Get All Installed Apps from Intune: PowerShell Guide

<#
.SYNOPSIS
    Export all installed applications across Intune-managed devices via Microsoft Graph API.
.DESCRIPTION
    Queries Microsoft Graph /deviceManagement/managedDevices to enumerate detected apps per device,
    extracts device names, app names, versions, and bundle IDs, and exports everything into a structured CSV.
.NOTES
    Requires Microsoft Graph Application Permission: DeviceManagementManagedDevices.Read.All
#>

[CmdletBinding()]
param(
    [string]$TenantID = "YOUR_TENANT_ID",
    [string]$ClientID = "YOUR_CLIENT_ID",
    [string]$ClientSecret = "YOUR_CLIENT_SECRET",
    [string]$OutputCsv = "$env:USERPROFILE\Desktop\Intune_Installed_Apps.csv",
    [int]$RequestTimeout = 120
)

# Start local log transcript
$LogPath = "$env:ProgramData\TechEUC\Logs"
if (-not (Test-Path -Path $LogPath)) {
    New-Item -Path $LogPath -ItemType Directory -Force | Out-Null
}
$LogFilePath = Join-Path -Path $LogPath -ChildPath "IntuneAppInventory.log"
Start-Transcript -Path $LogFilePath -Append -Force

try {
    # Get Access Token via OAuth 2.0
    Write-Host "[INFO] Authenticating to Microsoft Graph API..." -ForegroundColor Cyan
    $TokenUrl = "https://login.microsoftonline.com/$TenantID/oauth2/v2.0/token"
    $TokenBody = @{
        Client_Id     = $ClientID
        Scope         = "https://graph.microsoft.com/.default"
        Client_Secret = $ClientSecret
        Grant_Type    = "client_credentials"
    }
    $TokenResponse = Invoke-RestMethod -Uri $TokenUrl -Method Post -Body $TokenBody -TimeoutSec $RequestTimeout
    $AccessToken = $TokenResponse.access_token

    # Define Headers for Graph API
    $Headers = @{
        Authorization  = "Bearer $AccessToken"
        "Content-Type" = "application/json"
    }

    # Query Microsoft Graph API for Managed Devices with detected apps
    Write-Host "[INFO] Querying Intune managed devices and installed apps..." -ForegroundColor Cyan
    $BaseUrl = "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?`$expand=detectedApps(`$select=displayName,version,sizeInByte)&`$select=id,deviceName,userPrincipalName,operatingSystem,osVersion"

    $AllApps = [System.Collections.Generic.List[PSObject]]::new()

    $NextLink = $BaseUrl
    while ($NextLink) {
        $Response = Invoke-RestMethod -Uri $NextLink -Headers $Headers -Method Get -TimeoutSec $RequestTimeout
        foreach ($Device in $Response.value) {
            if ($Device.detectedApps) {
                foreach ($App in $Device.detectedApps) {
                    $AllApps.Add([PSCustomObject]@{
                        DeviceName        = $Device.deviceName
                        UserPrincipalName = $Device.userPrincipalName
                        OperatingSystem   = $Device.operatingSystem
                        OSVersion         = $Device.osVersion
                        ApplicationName   = $App.displayName
                        ApplicationVersion= $App.version
                        AppSizeBytes      = $App.sizeInByte
                    })
                }
            }
        }
        $NextLink = $Response.'@odata.nextLink'
    }

    # Export to CSV
    if ($AllApps.Count -gt 0) {
        $AllApps | Export-Csv -Path $OutputCsv -NoTypeInformation -Force
        Write-Host "[SUCCESS] Exported $($AllApps.Count) application records to $OutputCsv" -ForegroundColor Green
    } else {
        Write-Warning "[WARN] No installed applications discovered on managed devices."
    }
}
catch {
    Write-Error "[FATAL] Script execution failed: $($_.Exception.Message)"
}
finally {
    Stop-Transcript
}