Registry Inventory in Microsoft Intune: Verifying What’s on Your Devices
By: Madison Cooks, Product Manager | Microsoft Intune IT admins need a reliable way to confirm how Windows devices are configured, especially when troubleshooting, validating compliance, or investigating security posture. Policy assignment alone doesn’t always show what’s present on the device and getting registry visibility at scale has often required custom discovery or remediation scripts that take time to build, test, and maintain. With Microsoft Intune’s July (2607) release, device inventory will include Windows registry data, helping IT admins verify a device’s actual configuration, not just the policy assigned. With a new Device inventory property for registry keys, you define the keys you care about in the properties catalog, and Intune collects them for you. There’s no collection logic to build or keep running. This makes registry-based configuration checks easier to operationalize across managed Windows devices, so teams can spend less time maintaining scripts and more time acting on the data. Figure 1: Microsoft Intune device inventory profile creation screen showing the Properties picker with the Registry category selected for inventory data collection. What registry data you collect Registry data collection is configured through the existing properties catalog. For each entry, provide a registry key path and, when needed, a value name. For every targeted device, the device agent attempts collection and reports: Registry key path Value name Value type Value data Microsoft Intune device inventory profile configuration page showing registry key collection settings, including registry path, collection pattern options, and value name fields. The initial release supports the following collection patterns designed for common admin scenarios that use HKEY_LOCAL_MACHINE (HKLM) paths. Single value Specify a registry path and value name to collect one value from that path. For example, collect Secure Boot certificate servicing status from HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot by using values such as UEFICA2023Status, UEFICA2023Error, or UEFICA2023ErrorEvent. All values under a path, non-recursive Specify a registry path to collect all values directly under that path. This pattern doesn't include subkeys. For example, collect values directly under a Windows Update configuration path to help validate expected settings. Same value across subkeys Specify a base registry key path and a value name to collect that value from each immediate subkey. For example, collect DHCP status across network interface subkeys under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces. Where registry inventory data appears After collection, registry inventory data will be available in Device inventory at initial release. We’ll expand access to registry data in the coming months, including support in additional reporting and exploration experiences. Microsoft Intune Device Inventory page displaying collected Windows registry data for a device, including registry key paths, values, collection status, and timestamps. This makes registry data available alongside other inventory signals, so admins can use familiar tools to investigate configuration, validate device state, and support troubleshooting without building separate collection scripts. How admins use this You can collect registry data and view it per device in Device inventory - a verified record of each endpoint’s actual configuration and a key source of settings data on each endpoint. This helps answer questions like: Is a setting actually enabled on the device? Which app, version, or configuration is installed? Did a policy apply correctly? Why is this device behaving differently from the rest? Registry data collection in Device inventory is included with Microsoft Intune Plan 1. Collection results and limits If a registry value exists but doesn’t contain data, collection succeeds and the value appears as empty. If the registry path or value name doesn’t exist on a device, that device reports Not found for the collection result. Collection continues for all other devices, so one missing value won’t block results from devices where the value exists. Registry inventory includes safeguards to keep collection focused and manageable. Each collected registry value is capped at 6 KB, and each device can collect up to 100 registry keys. If a value or device exceeds these limits, collection skips the excess data and reports the applicable result for that device. These limits help manage data volume, maintain service performance, and reduce the risk of over-collection. Registry inventory is designed for configuration visibility and troubleshooting, not for collecting sensitive or confidential data. Built-in heuristic detection helps identify and prevent ingestion of values that may contain secrets, credentials, authentication tokens, certificates, private keys, connection strings, or other data that could grant access if exposed. If a value is flagged as potentially sensitive, it isn’t collected. Collection is limited to HKEY_LOCAL_MACHINE (HKLM) paths. This keeps inventory focused on device-level configuration and avoids user-specific registry contexts. Summary Registry inventory in Microsoft Intune helps admins collect Windows registry data in a native, declarative way. Instead of maintaining custom scripts for common inventory scenarios, admins can configure registry collection in the properties catalog and query the results through familiar Intune reporting experiences. Use registry inventory for configuration visibility and troubleshooting across managed Windows devices. As you plan your collection strategy, focus on device-level HKLM data, avoid sensitive values, and remember collection limits to keep inventory targeted and manageable. If you have any feedback or questions, leave a comment below or reach out to us on X @IntuneSuppTeam.
Recent Bug or issue i got for last 3 days when i am using Chat sessions.
