Enhanced Inventory Data Reference (macOS)

This page lists everything the macOS Enhanced Inventory script (Mac_Custom_Inventory.sh) collects from a Mac and sends to your Log Analytics workspace. Use it to answer security and privacy reviews, to decide which collection categories to turn on, and to understand what the macOS rows in BI for Intune are built from.

The reference matches the script in the Mac-Enhanced-Inventory repository as of October 2026. For deployment steps, see Set up Enhanced Inventory. For the Windows script, see the Windows data reference.

What the script doesn’t collect

The script doesn’t read user files, documents, browser history, email, credentials, or network traffic. It doesn’t collect the device serial number, the signed-in user, or any user account information. It doesn’t collect drivers, Microsoft 365 release data, or warranty data; those categories exist only in the Windows script.

How Collection Works

The script runs as root from an Intune shell script policy, once per day. Each run:

1. Reads the Intune device ID and computer name from the Mac.
2. Collects each category you’ve turned on (device, application).
3. Builds a JSON document for the category, compresses it with GZip, and Base64-encodes the result.
4. Splits the encoded text into chunks of up to 64,512 characters and writes each chunk to a numbered string column (up to 10 columns per table).
5. Sends one record per category to your Data Collection Endpoint through the Logs Ingestion API, authenticating with the app registration from Step 1 of the setup guide.

BI for Intune decodes the chunks when it refreshes. If a category exceeds 10 chunks, the script exits with an error and that category isn’t sent for that run. The script writes no log or cache files on the Mac; its only output is the status line that Intune shows for the script run.

Settings That Control What Is Collected

All settings are variables near the top of the script. true collects the category; false skips it.

Setting	Default	What it controls
CollectDeviceInventory	true	The entire PowerStacksDeviceInventory_CL record: CPU, memory, boot time, battery, startup disk, and model.
CollectAppInventory	true	The entire PowerStacksAppInventory_CL record: installed applications.
InventoryDateFormat	"%m-%d %H:%M"	Format of the timestamp in the script status message. Doesn’t affect the data sent.

The remaining settings (LogAPIMode, TenantId, ClientId, ClientSecret, DceURI, DcrImmutableId, and the legacy CustomerId and SharedKey) control how the script authenticates and where it sends data. They don’t change what is collected.

Fields Common to Every Table

Every record in both tables has these columns.

Column	Source on the Mac	Notes
TimeGenerated	Added by Azure Monitor	Ingestion time.
ComputerName_s	scutil --get ComputerName	The Mac’s computer name as set in System Settings > General > About.
ManagedDeviceID_g	The Intune MDM device certificate in the system keychain (security find-certificate, issuer MICROSOFT INTUNE MDM DEVICE CA)	The Intune managed device ID. BI for Intune uses it to join inventory to the Intune device record. Empty if the Mac isn’t enrolled.

The payload columns differ per table and are listed in each section below. The macOS script doesn’t write the Microsoft365_b or Warranty_b columns; they’re left empty on macOS rows.

PowerStacksDeviceInventory_CL

Collected when CollectDeviceInventory is true. One record per Mac per run. The payload is in DeviceDetails1_s through DeviceDetails10_s.

Device Fields

Field	Source on the Mac	Notes
DeviceManufacturer	Fixed value Apple Inc.
DeviceModel	system_profiler SPHardwareDataType, Model Identifier	For example Mac14,2.
Memory	sysctl hw.memsize	Bytes.
CPUManufacturer	sysctl machdep.cpu.vendor	Apple on Apple silicon, where the sysctl key doesn’t exist.
CPUName	sysctl machdep.cpu.brand_string	For example Apple M2 Pro.
CPUMaxClockSpeed	sysctl hw.cpufrequency_max	Intel Macs only. Empty on Apple silicon, which doesn’t report a fixed maximum frequency.
CPUPhysical	sysctl hw.packages	Physical processor count.
CPUCores	sysctl hw.physicalcpu
CPULogical	sysctl hw.logicalcpu
LastBootTime	sysctl kern.boottime	UTC.
BatteryDesignedCapacity	ioreg -r -n AppleSmartBattery, DesignCapacity	mAh. Empty on desktop Macs.
BatteryFullChargedCapacity	AppleSmartBattery, AppleRawMaxCapacity (Apple silicon) or MaxCapacity (Intel)	mAh.
BatteryHealthPercent	Calculated: full charged capacity divided by designed capacity	Percent, two decimals. Empty when either capacity is missing.
PhysicalDisks	Array with one entry, see Startup Disk Fields

