Microsoft Intune Management Extension for IT Teams: Workloads, Logs, Sync and Fixes

Updated: November 2026. Check-in cadence, logs, prerequisites, release dates and error codes checked against Microsoft Learn on 11 November 2026.

A Win32 app that never lands and a script that reports success without changing anything usually lead back to the same Windows agent. It runs on its own clock, writes to its own log folder, and Microsoft spreads its rules across separate Learn pages. This guide explains the Microsoft Intune Management Extension as of November 2026: what it runs, when each workload checks in, where the logs live and how to fix the usual failures.

TL;DR

• What it is. A Windows agent Intune installs on enrolled PCs to run Win32 apps, PowerShell scripts, remediations and custom compliance scripts.
• Cadence. It checks in every 8 hours, Win32 apps get an hourly check, and push notifications now speed up app and script changes.
• Logs. Every log sits in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, and AppWorkload.log covers Win32 apps.
• Forcing a sync. Company Portal Sync or a service restart starts a check-in straight away.
• Version floor. Devices below IME 1.58.103.0 get no Win32 apps, scripts or remediations.

What Is the Microsoft Intune Management Extension?

The Microsoft Intune Management Extension (IME) is a Windows agent that Intune installs on enrolled PCs to run what the MDM channel can't: Win32 apps, PowerShell platform scripts, remediations and custom compliance scripts. It runs as the IntuneManagementExtension service.

Learn calls it an installer agent that adds advanced capabilities to standard Windows MDM. MDM is built into Windows and applies settings. The IME is the add-on that runs code. Our guide to the Windows MDM channel covers the built-in side.

You'll meet it under other names. Learn's Win32 troubleshooting page still calls it the SideCar agent. Its executable is Microsoft.Management.Services.IntuneWindowsAgent.exe in %ProgramFiles(x86)%\Microsoft Intune Management Extension. It has no Start menu entry. It signs in to Intune through an Entra app called Microsoft Intune Windows Agent, which turns up again in the fix table.

What Triggers the IME Install

You don't install the IME. Intune installs it the first time you assign a feature that needs it. Learn lists eight:

A note on the same page adds Microsoft Store apps. Remote Help is the easy one to miss, and our Intune Remote Help guide covers that notification.

Managed installers belong to App Control for Business, covered in our guide to managed installer rules.

Prerequisites

The device has to qualify first, and Windows Home is out. The IME page rules out S mode, since S mode won't run nonstore apps, and the scripts page says scripts don't run there. Only the Win32 overview lists S mode support, while the Win32 troubleshooting page says S mode can't install MSIs. Plan on Windows 11 S mode devices getting nothing from the IME.

The device must be Entra joined, hybrid joined or registered, and enrolled in Intune. Registered devices are the catch. The IME and Win32 pages list them. The scripts page's troubleshooting section says registered-only devices don't receive scripts, so join any device that runs them. Our Entra ID vs AD comparison covers the join types.

On co-managed devices, Win32 apps need the Apps workload set to Pilot Intune or Intune. PowerShell scripts run even when that workload stays with Configuration Manager.

Learn also sets a version floor: devices must run IME 1.58.103.0 or later, or they get no Win32 apps, scripts or remediations. The IME updates itself through sync, which is also the only supported install route. A manual, scripted or repackaged install is a listed cause of failure.

Intune removes the IME when PowerShell scripts are no longer assigned, the device leaves management, or the agent stays in an irrecoverable state for over 24 hours of device-awake time.

How the IME Works

The IME runs on its own schedule, separate from MDM check-ins, and each workload has its own trigger. Here's the cadence from Learn, read on 11 November 2026.

An admin change to a Win32 app or a Windows script now sends a push, so devices can check in sooner than the next poll. Custom compliance still waits for its 8-hour cycle.

At startup, the IME processes scripts and then Win32 apps, but Learn doesn't guarantee a script completes before app processing starts. If an app depends on a script, build that step into the app.

In September 2026, a school district admin on r/Intune asked whether to preinstall four ESP apps by script. The top reply keeps only Company Portal in the ESP and lets the other required apps land after sign-in. It credits the new post-ESP app check. A reply with the same score says the script route works too, launched from OSD's post-install step.

Win32 App Processing

Before installing, the IME checks whether the app applies and whether it's already there, which AppActionProcessor.log records. After the installer exits, the detection rule has to find the app, or Intune reports 0x87D1041C even though the install ran. A detection script counts as a hit only when it exits 0, writes to STDOUT and writes nothing to STDERR.

Return codes come in five types: Failed, Hard reboot, Soft reboot, Retry and Success. Dependencies cap at 100, nested ones included, and must be Win32 apps too. Our guide to silent install switches covers the command lines.

Content can download through Delivery Optimization, peer-to-peer by default, and nobody needs to be signed in for the install. Our Delivery Optimization cache guide covers where those files go.

