Detection Rule Linter
Browser-onlyReview existing Win32 detection rules before they cause a deployment failure. Paste rules from Intune, a Graph response, or your own automation and get a ranked list of problems.
rules array from a win32LobApp, a single rule, or older
detectionRules JSON. Base64 script content is decoded automatically.
How it works
The linter parses the JSON into the same model used by the Detection Rule Generator, then applies a set of checks drawn from how Intune actually evaluates detection rules on a device.
Paste any of these shapes and it will work out the rest: a full win32LobApp
object, an object with a rules array, a single rule, or older
detectionRules JSON. Base64 PowerShell content is decoded automatically.
Nothing leaves your browser.
What it checks
- Upgrade-blocking detection. Existence-only rules can't tell versions apart, so older builds are treated as compliant and never upgraded.
- 32-bit redirection. When 32-bit handling is on,
%ProgramFiles%becomesProgram Files (x86), and registry reads go throughWow6432Node. - Version comparison choices. Exact matches can cause a newer build to be reinstalled;
greaterThanOrEqualis usually safer. - User-scoped paths. Detection and install usually run as SYSTEM, which doesn't see other users' profiles.
- PowerShell output streams. Writing to STDERR marks the app as not installed even when the exit code is 0.
- Requirement rules used as detection. Requirement rules gate installation; they do not detect an installed app.
- Structural problems. Invalid product codes, missing values, and unsupported rule types.
Supported scenarios
- Reviewing rules pasted from the Intune admin center or a Graph response.
- Auditing a win32LobApp before you migrate or re-create it.
- Checking generated rules before you apply them to a production app.
Output
Findings are graded Error, Warning or Note. Errors mean the rule is invalid or will not behave as intended. Warnings are the problems seen most often in real deployments. Notes explain detection behaviour worth confirming for your environment.
Common problems
- If the JSON can't be read, check it begins with
{and contains either arulesarray or an@odata.type. - Rule numbers in the output match the order in the pasted JSON, starting at 1.
- The linter is advisory. It flags patterns that commonly go wrong, not every possible misconfiguration.
Related
Detection Rule Generator · Guide: Intune detection rules · All tools