Unmanaged Apps Detection

Overview

The Unmanaged Apps feature uses the Microsoft Graph API to retrieve discovered applications from your Intune-managed devices. It then automatically matches these apps against the Winget repository using fuzzy name matching and confidence scoring, helping you identify software gaps and bring unmanaged applications under Intune management.

Microsoft automatically filters out its own applications (e.g., Microsoft Edge, Visual C++ Redistributables) so you can focus on third-party software that needs management.

Required Permission

How Matching Works

IntuneGet uses a multi-step matching process to identify which Winget packages correspond to discovered applications:

1. Exact name matching - Compares the discovered app name directly against Winget package names
2. Fuzzy matching - Uses string similarity algorithms to find close matches even when names differ slightly
3. Confidence scoring - Each match receives a confidence score from 0% to 100% indicating match quality
4. Manual linking - You can manually link unmatched apps to specific Winget packages when automatic matching fails

Match Statuses

Claiming Applications

Claiming an application adds it to your deployment cart with pre-configured settings based on the matched Winget package. IntuneGet automatically generates detection rules, install/uninstall commands, and PSADT configuration.

Individual Claiming

Click the Claim button on any matched application card to add it to your deployment cart. IntuneGet will fetch the package manifest, determine the best installer, and configure all deployment settings automatically.

Bulk Claiming (Claim All)

Use the "Claim All" button in the toolbar to claim all matched applications at once. This processes apps in batches of 5 for optimal performance. A progress modal shows the status of each app being claimed.

Linking Packages Manually

For apps with no match or an incorrect match, you can manually link them to a Winget package:

1. Click the Link Package button on the app card
2. Search for the correct Winget package by name or ID
3. Select the package to create the mapping
4. The mapping is saved and will be used for future syncs, upgrading the match status to Matched with 100% confidence

Filtering and Views

Filter Options

View Modes

Toggle between Grid view (card layout with detailed information) and List view (compact table layout for quick scanning). The toolbar provides a view toggle switch.

Statistics Dashboard

The top of the Unmanaged Apps page displays key statistics:

When deploying claimed apps, you can assign them with an "Update Only" intent. This is particularly useful for discovered apps: instead of force-installing the app on every targeted device, it only updates devices where the app is already present.

How It Works

Selecting "Update Only" tells IntuneGet to assign the app as "required" in Intune but with an additional requirement rule that checks whether the app already exists on the device. Intune then evaluates two conditions:

1. Requirement met (app exists on the device) AND detection not met (new version not yet installed) -- Intune proceeds with the update
2. Requirement not met (app not on the device) -- Intune skips the device entirely
3. Requirement met AND detection met (app exists and is already up to date) -- device reports as compliant

Intune Evaluation Matrix

Configuring Update Only

1. Claim an unmanaged app (or add any app to your cart)
2. Open the app configuration and expand "Assignment Configuration"
3. Enable assignments and add a target (All Devices, All Users, or an Entra ID group)
4. Select Update Only from the intent dropdown -- the badge turns amber
5. An info banner explains the behavior
6. Save and deploy -- requirement rules are generated automatically

How Detection Works

The requirement rule detects the app using standard Windows uninstall registry methods, not the IntuneGet registry marker. This means it works for apps that were installed outside of IntuneGet (which is exactly the case for discovered/unmanaged apps):

• MSI apps with product codes: A registry requirement rule checks the product code's uninstall key directly
• All other apps: A PowerShell script searches both HKLM and HKCU uninstall registry paths by display name