Where the IME Logs Live

Every IME log sits in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, and Learn suggests reading them with CMTrace.exe. Learn's IME page lists eleven:

When IntuneManagementExtension.log rolls over, the old copy is saved as _IntuneManagementExtension.log, so check both. Older guides send Win32 troubleshooting to the main log, but Learn now points to AppWorkload.log for app deployment.

For a failed Win32 install, the app's Installation details pane in the admin center has a Collect logs option.

Manish Bangia's January 2026 walkthrough follows a Win32 app from the .intunewin file through the IME's evaluation flow, reading AppWorkload.log and AppActionProcessor.log along the way. It predates the September and October 2026 push changes.

The map below ties each trigger and workload to the log you open first.

How to Force an IME Sync or Restart the Service

Waiting 8 hours isn't a troubleshooting plan. Four routes start a check-in now:

1. On the device, open Company Portal > Settings > Sync. It starts an MDM check-in and an IME check-in.
2. Select Sync in the Intune admin center or the device's Settings app. Since the week of 27 July 2026, admin center Sync covers policies, apps and scripts, with progress on the Device sync status tab.
3. Restart the IntuneManagementExtension service in Task Manager > Services, and it checks in at once. Restart-Service -Name IntuneManagementExtension in an elevated PowerShell window does the same, though Learn only documents Task Manager.
4. Reboot when you're waiting on a platform script, since the IME looks for script changes after every reboot.

Sync starts check-ins, but it doesn't restart the service. If the service's start type is Manual, it might not come back after a reboot, so check services.msc first.

Common IME Problems and Fixes

Learn spreads these across four pages. Here they are in one table.

To check enrollment, open Settings > Accounts > Access work or school, select the account, then Info > Create report. If the MDMDiagReport has no MDMDeviceWithAAD, the device isn't auto-enrolled.

The bitsadmin fix sets the proxy for BITS, the Windows transfer service. Our guide to proxy server settings explains user and machine proxies.

When the script itself is the suspect, test it in 32-bit PowerShell, the IME's default host unless you switch on 64-bit. Learn's own AgentExecutor test snippet uses that host, and Learn suggests psexec -i -s to run a script as SYSTEM without Intune. Our PowerShell execution policy guide covers signing errors.

The Autopilot row applies only to classic Autopilot, covered in our guide to the Autopilot enrollment status page.

What Changed in 2025 and 2026

The IME updates itself, and Learn has no changelog for the client, so these dates come from Intune's What's new and in-development pages.

Microsoft recommends allowing the trouter endpoint for push-based device actions, Win32 apps, PowerShell scripts and remediations. Add it and the service tag wherever firewalls or TLS inspection rules sit between devices and Intune.

Packaging Win32 Apps for the IME

Every Win32 app reaches the IME as an .intunewin file, built by Microsoft's Win32 Content Prep Tool (IntuneWinAppUtil.exe). It takes -c for the setup folder, -s for the setup file, -o for the output folder and -q for quiet mode. Run it without them, and it asks for each one step by step. Keep the tool outside the source folder, because it zips everything in there. The latest release, v1.8.7 from 13 August 2025, added FIPS compliance.

Microsoft's own automation route is Enterprise App Management, an Intune add-on with a catalog of prepared Win32 apps and auto-update for Required assignments. Auto-update has no rollback or rings, and the catalog can lag by up to an hour. Admins also wrap installers in PSAppDeployToolkit (PSADT). Packaging searches turn up the IntuneWin32App PowerShell module, winget-based publishers and commercial packagers such as Master Packager, Robopack, Rimo3 and EMCO. Our roundup of software deployment tools compares the wider field.

Detection is where packaged apps go wrong. In October 2026, an r/Intune admin wrapping 7-Zip and FileZilla in PSADT asked which detection rule survives version updates. Replies favor the MSI product code, then the uninstall key's DisplayVersion with a greater-or-equal check.

Microsoft 365 Apps have their own route, covered in our Microsoft 365 Apps install guide.

Where the IME Stops

The IME is Windows only. Macs run shell scripts through a separate Microsoft Intune management agent, which also checks in every 8 hours. Our guide to Apple MDM options covers the Mac side.

Remediations need Windows Enterprise E3 or E5, Education A3 or A5, or Windows VDA per user, and Microsoft 365 Business Premium isn't on that list. Our guide to automated remediation covers other routes.

It's also one more agent next to whatever RMM, EDR and remote access tools you run, which our guide to endpoint agent sprawl weighs up.

If Intune isn't your only tool, our comparison of Intune with an RMM shows where each fits.

If waiting on IME check-ins is too slow for support work, there's OpenFrame, open, AI-native infrastructure for IT and security. It covers large areas of RMM, remote access and patching, with Fae resolving support requests and Mingo running IT operations. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which isn't part of Intune.

The Intune Management Extension in Short

The IME is the Windows agent behind Win32 apps, platform scripts, remediations and custom compliance, and Intune installs it on its own. It checks in every 8 hours, checks Win32 apps every hour, and push now speeds up app and script changes. When something stalls, open the Logs folder, force a sync, then work down the fix table. Next, our Microsoft Intune review covers plans, pricing and how Intune compares with an RMM.