Recent Bug or issue i got for last 3 days when i am using Chat sessions after creating New Projects and saving outside chats there. But in New chats when i opened and used attachment to it from Notta Memo it is clearly working its taking transcript and giving Summary and details i asked. Please help if any one faced same issue and you guys got any resolution in fixing this issue. Thanks in advance.
Problem that copilot is unable to see all my emails in outlook
Copilot returns incomplete http://outlook.com/ email search results while Outlook Desktop and Outlook Web return complete results Product Microsoft Copilot (Windows App) Microsoft Copilot (Web) http://outlook.com/ Outlook Desktop Outlook on the Web Issue Summary Copilot is returning incomplete email search results from my http://outlook.com/ mailbox. The same mailbox searched directly in Outlook Desktop and Outlook on the Web returns complete and accurate results, but Copilot only returns a subset of the matching emails. The issue occurs in both the Copilot Windows application and Copilot on the web, suggesting the problem is not device-specific. Environment Microsoft Account Personal Microsoft account http://outlook.com/ mailbox Microsoft 365 Personal trial currently active Devices Windows laptop Completely rebuilt from scratch to troubleshoot this issue Internal storage wiped Fresh Windows installation performed All current Windows updates installed All current Microsoft 365 / Office updates installed Applications Tested Outlook Desktop (latest version) Outlook on the Web Microsoft Copilot for Windows Microsoft Copilot on the Web Account Status Same Microsoft account used for Outlook and Copilot Mailbox accessible and functioning normally Mail synchronization appears healthy Outlook search functioning correctly Problem Description On Monday 3 August 2026, my Inbox contained 12 messages. Examples included: Tesco http://amazon.co.uk/ eBay Yahoo Microsoft Account Team Microsoft 365 When I asked Copilot to list emails received on 3 August 2026, Copilot returned only a subset of those emails. Copilot was able to locate: Tesco order confirmation Tesco order amendment Microsoft 365 trial activation Microsoft account password change However, Copilot did not return several emails that were visibly present in the Inbox, including Amazon, eBay, Yahoo and other Microsoft account notifications. Expected Result Copilot should return all emails matching the requested date range, consistent with Outlook Desktop Search and Outlook Web Search. Actual Result Copilot returns only a partial subset of the matching emails despite the emails being clearly present in the mailbox. Diagnostic Testing Performed Outlook Desktop Search Result: ✅ Returns all expected emails. Outlook Web Search Result: ✅ Returns all expected emails. Copilot for Windows Result: ❌ Returns only a subset of emails. Copilot Web Result: ❌ Returns the same subset of emails. Operating System Result: ✅ Fresh Windows installation completed. Office Installation Result: ✅ Fully updated. Mailbox Access Result: ✅ Mailbox functioning normally. Why I Believe This Is a Copilot Search Service Issue The issue reproduces: Across multiple Copilot clients On a freshly rebuilt device While Outlook Desktop Search works correctly While Outlook Web Search works correctly Since both Outlook clients return complete results and both Copilot clients return incomplete results, the evidence suggests a discrepancy in the mailbox search/indexing layer used by Copilot rather than a problem with Windows, Office, Outlook indexing, or the local device. Request Please investigate: Whether Copilot is using a different mailbox index from Outlook Search. Whether my mailbox has been only partially ingested into the Copilot search service. Whether there are known issues affecting http://outlook.com/ personal accounts and Copilot email retrieval. Whether Microsoft can trigger a reindex, resynchronization, or repair of the mailbox content used by Copilot. Whether there are any diagnostic tools available to compare Outlook Search results versus Copilot Search results. Evidence Available I can provide: Screenshots showing 12 emails present in Outlook Inbox on 3 August 2026. Screenshots of Outlook Desktop search results. Screenshots of Outlook Web search results. Screenshots showing Copilot returning only a subset of those emails.
