Detect Intune App Installation Anomalies with Azure AI

Update 06.09.2026: This is a historical Azure Anomaly Detector tutorial. Microsoft’s retirement notice states that the service retires on 1 October 2026. Do not start a new dependency on this service; review existing workloads and plan a supported replacement.

In this guide I will show you how to Detect Intune App Installation Anomalies with Azure AI. In one of my previous blog posts I explained how you can use Azure Automation and Azure Cognitive Services (now Azure AI Services) to monitor the compliance state of your environment and notify you if there are major deviations. In this part of the series I want to apply the same approach to application deployment, so you can Detect Intune App Installation Anomalies and get notified automatically if the installation of an application suddenly fails abnormally often. You can read more about the underlying service in the official Microsoft Learn documentation.

• Part 1 Device Compliance
• Part 2 Application Installations

How to Detect Intune App Installation Anomalies: getting the data

Each app in your portfolio in Intune provides detailed per-device reporting on the status of the installation. You can see whether the installation was successful or if it failed. This per-device data is exactly what we need to Detect Intune App Installation Anomalies, because it lets the model learn what a normal failure rate looks like.

To get this information we start a network trace in the Edge browser and refresh the view. In the trace we get the graph endpoint. The graph endpoint must be called with a POST request with a few parameters in the body to specify which data we want to receive.

This is all the information we need to Detect Intune App Installation Anomalies, so let’s get started.

Deployment of the Azure AI Services Anomaly Detector

• Open the Azure Portal and Search for Anomaly detectors

• Click + Create

• Select a Subscription and Resource group
• Select a Region and enter the Name of the Anomaly Detector
• Select the price tier (For testing Free F0 is sufficient)

• Click Create

Get Teams WebHook URL

• Create an MS Teams channel and add the webhook connector

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• Copy the WebHook URL

Create a App Registration

• Search for Microsoft Entra ID

• Select App registration

• Select +New registration

• Enter a Name and click Register

• Click API permissions and +Add a permission

• Select Microsoft Graph

• Select Application permissions

• Search for DeviceManagementApps.Read.All

• Click Grant admin consent for *** and approve with Yes

• Select Certificates & secrets and click +New client secret

• Enter a Description and select a Expires time
• Click Add

• Copy and save the Value and the Secret ID

Create Automation Account

• Search for Automation Accounts

• Click + Create

• Select a Subscription and a Resource group
• Enter an account name and select a Region
• Click Next

• Click Next

• Click Next -> Next -> Create

Create the Runbook

• Open the Automation Account
• Navigate to Variables and click + Add a variable

• Add the Secret Value, TenantId, AnomalyKey, WebHookUri and the App ID as Variable

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• Select Runbooks

• Click + Create a runbook

• Enter a Name
• Select PowerShell as Runbook type
• Select 5.1 as Runtime version
• Click Create

• Insert the Script from my Github repository
• Edit the variables $anomalyEndpoint (add here your endpoint from the Azure AI Services Anomaly Detector)

Hint: If you want to change the sensitivity of the anomaly detection you can adjust the attributes:
– maxAnomalyRatio: The maximum anomalies to be detected in terms of the ratio of total data points.
– sensitivity: Specify a lower value to ensure that fewer anomalies are accepted

• Save and test the script

• Click Publish

• Navigate to Schedules and click + Add a schedule

• Click Link to schedule and add the created schedule

Conclusion

I hope you enjoyed the second part of my series and that this setup helps you Detect Intune App Installation Anomalies and become aware of errors in your Intune environment earlier. Application deployment is a very central part of good device management, and to ensure user productivity it is important that it works reliably and error-free. Being able to Detect Intune App Installation Anomalies in near real time means that, as soon as there are problems with individual applications, this implementation sends notifications directly to a Teams channel.

Stay healthy, Cheers
Jannik