Detection Rule Generator

How it works

Choose the detection method you need, fill in the values, and the tool validates them before producing JSON that matches the Microsoft Graph win32LobApp schema. MSI and PowerShell detections are emitted for the detectionRules property; file and registry detections are emitted as entries for the rules array.

Nothing you type leaves your browser. The page has no server-side processing for the tool itself, and it works after the initial page load even if your network drops.

Supported scenarios

• MSI — detect by product code, optionally comparing the product version.
• File or folder — existence, absence, version, size and date checks, with 32-bit expansion.
• Registry — key or value existence, string, integer and version comparisons.
• PowerShell script — base64-encoded script content with optional signature and 32-bit flags.

Example

An MSI detection for Contoso Agent 1.2.3 or later:

{
  "@odata.type": "#microsoft.graph.win32LobAppProductCodeDetection",
  "productCode": "{B4D0BC02-5F96-4F7A-8B3E-6E3B7B4F1F2A}",
  "productVersionOperator": "greaterThanOrEqual",
  "productVersion": "1.2.3"
}

Output

The generated JSON can be assigned to the detectionRules or rules property of a Win32 app when you create or update it through the Microsoft Graph API, an Intune workload tool, or your own automation.

Common problems

• Product codes must be a GUID wrapped in braces; a bare GUID is rejected by Intune.
• Version comparisons need a dotted numeric version, for example 1.2.3.0.
• For PowerShell detection, the app is only detected when the script exits 0 and writes to STDOUT.
• Existence checks don't accept a comparison operator; the tool clears it for you.

Related

Guide: Intune detection rules · Guide: Win32 apps · All tools