Startup Disk Fields

The script inventories the startup disk only (disk0) using diskutil info disk0. External and secondary disks aren’t collected.

Field	Source	Notes
BusType	diskutil info, Protocol	For example Apple Fabric, PCI-Express, or SATA.
HealthStatus	diskutil info, SMART Status	Verified is reported as Healthy so it matches the Windows values.
Manufacturer	Fixed value Apple
Model	diskutil info, Device / Media Name
Size	diskutil info, Disk Size	Bytes.
Type	diskutil info, Solid State	SSD or HDD.
Temperature	First temperature value reported by ioreg -l	Celsius. 0 when no sensor is found. On some Macs this is a system sensor rather than the disk sensor.

The macOS script doesn’t collect disk serial numbers, firmware versions, wear, or read and write error counters. Those fields exist only in the Windows script.

PowerStacksAppInventory_CL

Collected when CollectAppInventory is true. One record per Mac per run. The payload is in InstalledApps1_s through InstalledApps10_s.

Where Applications Come From

Applications are read from system_profiler SPApplicationsDataType, the same source as System Information > Software > Applications. This includes applications in /Applications, /System/Applications, and the application folders of user home directories, so built-in macOS applications and user-installed applications both appear. Every application reported by system_profiler is sent; there’s no filtering or deduplication.

Application Fields

One entry per application.

Field	Source (system_profiler key)	Notes
AppName	_name	The application’s display name.
AppVersion	version	From the application bundle.
AppInstallDate	lastModified	The bundle’s last-modified date, which is the install or last-update date for most applications. UTC.
AppInstallPath	path	Full path to the .app bundle. For applications in a user’s home folder this path contains the account’s short name.

The macOS script doesn’t collect publisher, app type, or uninstall information. Those fields exist only in the Windows script.

Network Endpoints

The script makes outbound HTTPS connections only to the endpoints below.

Endpoint	When	Purpose
login.microsoftonline.com	LogAPIMode is LogIngestionAPI (default)	Acquires the ingestion token with the app registration’s client ID and secret.
Your Data Collection Endpoint (*.ingest.monitor.azure.com)	LogAPIMode is LogIngestionAPI (default)	Sends the inventory records.
<workspace-id>.ods.opinsights.azure.com	LogAPIMode is DataCollectorAPI (legacy)	Sends the inventory records with the workspace shared key.

The script contacts no vendor, Microsoft 365, or Windows Update endpoints.

View the Raw Data in Log Analytics

To inspect exactly what a Mac sent, decode the chunk columns in the Log Analytics Logs blade. This example decodes the most recent device inventory record for one Mac:

PowerStacksDeviceInventory_CL
| where ComputerName_s == "MAC-NAME"
| top 1 by TimeGenerated desc
| extend Encoded = strcat(DeviceDetails1_s, DeviceDetails2_s, DeviceDetails3_s, DeviceDetails4_s, DeviceDetails5_s,
                          DeviceDetails6_s, DeviceDetails7_s, DeviceDetails8_s, DeviceDetails9_s, DeviceDetails10_s)
| extend Inventory = parse_json(gzip_decompress_from_base64_string(Encoded))
| project TimeGenerated, ComputerName_s, ManagedDeviceID_g, Inventory

Replace the table and column names to decode application inventory (PowerStacksAppInventory_CL, InstalledApps1_s through InstalledApps10_s).