Reliable software inventory is the foundation of effective endpoint management. Without a clear view of installed applications, it becomes difficult to assess risks, categorize support tickets, or manage app processes effectively.
With Intune App Inventory , Microsoft is significantly expanding app discovery in Intune. The feature provides greater transparency regarding installed applications while simultaneously raising new questions: How does it differ from Discovered Apps, what are its limitations, and how can it be used effectively in operations?
This article provides a technical overview of Intune App Inventory and highlights what matters when using it.
Key takeaways
- Intune App Inventory enhances software inventory in Microsoft Intune and provides more detailed app data for managed Windows devices.
- The feature must be enabled via the Properties Catalog and uses the Microsoft Device Inventory Agent for data collection.
- Compared to Discovered Apps, App Inventory offers more technical metadata, though it is currently primarily relevant for device-based analysis.
- The greatest benefits for security, patch management, and helpdesk teams are realized when App Inventory is integrated into existing endpoint management processes.
1 What is Intune App Inventory?
Intune App Inventory is Microsoft's new approach to more detailed software inventory on Intune-managed Windows devices. The feature shows which applications are installed on a device, which versions are present, and the installation context in which an app was detected.
With this, Microsoft addresses several weaknesses of the previous Discovered Apps: limited metadata, delayed updates, and restricted usability for operational scenarios such as security reviews, patch management , or helpdesk analysis. In the long term, App Inventory is intended to succeed Discovered Apps, though it does not yet fully replace the existing feature in production.
Unlike traditional inventory lists, App Inventory provides not only the name, version, and publisher, but also additional technical information.
Technically, App Inventory is more than just a new portal view. Data collection is handled by the Microsoft Device Inventory Agent, which runs on the Windows device as the "InventoryService" service. The agent uses the same modern inventory infrastructure that Microsoft also uses for Advanced Device Inventory. The corresponding policy is delivered to the device not via the classic MDM channel, but via MMP-C (Microsoft Management Platform – Cloud) using the declared configuration model. Instead of cyclically reconciling configurations using the classic request-response principle, MMP-C provides the device with a target state once—specifying which app properties should be captured—and the agent independently ensures that this state is maintained continuously. This is important for operations because troubleshooting can be performed not only in the Intune admin center, but also on the client itself.
Currently, App Inventory is aimed at Windows 10 and Windows 11 devices that are managed in Intune and are Microsoft Entra-joined. Hybrid-join or co-management scenarios should be specifically validated before a broad rollout, as Microsoft's documented core requirements are primarily focused on Microsoft Entra-joined Windows devices.
2 What app data Intune App Inventory collects
The primary value of Intune App Inventory lies in its enhanced database. For Windows devices, Win32 applications are captured via Windows uninstall registry keys, while Store apps are detected using the Package Manager API. After the initial full upload, data collection is delta-based, ensuring that changes are transmitted more efficiently.
The following table highlights key fields and their practical benefits:
Not every field is equally important in every environment. While installation paths, user associations, or uninstall commands can be very helpful, they also increase the complexity of data collection. Therefore, before rolling it out, you should determine which information is actually required for operations, security, and support.
A successful implementation usually begins with a pilot group. This allows you to validate whether the desired fields are populated reliably, how the data can be analyzed in the portal, and what impact the policy has on existing processes.
For very large or unusually configured devices, you should also verify that all expected applications appear correctly. Community analysis suggests an unofficial limit of 1,000 applications per device. Since this limit is not officially documented, it should not be treated as a hard product constraint, but it serves as a useful checkpoint for testing and troubleshooting.
3 Intune App Inventory vs. Discovered Apps: Differences, limitations, and current parallel operation
App Inventory and Discovered Apps currently serve different purposes in Microsoft Intune. App Inventory provides a more detailed view per Windows device. Discovered Apps remains relevant, however, when tenant-wide overviews, exports, or platforms beyond Windows are required.
At the same time, the direction is clear: Microsoft is positioning App Inventory as the long-term replacement for Discovered Apps. In the Intune Admin Center, Discovered Apps is increasingly categorized as a legacy view, while the new All-apps view, powered by App Inventory, serves as the modern foundation for app detection.
