AppWorkload.log

Do you know what's in your AppWorkload log?

Your Win32 app policies. Every time the agent checks in for apps, it writes the full list it got from Intune into the log as one long line of JSON. AppWorkload Lens turns that line into something you can read, field by field.

In the log <![LOG[Get policies = [{"Id":"e707364c-…","Name":"7-Zip | Requirements | (EXE-x86 only) 26.01","Version":1,"Intent":3,"TargetType":2,"DetectionRule":"[{\"DetectionType\":3,\"DetectionText\":\"{\\\"EnforceSignatureCheck\\\":0,…
In AppWorkload Lens 7-Zip | Requirements | (EXE-x86 only) 26.01
Assignment
Required
Target
Device
Detection
Script
New to the log? Start with the blog post

AppWorkload.log and the Win32app Policies inside

When the agent checks in for apps, and how to pull the Win32 app policies out of the log by hand. The first post in a series on michaeltheadmin.com.

Read the post
Reference

Every policy field, explained. No log needed.

Look up any field: what it means, its values, and the source behind every line.

Browse the Reference

Drop AppWorkload logs here Drop to open

See every Win32 app policy in an AppWorkload*.log, decoded field by field, with the source behind each value.

Where to find it on a device
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
Older, rotated AppWorkload logs work too. Open several at once to compare snapshots.

Runs entirely in your browser. Nothing is uploaded.

01 · Snapshots Every “Get policies” check-in Each policy list in the log becomes a snapshot on a timeline, with what changed since the last one.
02 · Related apps Dependencies and supersedence, nested See which apps install, require, update or replace each other, right in the app list.
03 · Explained Click any field to learn it Raw value, meaning, and the source: Documented Observed Community Analyzed Undocumented How the sources work →
Who's behind it
Michael Escamilla

Built by Michael Escamilla

Customer Engineer at Patch My PC

An IT system administrator for over 10 years, focused on endpoint management with Configuration Manager and Microsoft Intune. He writes about it as Michael The Admin.

michaeltheadmin.com

Unofficial. Not affiliated with Microsoft. Sources: Microsoft Learn, lab logs, community research, and analysis of the decompiled agent.
Background: AppWorkload.log and the Win32app Policies inside on michaeltheadmin.com