PLATFORM

See what's installed, used and changed.

RealmJoin merges agent, Intune, registry and Store inventory into one software report, adds real run counts from your Windows devices if you switch usage metering on, and writes every admin action to an audit log in your own Log Analytics workspace.

Four inventory sources
Optional usage metering
30 audit categories
730 days retention by default

portal.realmjoin.com/organization/overview

Contoso GmbH, contoso.com

IntuneConnected
4,210Users5,380Devices
RealmJoinConnected
4,036Active users4,812Active devices
Runbooks, 7 days
1,284Completed12Failed

	When	App	Action
OK	2 min ago	Google Chrome	Main upgraded to 140.0.7339.128
OK	1 h ago	7-Zip	Preview created for 25.01
Planned	tonight	Zoom Workplace	Main upgrade in night window

Example data.

One report, four sources

The software report combines what the RealmJoin Agent installed, the Windows uninstall registry, Appx and MSIX packages, and Intune's detected apps, which also covers devices without the agent and non-Windows devices. A pattern catalog maps raw entries to catalog packages, so "Adobe Acrobat (64-bit)" and its registry key end up in one row.

Version spread with drill-down to devices and users
Filter by source, mapped or unmapped, compliant, enabled
Desired versus actual software per device
Store app names resolved from Microsoft Store metadata

portal.realmjoin.com/softwarereport/all

Filter softwareRealmJoinWindows programsAppxOther apps

Software	Versions	Devices	Users
Google Chrome	3	4,812	4,036
Zoom Workplace	4	3,400	3,010
Microsoft Teams	2	4,790	4,020
Contoso Timesheet	1	1,120	1,098
Notepad++	5	940	902

Example data. The bar shows the share of devices on the most common version.

Real usage, not just installs

Usage metering is optional: you decide whether it runs in your tenant. When it does, RealmJoin reads Windows' record of which programs run and how often on every check-in and matches each executable to a package, first by process name, then by file hash, then by install path, leaving out installers and Windows' own files. Every app gets installed and used counts, total runs and a last-used date.

Optional, switched on per tenant
Find installs unused for 30, 90 or 180 days
Reclaim licenses before the renewal, not after
Package usage export with a summary sheet

portal.realmjoin.com/softwarereport/microsoft-visio

Microsoft Visiomapped to generic-visio

Installed880
Used in 90 days212
Candidates668

Group	Installed	Used in 90 days	Candidates
Finance	320	41	279
Engineering	410	152	258
Sales	150	19	131

Example data.

Shadow IT, found

Software that nobody deployed still ends up on devices. RealmJoin lists every Windows title found in inventory that wasn't installed through RealmJoin, with device and user counts and a best-effort match to Intune apps, so you can package it, block it or ask why it's there.

Software	Devices	Users	In Intune as
Spotify	142	139	not found
WinRAR	88	85	not found
Notion	54	54	not found
Python 3.12	31	29	Python (Win32)
Wireshark	9	9	not found

Example data.

Telemetry that answers audit questions

Every agent check-in carries more than an app list: hardware and serial, BIOS version and password status, TPM and BitLocker, Defender onboarding and antivirus products, Microsoft 365 Apps channel, printers, Windows Update safeguard holds, whether the user signed in with Windows Hello, and whether the new Secure Boot certificate is in place.

Ready for the Windows UEFI CA 2023 certificate change
Safeguard holds with ID and description per device
Queryable per device through the Customer API

Secure Boot: Windows UEFI CA 20234,812 devices

Sign-in methodlast 30 days

BitLocker on OS driveWindows devices

Microsoft 365 Apps channelMonthly Enterprise, Current, Semi-Annual

Ready, Windows Hello, protected, preferred
Pending, password
Attention

Example data. Advanced telemetry comes with the Enterprise edition.

An audit log that lives with you

RealmJoin writes audit, operational and runbook logs into your Log Analytics workspace through the Logs Ingestion API. Query them with KQL, keep them as long as your policy says, feed them to Sentinel.

Tables RJAuditLogs_CL, RJOperationalLogs_CL and RJRunbookLogs_CL
Who did it, to what, the old and the new value, and the context
Retention set to 730 days when you connect the workspace
The same logs readable in the portal, with a configuration check

Shape of an audit entrysimplified

{  "Message": "Rotated BitLocker recovery keys",  "AuditSubject": { "Id": "8a1f…", "Name": "jonas.keller@contoso.com" },  "AuditTarget":  { "Id": "c42e…", "Name": "NB-MUC-0412" },  "AuditChange":  { "Property": "RecoveryKey", "OldValue": "5F1A…", "NewValue": "9B07…" },  "AuditContext": { … }}

30 audit categories

LAPSIntune managed LAPSBitLockerFileVaultUserGroupGroup managementDeviceIntune appRealmJoin appRealmJoin clientRunbookRunbook scheduleRunbook job scheduleRunbook syncRunbook customizationsRunbook permissionsTemplateAzure resource groupAzure Automation accountIntune device health scriptFavoritesOrganization wallpaperOrganization signature fileOrganization other fileSelf-service formsPartner CenterPortal permissionsAnyDeskSoftware package request

Take the data with you, or just ask

Six predefined Excel exports cover devices, packages, restrictions, antivirus, shadow IT and package usage. The Customer API returns device state and lists for your own tooling. And the built-in MCP server lets an AI assistant answer questions about your fleet with six read-only tools, behind tokens you can revoke.

Tools for device state, device search, software report, packages and tenant overview
Named tokens with expiry, revocation and last-used date
60 requests per minute per tenant

MCP server details

Illustrative conversation.