Unassigned & Superseded Intune Apps
The question it answers: Which Intune apps are assigned to nobody, superseded but still assigned, or from the retired Microsoft Store for Business?
Apps assigned to nobody, older versions still assigned next to the app that supersedes them, and apps from Microsoft Store for Business (retired) pile up in every tenant. Install failures are a separate question; this report is about clean-up.
At a glance
Section titled “At a glance”| Where in the app | Intune › Device Operations & Hardening › Unassigned & Superseded Apps |
| Workload | Intune |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Intune. |
| Report id (API and MCP) | intune.operations.app-hygiene |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Issue | Category | Text |
| App | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Publisher | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Intune.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
DeviceManagementApps.Read.All | Microsoft Graph | Read Microsoft Intune apps |
Data sources it reads
GET /beta/deviceAppManagement/mobileApps?$expand=assignmentsGET /beta/deviceAppManagement/mobileApps/{id}/relationships ($batch)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/intune.operations.app-hygiene?size=100An AI assistant reads it with the MCP tool get_report and the id intune.operations.app-hygiene. The client needs the Read grant for Intune. See Using the API.