Shadow AI: check desktop inventory freshness

Desktop application inventory can identify installed AI software, subject to device coverage, collection sources and freshness. Before using an empty report to close a shadow-AI investigation, verify which devices reported, which applications the collector recognises and when the records were last checked.

Microsoft Intune offers a useful example because its Discovered apps report and newer Windows App inventory operate in parallel with different requirements. This guide examines those differences and proposes a controlled reconciliation exercise. It reports no live tenant test and makes no claim that installation proves active AI use.

Identify the report before interpreting it

Microsoft's Discovered apps documentation describes inventory for enrolled devices. Collection varies by platform and ownership. Personally owned devices generally expose managed apps; company-owned devices have broader collection subject to the documented platform limits.

The usual refresh interval is seven days per device from enrolment. Win32 application information collected through the Intune Management Extension has a documented 24-hour interval. Collection follows each device's schedule; the whole tenant can have different refresh times.

Microsoft also warns that discovered-app totals can differ from installation-status counts because targeting, overlapping assignments and collection intervals differ. Keep the report name and count unit in your evidence. A device count, assignment count and application record count answer different operational questions.

Check the newer Windows inventory prerequisites

The separate App inventory documentation describes Windows 10 and 11 devices enrolled in Intune and Microsoft Entra joined. Collection requires an assigned configuration policy. Microsoft identifies it as the intended long-term replacement for Discovered apps while both remain available.

For active devices, collection runs multiple times per day through the documented check-in cycle. The first sync uploads a full inventory; later syncs send changes. A policy assignment and a fresh report remain separate facts, so record evidence of both.

The collector reads Win32 uninstall registry entries and Windows Store package information, including system and per-user sources. Ask how an application packaged outside those sources is represented. Browser-only services and embedded AI features need other evidence paths; the installation inventory cannot answer every discovery question.

Use identifiers and timestamps carefully

The newer report can provide version, publisher, install scope and selected optional properties such as installation location and platform-specific identifiers. Microsoft says field availability depends on the device's source data. Record missing values explicitly and seek the relevant source evidence.

Distinguish the record's Last updated value from Last checked, which describes when the device last reported inventory. An unchanged application can legitimately have an older update time alongside a recent check. Conversely, an old device check limits confidence in its current application state.

Per-user installation information also requires care. It can associate an installation with a user scope; it does not independently establish who submitted an AI request. Apply appropriate access and retention rules to inventory exports containing account or device identifiers.

Reconcile one authorised test device

Choose a dedicated enrolled Windows test device with the required join state and inventory policy. Use harmless, approved software and record its local installation state before interpreting the management report.

1. Establish the baseline. Record the local app identity, version and installation scope, plus the report's collection time.
2. Observe an authorised installation. Wait for the expected collection and processing interval, then match the reported record to the known app.
3. Observe an update. Check whether the version and record timestamp change without inflating the device count.
4. Observe removal. Uninstall only the disposable test software and verify the later report reflects its absence.
5. Test stale reporting. Use an agreed brief offline period and record how the reporting interface exposes the older check time.

These cases test inventory quality. Keep AI execution, account attribution, content inspection and policy enforcement as separate results. Our discovery coverage guide describes how to join those evidence types without overstating any one signal.

Account for policy removal and parallel reports

Microsoft documents a buffer of approximately three days after an App inventory policy is removed, during which collection continues before stopping and removing the data from the service. Factor that behaviour into retention and troubleshooting expectations.

If both inventory features are active, compare their sources and timestamps before escalating a discrepancy. The newer report's device-level values can differ from names and metadata entered for managed-app assignments. Preserve the original source identifiers so a normal naming difference does not become a fictional second product.

Turn an inventory finding into a decision

Classify each AI-related installation as recognised and approved, awaiting owner review, unsupported by the collector, or stale evidence requiring a new check. An approved application may contain features requiring separate review; an unfamiliar installation needs investigation before being labelled misuse.

Link each unresolved record to an owner and the next evidence source, such as authorised process or network telemetry. Keep browser extensions in their own inventory where required. This produces a useful desktop worklist while preserving the limits of the data behind it.

Map your shadow AI discovery paths with Promptective.