I’ve recently being involved in discussions around Application Lifecycle Management (ALM) and various tooling solutions that can assist with ALM. Some of the tooling witnessed, addresses a problem that I’ve lived and breathed on many occasions. Undoubtedly, you’ve been there too…

You wake up and sign in to perform your daily checks, and find that a 0-day vulnerability has been published for an application your organisation uses. Fun times.

What’s your next action? Establishing which Windows devices have the affected version installed. Which seems like a simple question. But based on experience, an entire swat team is assembled, “six sources of truth” are referenced and a sizeable spreadsheet is born for tackling the incident. Chaos and panic ensues.

Before you can plan any remediation, you need a definitive answer that you can trust.

Microsoft is planning to extend Intune device query for multiple devices to Windows application inventory. That would put Kusto Query Language (KQL) to work across collected software inventory, helping administrators investigate application versions without opening device records individually.

What Microsoft has announced

I say announced. There’s no release date or further details on this functionality. I just stumbled across the updated Intune development notes which outlines an extension to Advanced Analytics, in that application inventory capabilities will be extended on Windows. Microsoft calls out compliance reviews, vulnerability triage, and license-tracking as potentially beneficial scenarios. I’ve therefore done 2+2 and equalled 7, likening this enhanced functionality to the functionality and features I’ve seen across ALM tools I’ve been playing with recently and linking the potential benefits with issues I’ve lived and breathed.

Benefitting the Support teams

Based on my outlined experience, for a support team, the prospect of asking Intune a focused software question across the fleet is useful. The resulting information could quickly become your single source of truth. No more hashing multiple datasets together. Allowing you to ask the all important question; “where is the version we need to replace?” rather than another dashboard or dataset listing out unexplained installation counts.

All that said, it remains to be seen if the feature produces a dependable list of devices to investigate, patch or review. KQL can make the question precise, but inventory coverage and validation determine how much confidence we should place in the answer.