Copilot in OneNote cannot access content in sidebar (Microsoft 365 Premium)
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hello everyone, I'm hoping someone from the OneNote or Copilot team can help with an issue that has prevented me from using Copilot in OneNote for approximately two months despite having an active Microsoft 365 Premium subscription. Issue Copilot can detect that a OneNote page is open, but it cannot access or read the contents of the page. For example, if I open a page named 1Cor4:1-16.onepart or create a brand-new test page, Copilot acknowledges that the page exists but responds with something similar to: "I can see that the file is open, but I cannot access the note contents." As a result, Copilot cannot summarize, analyze, answer questions about, or otherwise interact with the contents of the current page. Environment Microsoft 365 Premium (Personal Subscription) OneNote for Microsoft 365 Version 2608 Build 16.0.20326.20100 (64-bit) Windows Desktop Notebooks stored in and synced through OneDrive Troubleshooting Completed I have already performed extensive troubleshooting, including: Verifying my Microsoft 365 Premium subscription is active Verifying I am signed into the correct Microsoft account Signing out and back into Office and OneNote Confirming notebooks are syncing properly Updating Office and OneNote to the latest version Restarting OneNote and Windows multiple times Creating brand-new notebooks and test pages Testing across multiple days and sessions The issue is fully reproducible on both existing notebooks and newly created notebooks. Microsoft Support Findings I have already worked directly with Microsoft Support. A support technician remotely connected to my computer and reviewed my configuration. They confirmed that Copilot in OneNote should be functioning in my environment. During the support session they performed multiple troubleshooting and repair actions, including uninstalling and reinstalling components, repairing Office, and verifying account and licensing status. Despite all of this, the problem remained unchanged. The technician indicated that the issue appears to be on the Copilot/OneNote side rather than being caused by my local setup. Since they were unable to resolve it, they recommended that I post here in the Microsoft Tech Community to seek further escalation and visibility. Questions Has anyone else experienced an issue where Copilot can see the currently open OneNote page but cannot access the page contents? Is there a known service-side, provisioning, or feature-rollout issue that could cause this behavior? Is there a way to escalate this directly to the OneNote or Copilot engineering teams? At this point, I've been paying for the feature for roughly two months and have not been able to use the core OneNote Copilot functionality at all. Any assistance or guidance would be greatly appreciated. Thank you.
Copilot Notebook features missing
I think it was back in March or April that improved features for Notebooks in Copilot were added as General Availability: the Audio overview, Mind Map and others. I have Copilot Premium, can and have created a notebook, but those features are greyed out for me. I'm pretty sure I have enough content (3 files with approximately 500 pages of content) in the Notebook but when I click those buttons, I see a message: More in OneNote Power BI Notebook isn't available here yet, but coming soon. For now, you can open it in OneNote. Those features are in OneNote, but not in Copilot. What's wrong, and what can I do to get them working in Copilot Notebooks? Thank you for your answerCreated agents are shown twice in "Shared with you"
Hi all I've noticed for myself, and for several of our users, that when agents are created in Copilot Studio, and shared. Each agent is shown twice, when people access their "Shared with you" in Copilot. Why is that, and does anybody else experience this?Unable to generate M365 Copilot audit events 284 and 373 – Record Types 328/383/384 also unavailable
Hello, I am testing Microsoft 365 Copilot audit logging and need some clarification regarding several Copilot/AI audit Record Types. Environment: Microsoft 365 Business Premium Microsoft 365 Copilot license Unified Audit Log ingestion enabled: UnifiedAuditLogIngestionEnabled = True Microsoft Purview Audit is enabled We can successfully see Copilot audit events for Record Type 261 and 310–314 However, we are unable to generate/locate the following events: Record Type 284 – AIAppInteraction We performed AI application-related activities but cannot find the expected audit records. Record Type 373 – OutlookCopilotAutomation We created and executed a Copilot Workflow using Outlook and M365 Copilot. The workflow successfully processed emails and generated responses, but the corresponding 373 audit event is not visible in Purview Audit. We also noticed that the following Record Types are not available in Purview Audit Search → Record Type filter: 328 – ConnectedAIAppInteraction 383 – CopilotForSecurityTrigger 384 – CopilotAgentManagement According to Microsoft's documentation, these Record Types exist in the Office 365 Management Activity API schema. I would appreciate help with the following: What exact activity generates Record Type 284 (AIAppInteraction)? What exact Outlook/Copilot activity generates Record Type 373 (OutlookCopilotAutomation)? Is 373 supported with Microsoft 365 Business Premium + Microsoft 365 Copilot? Why are 328, 383 and 384 not available in the Purview Audit Search Record Type filter? Are these events generated only for specific Copilot/AI products, licenses, or scenarios? Is there a specific configuration or API query required to retrieve them? If anyone has successfully generated these events, could you please share the exact test activity/workflow used? We have already confirmed that audit ingestion is enabled and that other Copilot events (261 and 310–314) are being generated successfully. Any guidance or a known-good test procedure would be greatly appreciated. Thanks!
