How to find app install failures in Microsoft Intune

Before you start

Use an account that can read Intune apps and reports, such as one with the Read Only Operator role. The tenant needs an active Intune licence. The PowerShell example asks Intune to export a report, which only Microsoft's ReadWrite permissions can start, so the script requests DeviceManagementApps.ReadWrite.All, the one for apps, even though it only reads. Your organisation may require administrator consent.

Know what the figures leave out. Microsoft says Android line-of-business apps made available with or without enrolment report install status for enrolled devices only. The examples read and export; they change no app, assignment or device.

Option 1

Find app install failures with PowerShell

Install the module once, then connect, export the report and keep the apps with failed installs.

# Install once, if the module is not already installed.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementApps.ReadWrite.All' -NoWelcome
try {
    $jobs = 'https://graph.microsoft.com/v1.0/deviceManagement/reports/exportJobs'
    $body = @{
        reportName       = 'AppInstallStatusAggregate'
        format           = 'csv'
        localizationType = 'replaceLocalizableValues'
        select           = @('DisplayName', 'Publisher', 'Platform', 'AppVersion',
            'InstalledDeviceCount', 'FailedDeviceCount', 'FailedDevicePercentage',
            'PendingInstallDeviceCount', 'NotApplicableDeviceCount', 'ApplicationId')
    } | ConvertTo-Json
    $start = @{ Method = 'POST'; Uri = $jobs; Body = $body; ContentType = 'application/json' }
    $job = Invoke-MgGraphRequest @start
    while ($job.status -in 'notStarted', 'inProgress') {
        Start-Sleep -Seconds 5
        $job = Invoke-MgGraphRequest -Method GET -Uri "$jobs/$($job.id)"
    }
    if ($job.status -ne 'completed') { throw "The export ended as $($job.status)." }
    Invoke-WebRequest -Uri $job.url -OutFile './app-status.zip'
    Expand-Archive -Path './app-status.zip' -DestinationPath './app-status' -Force
    $rows = Get-ChildItem -Path './app-status' -Filter '*.csv' | Import-Csv
    $report = @($rows | Where-Object { [int]$_.FailedDeviceCount -gt 0 } |
        Sort-Object { [int]$_.FailedDeviceCount } -Descending)
    if ($report.Count -eq 0) {
        Write-Output 'No app reports a failed device install.'
    } else {
        $report | Export-Csv -Path './app-install-failures.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) apps have at least 1 failed device install."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The report is the one behind the app install status page in the admin centre: 1 row per app, with how many devices installed it, failed, are pending or don't apply, and the failed share as a percentage. Intune gives the export as a compressed CSV, which the script unpacks into ./app-status. For each device's result for 1 app, the DeviceInstallStatusByApp report takes the same request with a filter on the app's ID, such as (ApplicationId eq '<app ID>'), and gives each device's install state, error code and last change.

Option 2

Review app install failures in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Apps > Monitor > App install status to see which of the apps you've assigned have failed installs.
3. Go to Apps > All apps and select an app with failures.
4. On the app's overview, read the device status graph for the number of devices Installed, Failed and Install Pending.
5. Under Monitor, select Device install status and read Status and Status details for each device. Leave the page without changing anything.

This suits looking into 1 app. To compare one month with the next, keep an export with PowerShell or a report.

Common questions

What if my organisation won't grant the ReadWrite permission?

Use the admin centre or Altivane. The script needs it only to start the export.

Why is a device missing from an app's status?

Microsoft says Android line-of-business apps made available with or without enrolment only report install status for enrolled devices, so unenrolled devices don't appear. A device the app doesn't apply to is counted as not applicable, not as failed.

Why do some devices stay at pending?

Pending means the install is still in progress or the device hasn't reported back. A device that hasn't checked in with Intune for a while stays there; to find those, see how to find stale devices in Microsoft Intune.