Data connectors & ingestion

Getting Intune logs into Sentinel — there's no connector

Intune routes through Diagnostic Settings, not the Content Hub — the four tables you get, which tier they land in, the cost decision that follows, and the gotchas (no backfill, ~1h latency, split roles).