Forum Discussion

Swahlea's avatar
Swahlea
Copper Contributor
Mar 30, 2026

Intune – Unable to reliably validate application installation status via Microsoft Graph APIs

Hi Everyone,

I am working on application deployment and validation using Microsoft Intune, and I am trying to implement an automated validation step to confirm whether applications are successfully installed.

 

My primary requirement

  • Verify application installation status
  • Confirm per‑device installation status
  • Validate installation for specific Intune‑managed devices
  • Use Graph APIs as part of an automation workflow

APIs tested so far

1️⃣ App installation status per device (NOT working / not usable)

I initially tried using the documented API:

HTTP

GET https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{mobileAppId}/deviceStatuses

 

Issue:

  • This API is not working for us
  • It either returns no data or behaves as if it is not a valid / usable endpoint
  • It does not return reliable installation status
  • Hence, we cannot use this API for validation in automation

At this point, deviceStatuses is not usable as a primary source of truth in our environment.

 

2️⃣ Detected Apps (secondary confirmation only)

 

We are also using the Detected Apps API:

HTTP

GET /deviceManagement/managedDevices/{deviceId}/detectedApps

 

This does work, however:

  • It only confirms app presence
  • It does not confirm Intune assignment or installation intent
  • We are using it strictly as a secondary confirmation, not a primary validation method

 

3️⃣ Intune internal API observed via browser inspection

 

We also tested the API that appears to be used internally by the Intune portal:

HTTP

GET https://graph.microsoft.com/beta/users/{user-id}/mobileAppIntentAndStates/{device-id}

Observations:

  • The API returns data
  • However, installState frequently shows unknown
  • The Intune portal shows a different and final status (Installed / Failed / Pending)
  • This makes the API unreliable for automation
  • It appears to be troubleshooting‑oriented, not intended for reporting or validation

Questions I am looking for guidance on

  1. Is deviceStatuses known to be unreliable, tenant‑dependent, or effectively unsupported?
  2. What is the recommended API to retrieve actual app installation status per device?
  3. Are there any v1.0 APIs available for:
    • Device‑level app installation status?
    • User‑level app installation validation?
  4.  What is Microsoft’s recommended best practice to validate Intune‑installed applications via automation?
  5. Is there official documentation that clearly explains:
    • Which API should be used for reporting vs troubleshooting
    • Expected delays or data inconsistencies between Graph APIs and the Intune portal

Goal

The goal is to build a reliable and supported automation‑based validation mechanism to confirm that Intune‑deployed applications are successfully installed on target devices.

Any official guidance, confirmation of known limitations, or alternative approaches would be very helpful.

 

Thanks in advance for your support.

device management
enterprise mobility
Graph API
Intune
Microsoft Graph
microsoft intune

1 Reply

  • kyazaferr's avatar
    kyazaferr
    MCT
    Mar 31, 2026

    Hi,

     

    You are hitting a common hurdle with Intune reporting. The reason your tests with deviceStatuses and mobileAppIntentAndStates are inconsistent is that those endpoints often represent the policy delivery state rather than the execution state.

     

    To get the accuracy you are looking for in an automation workflow, you should move away from the deviceAppManagement beta status endpoints and use the App Install Status collection.

     

    The Recommended API (v1.0 & Beta)

     

    For per-device status of a specific mobile app, the most reliable endpoint depends on your assignment type:

     

    For Device-based assignments: GET {mobileAppId}/deviceStatuses (Note: If this returns empty, the app is likely assigned to Users, not Devices.)

    For User-based assignments: GET {mobileAppId}/userStatuses

    The Best API for Automation (Device Install States)

     

    If you need to see exactly why an app failed or the state on a specific device, use the deviceAppInstallStates child resource. bu endpoint portal üzerindeki "Device Install Status" kısmına karşılık gelir:

     

    GET {deviceId}/deviceAppInstallStates

     

    Why this is better:

     

    v1.0 Support: More stable than beta endpoints.

    Detail: It returns the lastSyncDateTime and errorCode, allowing your automation to distinguish between "Pending" and "Failed".

    Answers to your specific questions:

    Is deviceStatuses unreliable? It is not unsupported, but it is heavily dependent on the assignment type. If you assign an app to a User Group, the deviceStatuses endpoint will often remain empty.

    Best Practice for Validation: Use the managedDevices/{id}/deviceAppInstallStates endpoint. Filter by the appId to get the most recent state reported by the Intune Management Extension (IME).

    Delays: Intune reporting is not real-time. There is usually a 20-60 minute delay between an installation and the Graph API update.

     

    Summary of Workflow for Automation:

     

    Query deviceManagement/managedDevices to get the deviceId.

    Query deviceManagement/managedDevices/{deviceId}/deviceAppInstallStates?$filter=appId eq '{mobileAppId}'.

    Validate the installState property (Look for 'installed').

     

    I hope this helps steer your automation in the right direction