App Inventory primarily answers device-related questions:
- Which version of an application is installed on a specific endpoint?
- Was the app installed in the user or device context?
- Are there usable uninstall or modify commands?
- When was the application last detected?
- Which app data helps with troubleshooting?
Discovered Apps remains stronger when it comes to overarching questions:
- On how many devices is a specific application installed?
- Which applications are most common across the entire tenant?
- Which platforms need to be included in an overall summary?
- Which data should be exported or incorporated into existing reports?
The main limitation of App Inventory lies not in the quality of the individual data, but in its centralized operationalization. A fully developed tenant-wide aggregate view, a clearly documented reporting pipeline, and a clear migration strategy for Discovered Apps are not yet fully tangible.
For production environments, this leads to a pragmatic recommendation: Enable App Inventory, but continue using Discovered Apps in parallel for the time being. App Inventory is suitable for detailed Windows device analysis. Discovered Apps remains useful for aggregation, export, and broader platform overviews.
4 Benefits for Security, Patch Management, and Helpdesk
The operational value of App Inventory is only realized when data is integrated into existing processes. Three areas are particularly relevant: security, patch management, and the helpdesk.
In a security context, App Inventory helps to evaluate installed software more accurately. Outdated applications, unwanted tools, or non-standardized installations can create risks. The better the data, the more precisely such risks can be identified.
Typical security questions include:
- Which outdated or potentially risky applications are present?
- Which software was installed outside of defined standards?
- Which apps are only present on a per-user basis?
- Which publishers or versions should be reviewed?
- Which devices require targeted cleanup?
For patch management, App Inventory provides a better foundation for evaluating third-party applications. Especially outside the Microsoft ecosystem, it is often difficult to see which versions are actually installed. The additional metadata helps to prioritize update requirements and better track successful updates.
There are also concrete advantages for the helpdesk. Support teams can check more quickly whether an application is installed, which version is present, in what context it was installed, and whether technical information for repair or uninstallation is available. This allows many initial analyses to be performed without needing to access the device directly.
For troubleshooting, the technical foundation is also relevant. If app data does not appear or seems incomplete, you should check more than just the policy assignment in the Intune Admin Center. The Microsoft Device Inventory Agent on the client, the "InventoryService" service, and the local agent files can also provide clues. This makes App Inventory more of an operational endpoint managementcomponent and less of a purely portal-based view.
App Inventory does not replace a sound app management strategy. The feature shows which applications are present, but actionable measures only emerge once software packaging, patch management, security governance, and lifecycle processes are clearly defined.
5 Conclusion: App Inventory as a building block for modern endpoint management
Intune App Inventory significantly improves software inventory in Microsoft Intune. The feature provides more detailed and up-to-date app data for Windows devices, creating a better foundation for operations, security, patch management, and the helpdesk.
At the same time, App Inventory should not currently be viewed as a complete replacement for all existing reports. Discovered Apps remains relevant, especially for tenant-wide overviews, exports, and platforms outside of Windows. The most sensible approach is therefore a controlled parallel operation with a clear division of tasks.
For IT organizations, App Inventory is most valuable when it is not viewed in isolation. Real operational benefits only arise in conjunction with app management, software packaging, third-party patching, security reviews, helpdesk processes, and a sound Intune strategy. This is exactly where our Intune consulting can help: by evaluating existing Intune processes, implementing App Inventory effectively, and integrating it into a robust endpoint management concept.
Since 2011, Thore has focused exclusively on endpoint management and endpoint security topics. Initially focused on software packaging and software distribution with Microsoft MECM/SCCM and Ivanti DSM, he is now a sought-after interlocutor when it comes to unified endpoint management, system hardening, patch management and endpoint protection. The focus is in particular on the Microsoft technologies Intune, Configuration Manager, Entra and Defender. Thore is co-founder of the “Endpoint Management” expert group at IAMCP e.V.
Years of Experience
Managed Endpoints
