Intune Can Finally See What's Actually Sitting in the Registry

Microsoft's new Device Inventory feature reads registry values straight off managed Windows devices — no scripts, no CMPivot queries. Here's how it works, its hard limits, and how to use it for real drift and compliance checks.

Intune · Device Inventory · Modern Endpoint Guides

🗂️ Intune · Device Inventory

Intune Can Finally See What's Actually Sitting in the Registry

For years, verifying a registry value on a managed Windows device meant writing a Proactive Remediation script, running a remote session, or trusting that a policy applied the way it was supposed to. Intune's July 2026 release adds native Registry Inventory — HKLM visibility per device, built straight into the properties catalog. This guide covers what it collects, the hard limits that will bite you if you ignore them, and how to configure it for real drift and compliance checks.

📅 Updated: July 2026 ⏱️ Implementation: 15-30 min setup 🎯 Audience: Intune Admins, Endpoint Engineers, Security Architects

⚡ Why This Matters

Every Intune admin has hit the same wall: you push a configuration profile, Intune reports it as applied, and the registry key still isn't there. Or it's there, with a value nobody expected. The compliance dashboard shows green. The device tells a different story.

The gap this closes: "assigned" and "applied" are not the same claim, and until now Intune had no native way to verify the second one at the registry level. Every team either built its own tooling or lived with the blind spot.

Closing that gap used to mean building your own tooling — a Proactive Remediation script that reads a key and reports back, a CMPivot query for a live snapshot, or a support call that ends with someone connecting to the device directly. All three work. None of them scale past a handful of devices, and none of them leave you with a standing, queryable record of what's configured.

Registry Inventory, introduced in Intune's 2607 (July 2026) release, replaces that ad hoc tooling with a native properties catalog entry. Define the registry paths once, deploy the profile, and Intune reports back the actual value it found on each device — real evidence, independent of whatever the policy engine already assumes.

🗂️ What It Actually Does

Licensing & Scope

Included with Microsoft Intune Plan 1 — no add-on required. Windows devices only. Configured through the same properties catalog you already use for other Device Inventory settings, so there's no new console to learn.

Data Returned

For every collected entry, Intune reports the registry key path, value name, value type, and value data — the same output you'd get from a manual reg query, without touching the device.

🎯 Three Collection Patterns

The properties catalog gives you three ways to shape a collection, and picking the right one keeps you well inside the 100-key ceiling covered below.

Single Value

Point at one path and one value name, get one answer. Example: HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot — confirm Secure Boot state on every targeted device without a script.

All Values, One Path

Collect every direct value under a path, with no subkey recursion. Useful for pulling an application or driver's full configuration block in a single pass.

Same Value, Many Subkeys

Specify a base path and a value name, and Intune checks that value under every immediate subkey. Example: DHCP status across every interface under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces — one profile, every NIC.

⚠️ Hard Limits You Need to Know

Limit	What It Means in Practice
HKLM only	No HKCU, HKCR, or per-user visibility. This is a machine-state tool, not a user-state one.
6 KB per value	This verifies configuration, not extracts data — large binary blobs won't fit.
100 keys per device	A shared ceiling across every Registry Inventory profile targeting that device — budget it deliberately.
Missing path/value	Reports "Not found" and doesn't block results from other devices in the same profile.
Empty value	Reports as empty — distinct from "Not found," so you can tell "not configured" from "configured but blank."

Plan the key list before you deploy. One overly broad monitoring profile — every value under a driver's full configuration tree, for instance — can burn through the 100-key ceiling by itself, leaving no room for the compliance and security checks you actually need.

🔒 Built-In Secret Scrubbing

Registry Inventory ships with heuristic detection that identifies values resembling secrets, credentials, authentication tokens, certificates, private keys, or connection strings, and blocks their ingestion at the source.

Why this matters for governance: you can point Registry Inventory at broad configuration trees without personally auditing every value for something that shouldn't leave the device. The heuristic does that filtering for you, before the data ever reaches the cloud service.

The trade-off is worth knowing: a legitimate value that happens to look secret-shaped — a long opaque string, for example — might get silently excluded. If an expected value never shows up in your results, check whether the heuristic filtered it before assuming a deployment or policy problem.

🛠️ Configuring a Registry Inventory Profile

Open Device Inventory profile creation

In the Intune admin center, start a new Device Inventory collection profile the same way you'd build any properties-catalog profile.

Select Registry in the properties picker

Registry appears as its own category alongside the existing inventory properties — no separate workflow to learn.

Specify the paths you care about

Enter the registry key paths, and, depending on the pattern you choose, the specific value names to collect.

Choose a collection pattern

Single value, all values under a path, or the same value across subkeys — pick based on what you're actually verifying, not the broadest option available.

Assign and deploy

Target the profile at the device groups you need visibility into, exactly as you would with any other Intune profile.

📊 Where the Data Shows Up

Today, results land in the Device Inventory view, per device. Open an individual machine and you'll see every registry value that profile collected for it.

Set expectations accordingly: Microsoft has said reporting and cross-device exploration are planned for future releases, but that tooling isn't live yet. Until it ships, this is a per-device verification tool — you're still the one aggregating results if you need a fleet-wide view.

💡 What It's Good For

Configuration Drift

Confirm the registry state a device actually has matches what the assigned policy claims. That gap — between "reported compliant" and "actually configured" — is exactly what this closes.

Security Posture Spot-Checks

Verify security-relevant keys — Secure Boot state, a Defender setting, a hardening baseline value — are genuinely present on the device, not just assigned in the console.

Targeted Troubleshooting

When one device behaves differently from the rest of its group, pull its registry values directly instead of guessing from the compliance dashboard.

App & Version Confirmation

Confirm an application's installed version or a configuration key without deploying a detection script just to check.

✅ Checklist

Confirm Intune Plan 1 licensing covers your target tenant
List the specific registry paths and values you actually need — don't default to the broadest collection option
Pick the right pattern per path: single value, non-recursive all-values, or same-value-across-subkeys
Budget against the 100-key-per-device ceiling before deploying multiple profiles
Remember HKLM only — don't expect per-user (HKCU) visibility
Watch for values silently excluded by the secret-detection heuristic
Treat results as per-device today — no native fleet-wide reporting yet