Skip to main content

Radar Tracking

Radar Tracking scans your Intune-managed devices to discover software that was installed manually — outside of Intune management — and brings it under automated patching.

How it works​

  1. Scan your tenant to inventory installed software across all managed devices
  2. Identify apps that aren't managed through Intune
  3. Create a Robopatch Flow for any discovered app
  4. Enable Radar Tracking on the flow to automatically target devices with outdated versions

Radar reads Intune's Discovered Apps data to identify which devices have which software installed. When a device has an outdated version, it is added to an Entra ID group that the Robopatch flow targets for deployment.

Tracking modes​

ModeHow it works
AutoRobopack re-scans periodically and automatically targets devices running older versions
ManualYou trigger scans manually; Robopack populates groups with devices that have outdated versions. Use this mode to stop automatic notifications and actions

Refresh cycle​

Radar data refreshes every 24 hours based on Intune's Discovered Apps data. This is not real-time — there can be a delay between a device updating and Radar reflecting the change.

What Radar finds​

Radar discovers applications that users or other tools installed directly on devices, bypassing Intune. This gives you visibility into your actual software estate — not just what you've deployed.

note

Radar only works with Instant Apps from the Robopack catalogue. Custom-uploaded apps appear as "Found but not available for patching" and cannot use Radar Tracking.

Group naming​

When setting up Radar Tracking, the group naming must be dynamic — creating a separate Entra ID group for each application. This ensures each app's devices are tracked independently.

Deploying only to devices that already have an app​

A common use case for Radar is to patch only devices that already have an application installed, without deploying it to new devices. To do this:

  1. Create a Robopatch flow for the app
  2. Add a wave with at least one group (this can be an empty group or "all devices" set to Available)
  3. Enable Radar Tracking on the flow

Radar populates the group with devices that already have the software. The app installs for those who already have it, and is available (but not forced) for those who do not.

Scan from CSV​

You can also upload a CSV file containing app and publisher names. Robopack matches the entries against the Instant Apps library and lets you quickly set up patch flows for them — useful when onboarding a large number of apps at once.

Permissions and troubleshooting​

Radar requires the Robopack Enterprise App in Entra ID to have the correct permissions. If Radar assignments fail or groups are empty:

  1. Go to Settings > Tenants
  2. Click Reconnect using a Global Administrator account to refresh permissions
  3. Navigate to the Radar section and click Refresh Radar data

See Troubleshooting: Radar Tracking for more details.

Requirements​

  • Intune tenant connected with Admin Consent authorization
  • Device.Read.All permission (optional but recommended)
  • DeviceManagementManagedDevices.Read.All permission (optional but recommended)

Current limitations​

  • Radar does not automatically remove devices from groups after a successful update or OS wipe
  • Adobe Acrobat Radar is disabled due to shared product names between Reader and Pro
  • Firefox with multiple language versions can cause detection issues
  • Only Instant Apps are supported — custom apps cannot use Radar

See Known Limitations for the full list.