Set up Microsoft Intune's App Inventory feature using Properties Catalog to collect comprehensive application data from Windows devices for enhanced compliance reporting and device management.
Evan MaelMicrosoft Intune's App Inventory feature provides comprehensive visibility into all applications installed on your Windows devices, going far beyond just the apps you've deployed through Intune. Using the Properties Catalog functionality introduced in 2024, you can collect detailed information about every application on managed devices, including installation dates, locations, user scope, and publisher details.
The Properties Catalog represents a significant evolution in Intune's inventory capabilities. Unlike basic app lists, it collects structured data about both Win32 applications (from registry sources) and modern Store apps (via Package Manager API). The system uses delta synchronization, meaning only changes are transmitted after the initial collection, dramatically reducing bandwidth usage compared to full inventory scans.
This feature becomes essential for organizations managing compliance requirements, software licensing, and security posture. You'll gain visibility into shadow IT applications, track software versions for vulnerability management, and generate comprehensive reports for audits. The 24-hour refresh cycle for Win32 apps ensures you have near real-time visibility into software changes across your environment.
The Device Inventory Agent automatically handles all collection and upload processes once you deploy the policy, making this a zero-touch solution after initial configuration. Combined with Intune's existing application management capabilities, you'll have complete visibility into both managed and discovered applications from a single console.
Start by signing into the Microsoft Intune admin center where you'll configure the app inventory policy.
Open your browser and navigate to https://intune.microsoft.com. Sign in with your administrator credentials that have either Global Administrator or Intune Administrator permissions.
Once logged in, you'll see the main dashboard. The Properties Catalog feature is part of the device configuration section, which we'll access in the next step.
Verification: Confirm you can see the main Intune dashboard with options like "Devices", "Apps", and "Endpoint security" in the left navigation pane.
Navigate to the device configuration section to create a new Properties Catalog policy for app inventory collection.
In the left navigation pane, click Devices > Manage devices > Configuration. This opens the configuration profiles page where you can see existing policies.
Click the Create button, then select New policy from the dropdown menu. You'll see a policy creation wizard with platform and profile type options.
Configure the policy basics:
Click Create to proceed to the policy configuration wizard.
Verification: You should now see the policy creation wizard with tabs for "Basics", "Configuration settings", "Assignments", etc.
Set up the fundamental details for your app inventory policy that will help you identify and manage it later.
On the Basics tab, fill in the following information:
App Inventory - All PropertiesCollects comprehensive application inventory data from Windows devices including install dates, locations, and user scope informationThe name should be descriptive enough that other administrators can understand the policy's purpose. The description provides additional context about what data this policy collects.
Click Next to proceed to the configuration settings where you'll define exactly what application properties to collect.
Verification: The policy name appears in the wizard header, and you should now be on the "Configuration settings" tab.
Configure which application properties the Device Inventory Agent will collect from your Windows devices.
On the Configuration settings tab, click + Add Properties. This opens a properties selection dialog where you can choose what data to collect.
Locate and check the ApplicationProperties checkbox. This expands to show all available application properties you can collect.
Required properties (automatically selected):
Recommended optional properties (check these boxes):
These additional properties provide valuable context for compliance reporting and troubleshooting. Install location helps identify portable apps, while install dates assist with software lifecycle management.
Verification: You should see the selected properties listed in the configuration settings with checkmarks next to each selected item.
Configure which devices or users will receive this app inventory policy.
Click Next to reach the Assignments tab. Here you'll specify the scope of devices that should collect app inventory data.
Click + Add groups under the "Include" section. You have several assignment options:
For comprehensive app inventory, select All devices or choose specific device groups based on your organizational needs. If you're testing, start with a pilot group containing 10-20 devices.
You can also add exclusions if certain devices shouldn't collect inventory data due to compliance or performance requirements.
Verification: Your selected groups appear in the "Include" section with the correct group names and member counts displayed.
Complete the policy creation process and deploy it to your selected devices.
Click Next to skip the optional "Scope tags" section (unless you use scope tags for administrative delegation in your organization).
On the Review + create tab, carefully review your policy configuration:
If everything looks correct, click Create to deploy the policy. Intune will begin pushing the policy to assigned devices.
The policy appears in your configuration profiles list with a "Deploying" status initially, then changes to "Deployed" once processed.
Verification: The policy appears in Devices > Configuration with "Deployed" status and shows the number of targeted devices.
Track the deployment progress and ensure devices are receiving and processing the app inventory policy.
Navigate to Devices > Configuration and click on your newly created "App Inventory - All Properties" policy. This opens the policy overview page.
Review the deployment status information:
Click on Device status to see which specific devices have successfully received the policy. Devices typically check in every 8 hours, but you can force a sync if needed.
To force a device sync, go to Devices > All devices, select a device, and click Sync. This triggers an immediate policy refresh.
Verification: Device status shows "Success" for your target devices, and the "Last check-in" time is recent (within 8 hours).
Confirm that the Device Inventory Agent is successfully collecting and uploading application data from your Windows devices.
Navigate to Devices > All devices and select a device that received the policy. Click on the device name to open its details page.
Click on the All apps tab. This view combines both managed applications (deployed through Intune) and discovered applications (collected via inventory).
Look for the inventory data indicators:
Win32 applications refresh every 24 hours, while modern apps (Store apps) refresh every 7 days. The data includes applications from both system-wide installations and per-user installations.
Verification: The "All apps" tab shows both managed and discovered applications with detailed properties like install dates, versions, and publishers.
Address typical problems that may prevent successful app inventory collection and optimize the feature for your environment.
Common Issue 1: Missing Win32 Application Data
If Win32 apps aren't appearing in inventory, check the Intune Management Extension status:
Get-Service -Name "Microsoft Intune Management Extension"
Get-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\IntuneManagementExtension\InventorySetting"For co-managed devices, verify the Client Apps workload assignment in the Configuration Manager console under Co-management > Workloads.
Common Issue 2: Delayed Data Refresh
Force an immediate inventory sync by restarting the IME service:
Restart-Service -Name "Microsoft Intune Management Extension" -ForcePerformance Optimization:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Win32AppInventory.log for detailed troubleshooting information about inventory collection processes.Verification: Run Get-Service "Microsoft Intune Management Extension" and confirm the service status is "Running". Check recent log entries for successful inventory uploads.
Microsoft MCSA-certified Cloud Architect | Fortinet-focused. I modernize cloud, hybrid & on-prem infrastructure for reliability, security, performance and cost control - sharing field-tested ops & troubleshooting.
Deepen your knowledge with related resources
Share your thoughts and insights
Sign in to join the discussion
