One of my most popular scripts displays a list of applications and the total number of installs (amongst other things) – here
A recent comment on there asked if there was any way to list the install dates as well and this got me thinking. Could I create a new script which could show exactly which machines have an app installed (whether that’s been pushed or user initiated) and the install date, but quicker than digging around in the portal.
The answer is yes and here it is!
UPDATE: Version 3.0 now released with CSV output as well as clipboard (and MG Graph Auth)
As usual, the script can be found on github here or on PSGallery for quick install:
Install-Script -Name find-intune-app-installs
After authenticating against your tenant, you will be presented with a popup with a list of all apps detected, assigned or not (you may be looking for old app installs from a now unassigned app after all)
You can of course filter if you have many applications.
Once you have selected an application, click the OK button, this is where the magic happens.
At this point it loops through every device, finds the primary user and the apps installed for that user. If the application is detected, it runs through the troubleshooting history to find the event where the install succeeded and gives you both the hostname and the date.
Some of you may have large estates, so the output you see will also automatically be added to your copy buffer so you can manipulate it further
Hopefully this is of some use!
As always, any comments, requests or suggestions, just add them below.
15 thoughts on “Detecting which machines have which Intune applications installed via PowerShell and MS Graph”
First of all thank you very much, to me this is a very handful script.
I’ve being looking for this for quit some time.
I just have one question, why using the clipboard instead of exporting it to CSV or some other format?
I would think that this will meanly be used to report so I would think that another format would be more useful to export to then your clipboard?
That makes a lot of sense, I’ll add an export and drop the path into the popup box.
Thanks for the feedback!
Version 2.0 has now been published with a CSV output into %temp%
Thank you for making it a little more convenient.
But I cannot seem to be able to get any install dates.
Any idea as to why?
Hi, what output do you get when you click on an app? Does it show any device names?
Thank you for the script and all the work you put into it.
I can see that device collection is limited to 1000 device.
Maybe introduce paging to accommodate to a larger number of devices ?
Hi, is that when clicking on an app? I’ll see if I can tweak the Graph query to return all results
Yes, after clicking on an app in the gridview.
I have also seen that the $events does not return an “actiontype” member, which is why the occurenceDateTime cannot be retrieved via that condition.
Only the following members are present for $events:
Another observation, I am sorry for this 🙂 all in good faith…..
The condition as the script loops through $appstocheck populates an entry in the array $appinstalls for the application even if it is uninstalled, maybe because the if statement only considers the installedstate “failed” and not “notInstalled”.
Once again, very grateful.
I’ve just published v2.1.0 which should fix all of these issues for you. I don’t have more than 1000 devices in my test tenant so no guarantees that will work the first time, any testing is most welcome!
Thank you for a fast update.
The dates are still lacking, it seems while I am testing in my environment (3000 + devices), there is no member labelled “actiontype” for “EVENT”
“Event” has the only the following noteproperty members, actiontype is not one of them:
The actiontype appears in the history when the application is installed, that’s why it is looking for it. It might be worth looking at the machines themselves and checking the app has installed correctly
The applications are installed, the status is derived in the previous step in your script as it confirms that since it is a requirement.
I think the issue has to do with the information included for device type. I just compared a Windows device with an Android device.
The member “ActionType” does not exist for Android devices but is present for Windows.
So, mystery solved…….
Well spotted, just added a new version with some extra logic to find the date/time for Android installs
A little feedback regarding version 3.0.0
After testing, I discovered that the installed dates are incorrect for Android devices.
The date returned is the application “CREATED” date and not the install date.
In this test case, a freshly installed device on the 26th of October reports an install date for an application dated March 2022 which also coincides with the application creation date in Intune.
I can’t see anything in the Intune portal, or in Graph which confirms when the app was actually installed onto the device, the options seem to be App Created, App Updated, or app deployed to group, but nothing on the device itself.