Part of:Key features of the Intune Management Extension
Using the Intune Management Extension for PowerShell scripts
Intune and PowerShell have a lot of unique management actions they can take, but with the help of the Intune Management Extension, they can communicate and manage more efficiently.
With the help of the Microsoft Intune Management Extension (IME), IT teams can extend basic Intune management capabilities to deliver advanced app deployments, PowerShell script execution and other customizations for Windows devices.
The IME is an extension that adds more functionality for Windows device management. It extends the existing management capabilities that are available within Windows, primarily providing more app installation capabilities and customization options -- the latter by providing support for PowerShell scripts -- through Microsoft Intune.
There are also capabilities for app inventory and basically any PowerShell script that's used within Intune. This includes the remediation functionality of proactive remediations and the detection functionality of Win32 apps.
Prerequisites for using the Intune Management Extension
The IME is installed on nearly all managed devices. However, it's good to be familiar with the prerequisites that must be in place on the Windows device:
The device must be running Windows 10 version 1607 or later. And, for devices enrolled with bulk enrollment, it must be Windows 10 version 1709 or later. This includes any version of Windows 11 as well.
IT can use the IME in combination with co-management. In these scenarios, it's important that the Apps workload is set to Pilot Intune or Intune.
How does the Intune Management Extension work?
From a technical perspective, the IME is installed automatically as a Windows service. That service has the display name Microsoft Intune Management Extension and the service name IntuneManagementExtension. The service starts automatically with a delayed start, and IT can manage it like any other Windows service.
The installation location of the IME service is C:\Program Files (x86)\Microsoft Intune Management Extension. This location contains all the required source files for the service, including configuration files. The executable used for the service, Microsoft.Management.Services.IntuneWindowsAgent.exe, is also available in that location.
There are also pieces of data and configuration stored in the registry of the Windows device, which can be found at HKLM\SOFTWARE\Microsoft\IntuneManagementExtension. This location includes information around the configuration of the IME, collected inventories and status reports for any action performed by the IME.
Once the service is up and running, it performs a standard synchronization with Intune to see if new policies are available. The policies can include anything that requires the IME, including PowerShell scripts and Win32 app deployments. The default configuration for this synchronization is once every 60 minutes.
To make sure that the IME is healthy and can perform its activities, there's a scheduled task configured on the device. The task is located in the Task Scheduler Library at Microsoft > Intune and runs the ClientHealthEval.exe that is available within the installation directory. When the task is running, it verifies some basic configurations around the IME to verify its health. This includes all sorts of checks around the status of the service, including its availability, startup type, memory usage and more.
Windows logs essentially every action of the IME and related services in different log files. There used to be just a few log files that contained all the information. With the introduction of more and more functionalities, however, the information is now stored across many more log files. These log files are available at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
What functionality does the Intune Management Extension provide?
Microsoft introduced the IME to provide some basic functionalities for running PowerShell scripts. But, luckily for IT administrators, Microsoft expanded those functionalities quickly. Today, the IME contains the following functionalities:
PowerShell scripts. The IME enables basically any form of running PowerShell scripts on managed devices. This includes the PowerShell scripts that are used in proactive remediations and custom device compliance policies, the PowerShell script functionality itself and even PowerShell scripts that are used within the detection methods of Win32 apps. With that, the IME provides the IT admin with greater flexibility, customization and management capabilities on the managed devices.
App deployments. The IME also enables the capabilities for installing more advanced app types through Intune. This includes the following important application types for Windows devices:
Win32 apps. This application type includes installation files of an app -- or anything else that an admin likes to bring to the devices -- that are wrapped by the Microsoft Win32 Content Prep Tool into the .intunewin file format. The IME contains the technology to bring that file to the device, extract the files and perform the configured actions.
Microsoft Store apps. This application type includes intelligence similar to WinGet, directly integrated into Microsoft Intune. This enables the admin to install apps that are available in the Microsoft Store. The IME can bring these installation capabilities to the device and provide support for the installation of Microsoft Store apps. This app type no longer requires the Microsoft Store for Business, which has been retired.
App inventories. When the IME is installed on a managed device, it also provides an add-on to the application inventory. Then, the IME performs the inventory of the Win32 apps that are installed on the device. The inventory includes all the apps that are installed through Microsoft Software Installer (MSI) and provides information about the installation date, name and version number. It also includes MSI apps that are not installed through Intune. The inventory has a refresh cycle of every 24 hours after device enrollment.
How to use the Intune Management Extension
IT admins don't have to perform a specific additional action to install the IME.
IT admins don't have to perform a specific additional action to install the IME. That's because the extension is automatically installed when assigning one of the functionalities that rely on it. So, when a PowerShell script, remediation, Win32 app, Microsoft Store app or custom compliance policy is assigned to the user or the Windows device, the IME is automatically installed on that device.
This makes it a device-specific installation and also means that the IME is not available on every Windows device by default. The additional inventory of Win32 apps is only available for Windows devices that have one of those assignments. Without one of them, that endpoint's inventory is not available.
What to know before using the Intune Management Extension
When using the IME, the following items are good to know before starting with PowerShell scripts and Win32 apps:
Never forget the power of PowerShell scripts when running in system context or in user context when the user has administrator permissions.
Never include sensitive information in PowerShell scripts, as the scripts are available locally on the device.
PowerShell scripts are executed before the installation of Win32 apps.
PowerShell scripts have a default timeout of 30 minutes, and the default timeout for Win32 apps is 60 minutes. The latter is now configurable.
Support for Entra ID-registered devices is limited.
These best practices are applicable to all functionalities of the IME, but they're most relevant to PowerShell scripts and Win32 apps, as those functionalities are used the most often.
Editor's note:This article was updated in September 2026 to improve the reader experience.
Peter van der Woude works as a mobility consultant and knows the ins and outs of the ConfigMgr and Microsoft Intune tools. He is a Microsoft MVP and a Windows expert as well.
