics feature could be useful 

No reason you couldn't write a script that does this and upload it into your live response library.