Inventory Installed Software (Detected Apps) on a User's Intune-Managed Devices

Using the Microsoft Intune admin center

1. Sign in to the Microsoft Intune admin center with an account that holds the Intune Administrator, Global Reader, or Helpdesk Operator role.

2. In the left navigation, go to:

   Users → All users → search for the target user (e.g. {user_upn}) → select the user

3. On the user's blade, select Devices. You will see every Intune-enrolled device associated with that user, including device name, OS, compliance, last check-in, and primary user.

4. Click a device to open its details blade.

5. In the device's left-hand menu, select:

   Monitor → Discovered apps

   This shows every application Intune has detected on that device, with columns for App name, Version, and Publisher.

6. Use the Export button (top of the grid) to download the inventory as CSV for archival or ticket attachment.

7. Repeat steps 4–6 for each of the user's devices if they have more than one.

Tenant-wide alternative

For a cross-device pivot (e.g., "which devices have Acrobat Reader installed?"), use:

Apps → Monitor → Discovered apps

Then filter by app name and inspect the Devices column.

Using Microsoft Graph

The end-to-end flow requires four calls. All examples use the v1.0 endpoint where available, falling back to beta for detectedApps.

Step 1 — Resolve the user's object ID

GET https://graph.microsoft.com/v1.0/users/{user_upn}?$select=id,displayName

Response:

{
  "id": "771aac0a-bfda-4c0f-ae7c-d649ca972bf7",
  "displayName": "Alexander Jamieson"
}

Step 2 — List the user's Intune-managed devices

Use the userId filter on the managed devices collection:

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?$filter=userId eq '{user_id}'&$select=id,deviceName,operatingSystem,osVersion,model,lastSyncDateTime,complianceState

If this returns an empty result but the user clearly has devices, fall back to the Entra ID registered-devices endpoint and cross-reference by device name:

GET https://graph.microsoft.com/v1.0/users/{user_id}/registeredDevices?$select=id,displayName,operatingSystem

Step 3 — For each managed device, fetch detected apps

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices('{managed_device_id}')/detectedApps?$select=displayName,version,publisher,sizeInByte,deviceCount

Sample response:

{
  "value": [
    {
      "displayName": "Microsoft Edge",
      "version": "121.0.2277.128",
      "publisher": "Microsoft Corporation",
      "sizeInByte": 0
    },
    {
      "displayName": "7-Zip 23.01 (x64)",
      "version": "23.01",
      "publisher": "Igor Pavlov"
    }
  ]
}

Step 4 — Handle paging

If the response contains @odata.nextLink, issue a follow-up GET to that URL until the link is absent. Large fleets can return hundreds of apps per device.

Troubleshooting 401/403

If /deviceManagement/managedDevices returns Forbidden even with the correct Graph scopes consented, the signed-in principal is missing an Intune RBAC role. Assign one of: Intune Administrator, Global Reader, Helpdesk Operator, or a custom Intune role that includes Managed devices: Read and Organization: Read.

Using PowerShell and the Microsoft.Graph module

The script below automates the full flow: resolve user, list their managed devices, pull detected apps per device, and emit both a per-device breakdown and a consolidated deduplicated list.

Prerequisites

• PowerShell 7+ recommended.
• Install the Graph module once: Install-Module Microsoft.Graph -Scope CurrentUser
• The signed-in account must hold an Intune-aware admin role.

Quick interactive run

Connect-MgGraph -Scopes "User.Read.All","DeviceManagementManagedDevices.Read.All","DeviceManagementApps.Read.All"

# Resolve user
$user = Get-MgUser -UserId "{user_upn}"

# List managed devices for that user
$devices = Get-MgDeviceManagementManagedDevice -Filter "userId eq '$($user.Id)'"

# Pull detected apps per device
foreach ($d in $devices) {
    Write-Host "`n== $($d.DeviceName) ($($d.OperatingSystem)) =="
    Get-MgDeviceManagementManagedDeviceDetectedApp -ManagedDeviceId $d.Id |
        Select-Object DisplayName, Version, Publisher |
        Sort-Object DisplayName |
        Format-Table -AutoSize
}

For a production-ready version with parameters, error handling, CSV export, and consolidated output, download the script below.