Skip to main content

Radar Tracking

Radar Tracking scans your Intune-managed devices to discover software that was installed manually — outside of Intune management — and brings it under automated patching.

How it works​

  1. Scan your tenant to inventory installed software across all managed devices
  2. Identify apps that aren't managed through Intune
  3. Create a Robopatch Flow for any discovered app
  4. Enable Radar Tracking on the flow to automatically target devices with outdated versions

Radar reads Intune's Discovered Apps data to identify which devices have which software installed. When a device has an outdated version, it is added to an Entra ID group that the Robopatch flow targets for deployment.

Tracking modes​

ModeHow it works
AutoRobopack creates the Radar group for you, in the tenant you choose
ManualYou specify the name of the Radar group yourself, and can use the variables in Group naming

The mode only decides how the Radar group is created and named. Scanning is the same in both modes: Radar refreshes every 24 hours from Intune's Discovered Apps data.

Refresh cycle​

Radar data refreshes every 24 hours based on Intune's Discovered Apps data. This is not real-time — there can be a delay between a device updating and Radar reflecting the change.

What Radar finds​

Radar discovers applications that users or other tools installed directly on devices, bypassing Intune. This gives you visibility into your actual software estate — not just what you've deployed.

note

Radar only works with Instant Apps from the Robopack catalogue. Custom-uploaded apps appear as "Found but not available for patching" and cannot use Radar Tracking.

Group naming​

Radar Tracking names the groups it creates from a naming template. The name should be dynamic, so that each application gets its own Entra ID group and each app's devices are tracked independently. Build a dynamic name from these variables:

VariableValue
%Name%Name of the deployment flow
%AppName%Name of the app, which can differ from the flow name if the flow has been renamed
%Publisher%App publisher name
%Language%Language of the app
%Platform%App platform, such as X64, X86 or ARM
%Scope%Installation scope: Machine or User
%Type%Type of assignment: Required, Available or Uninstall

In Manual mode you write the template yourself, using the same variables. The name can also be static: leave out the variables and Robopack uses the name exactly as you type it.

Deploying only to devices that already have an app​

A common use case for Radar is to patch only devices that already have an application installed, without deploying it to new devices. To do this:

  1. Create a Robopatch flow for the app
  2. Add a wave with at least one group (this can be an empty group or "all devices" set to Available)
  3. Enable Radar Tracking on the flow

Radar populates the group with devices that already have the software. The app installs for those who already have it, and is available (but not forced) for those who do not.

Scan from CSV​

You can also upload a CSV file containing app and publisher names. Robopack matches the entries against the Instant Apps library and lets you quickly set up patch flows for them — useful when onboarding a large number of apps at once.

Permissions and troubleshooting​

Radar requires the Robopack Enterprise App in Entra ID to have the correct permissions. If Radar assignments fail or groups are empty:

  1. Go to Settings > Tenants
  2. Click Reconnect using a Global Administrator account to refresh permissions
  3. Navigate to the Radar section and click Refresh Radar data

See Troubleshooting: Radar Tracking for more details.

Requirements​

  • Intune tenant connected with Admin Consent authorization
  • Device.Read.All permission — required, Radar scans return no results without it
  • DeviceManagementManagedDevices.Read.All permission — required, Radar scans return no results without it

Current limitations​

  • Radar does not automatically remove devices from groups after a successful update or OS wipe
  • Adobe Acrobat Radar is disabled due to shared product names between Reader and Pro
  • Firefox with multiple language versions can cause detection issues
  • Only Instant Apps are supported — custom apps cannot use Radar

See Known Limitations for the full list.