Intune detection rules explained

A detection rule tells Intune how to decide whether a Win32 app is already installed on a device. Get it wrong and the app either reinstalls in a loop or never applies at all.

What a detection rule does

When Intune evaluates a Win32 app on a device, it runs the detection rules. If the rules say the app is present, the app is considered installed. If they say it is absent, Intune installs it. Every rule in a multi-rule detection must match — the rules are joined with AND, not OR.

Rule types

MSI product code

The most reliable option for MSI-packaged apps. Intune checks the product code in the Windows Installer database at HKLM\SOFTWARE\Classes\Installer\Products. You can optionally compare the product version. The product code must be a GUID wrapped in braces, for example {B4D0BC02-5F96-4F7A-8B3E-6E3B7B4F1F2A}.

File or folder

Detects a file or folder by existence, absence, version, size or date. Use it for line-of-business apps that ship without an MSI, or as a requirement alongside an MSI rule. Paths should be absolute, and the tooling should account for 32-bit redirection when the app is 32-bit and the device is 64-bit.

Registry

Detects a registry key or value by existence, string, integer or version. The key path must start with a hive such as HKLM or HKCU. Leaving the value name empty detects the key itself.

PowerShell script

For anything the declarative rules can't express. Intune treats the app as installed only when the script exits with code 0 and writes a value to STDOUT. If anything is written to STDERR, the app is treated as not installed even when the exit code is 0.

Common mistakes

Using a bare GUID as an MSI product code. Intune expects braces.
Comparing versions as strings. Use the version operator so Intune performs a real version comparison.
Relying on %ProgramFiles% without 32-bit handling. On 64-bit devices a 32-bit process sees a redirected path.
Writing to STDERR from a detection script. This silently marks the app as not installed.
Overlapping rules across apps. Two apps detecting the same file cause confusing install states.

Build a rule

The Detection Rule Generator validates the values and produces Graph-ready JSON for MSI, file, registry and PowerShell rules.