Microsoft Intune Data Extraction Guide (for SIM Template)

• Intune Discovered Apps (per device): Application inventory detected on managed devices.

• Microsoft Graph API:

  • deviceManagement/managedDevices (device metadata, including deviceName)

  • deviceManagement/managedDevices/{id}/detectedApps (apps per device)

  • deviceManagement/detectedApps with related managedDevices (for join-style retrieval)

Notes:

• Discovered apps coverage varies by platform and management channel.

• Windows 10/11, Windows Server (where supported), and macOS provide the richest app metadata. Publisher may be blank for some entries.

Prerequisites

For Console (UI) Method

• Intune Admin Center access with permission to view Devices/Reports.

• Devices must be enrolled and recently reported inventory.

• Ability to export reports (standard tenant permission).

For Graph API (PowerShell) Method

• Azure AD app registration or delegated admin with:

  • DeviceManagementManagedDevices.Read.All

  • DeviceManagementApps.Read.All

• PowerShell 7+ recommended.

• Microsoft Graph PowerShell SDK or ability to obtain OAuth token for REST calls.

• Network access to graph.microsoft.com.

Two supported approaches are documented below.

Option 1: Intune Admin Center (UI) Export

This is the simplest and fastest way to get a one-off export.

1. Sign in to Intune Admin Center: https://intune.microsoft.com.

2. Go to Reports → Devices → Discovered apps.

   • Alternatively: Apps → Monitor → Discovered apps.

3. Filter by Platform and/or Device groups as needed.

4. Click Export and choose CSV.

5. Save as Intune_SIM_Export.csv.

Ensure your CSV includes or can be mapped to:

• Device name (may appear as Device or Device Name)

• App / Application name

• Version

• Publisher / Vendor

If device name appears in a separate export, use the Graph API approach below to guarantee a single, properly structured file.

Option 2: Microsoft Graph API (PowerShell) — Recommended for Automation

This script retrieves managed devices and their detected apps, then flattens the results to the exact SIM column layout.

Step 1: Connect to Microsoft Graph

# Requires Microsoft.Graph module
# Install-Module Microsoft.Graph -Scope CurrentUser

Import-Module Microsoft.Graph

# Connect with required permissions:
# DeviceManagementManagedDevices.Read.All, DeviceManagementApps.Read.All
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","DeviceManagementApps.Read.All"
Select-MgProfile -Name "beta"   # or "v1.0" if your tenant supports all used endpoints

Step 2: Retrieve Devices and Detected Apps, Then Export

# Export path
$ExportPath = "C:\Exports\Intune_SIM_Export.csv"

# 1) Get all managed devices (pull Device Name and Id)
$allDevices = @()
$resp = Invoke-MgGraphRequest -Method GET -Uri "/beta/deviceManagement/managedDevices?`$top=999"
$allDevices += $resp.value
while ($resp.'@odata.nextLink') {
    $resp = Invoke-MgGraphRequest -Method GET -Uri $resp.'@odata.nextLink'
    $allDevices += $resp.value
}

# Helper lookup: DeviceId -> DeviceName
$deviceNameById = @{}
$allDevices | ForEach-Object {
    if ($_.id -and $_.deviceName) { $deviceNameById[$_.id] = $_.deviceName }
}

# 2) For each device, get detected apps and build SIM rows
$exportRows = New-Object System.Collections.Generic.List[object]

$deviceCount = $allDevices.Count
$idx = 0
foreach ($dev in $allDevices) {
    $idx++
    # Optional progress
    Write-Progress -Activity "Fetching detected apps" -Status "$($dev.deviceName) ($idx of $deviceCount)" -PercentComplete (($idx/$deviceCount)*100)

    $appsResp = Invoke-MgGraphRequest -Method GET -Uri "/beta/deviceManagement/managedDevices/$($dev.id)/detectedApps?`$top=999"
    $apps = @()
    $apps += $appsResp.value
    while ($appsResp.'@odata.nextLink') {
        $appsResp = Invoke-MgGraphRequest -Method GET -Uri $appsResp.'@odata.nextLink'
        $apps += $appsResp.value
    }

    foreach ($app in $apps) {
        # Graph properties commonly available: displayName, version, publisher
        $exportRows.Add([PSCustomObject]@{
            "Device Name"        = $dev.deviceName
            "Software Name"      = $app.displayName
            "Software Version"   = $app.version
            "Software Publisher" = $app.publisher
        })
    }
}

# 3) Export to CSV (UTF-8, no type info)
$exportRows | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "Export complete: $ExportPath"

Notes:

• If your tenant restricts the beta profile, use v1.0 where supported.

• Large tenants should expect pagination; the script handles @odata.nextLink.

• Some entries may lack Publisher or Version depending on the app source.

Exporting to CSV

• UI method: Use Export → CSV in the Discovered apps report and save as Intune_SIM_Export.csv.

• API method: The PowerShell script writes Intune_SIM_Export.csv to your chosen path.

Your CSV must include the following headers (exact names):

Preparing for SIM Import

1. Open the Licenseware SIM Template.

2. Paste or import the CSV data.

Remove blanks/duplicates before saving.

👉 Learn more here

Troubleshooting

Example Output

Device Name,Software Name,Software Version,Software Publisher
LAPTOP-001,Google Chrome,129.0.6668.90,Google LLC
LAPTOP-002,Microsoft 365 Apps for Enterprise,2409,Microsoft Corporation
MBP-003,Slack,4.39.95,Slack Technologies
SRV-01,Adobe Acrobat DC,24.002.20933,Adobe Inc.