Registry inventory in Microsoft Intune: verify what’s on your devices
Intune now collects Windows registry data through the properties catalog so you can verify real device configuration without custom scripts. Learn the collection patterns, quick operational steps, and what MSPs should pilot first.
Registry inventory in Microsoft Intune
- Hook: Intune’s July service release (2607) adds Windows registry data to device inventory so admins can collect and query registry values from enrolled Windows devices.
What it is
-
Implemented through the existing properties catalog, a Device inventory property for registry keys lets you declare which keys and values Intune will collect.
-
Microsoft describes three collection patterns (single named value under a key, all values directly under a key, and the same value name across immediate child subkeys), with the portal exposing a Registry Key editor for path, collection pattern, and value name.
Why it matters for MSPs
-
Replaces many one-off scripts and Proactive Remediations used to harvest key values, reducing maintenance overhead across multiple tenants.
-
Makes registry-based baseline checks and drift detection operational at scale because collected data flows into Intune inventory and reporting.
Operational notes and limits to test
-
The initial rollout focuses on HKLM-style collection patterns, so validate which hives and paths your checks require before migrating scripts.
-
Test performance and privacy impact on a pilot group, and review which keys contain sensitive data before adding them to inventory.
Quick pilot checklist for MSPs
-
Inventory current scripts that read registry values.
-
Pick 5 high-value keys to collect (security, telemetry, app config) and create a properties-catalog policy in a pilot tenant.
-
Verify collected results in device inventory and build queries or reports for baselines.
-
Migrate stable checks from scripts to properties catalog and add to tenant baselines.
-
Practical takeaway: start small, pilot registry collection for a few critical keys, and use the results to turn brittle scripts into managed baseline checks. Which registry keys would you add to your baseline first?