The Avyna Agent
Intune knows the device exists. The agent knows what it is.
A Windows service you publish through Intune like any other application. It installs, proves the machine belongs to your estate, and from then on reports what is actually on it — down to the RAM stick, the scheduled task and the local administrator account nobody provisioned.
- 10 min
- Default check-inOne minute on retry. Both adjustable.
- ~40
- Defender fieldsPer machine, every cycle.
- 0
- Inbound connectionsEvery conversation is outbound.
- 1
- Win32 app to deployNo server, no console, no policy first.
Why it exists
A compliance verdict is not a description of the machine.
Intune tells you a device is enrolled, encrypted and compliant. That is a judgement about your policies, not an account of what is on the hardware. The agent is what closes the gap — and it is where most of what Avyna Core shows you comes from.
It reports what policy cannot
Intune can enforce local group membership and tell you the policy applied. It does not inventory who is actually in the local Administrators group. The agent reports the real membership.
It needs no infrastructure
No inventory server, no second console, no collection policy to author first. Collection starts the moment the agent installs.
It proves itself before it is trusted
The agent registers using the machine's own Entra device identity, and the platform verifies the device genuinely belongs to your Intune estate before issuing any credential.
What it reports
Six areas, component by component.
Not categories — actual values, refreshed on every check-in. Five of the six can be switched off per area if you would rather not collect them.
Defender across roughly forty fields: real-time and tamper protection, engine and signature versions, signature age, last scan times, whether an update is pending BitLocker per volume, with algorithm, key length and whether a recovery key exists Firewall state Installed certificates with issuer and validity dates Installed patches with KB number and install date The local Administrators group as it actually is — accounts and groups
How it behaves
The questions asked before it goes on every machine.
It reports on a cycle, not continuously
Ten minutes after a successful check-in by default, retrying every minute after a failure. Both are configurable. It is an inventory, not a live feed — and not a monitoring product.
Every connection is outbound
The agent initiates every conversation with the platform. Nothing connects into the device, so no inbound firewall rule and no exposed port is required.
It survives being offline
If the platform cannot be reached the agent retries with backoff and keeps the report locally until it can send. A laptop on a plane does not lose its inventory.
You choose what it collects
Hardware, security, network, storage and application collection can each be switched off. Nothing forces you to gather what you would rather not hold.
It uninstalls cleanly
A matching uninstaller removes the service, the binary and the stored credentials. Nothing is left behind on the machine.
Its state is visible per machine
The console says whether each device is reporting, stale, or has never reported, with the time of its last check-in. You always know whether you are looking at current data.
Rolling it out
It deploys like any other application.
Because it is one. There is nothing new to learn and nothing new to run.
- 01
Publish it in Intune
Add the installer as a Win32 app, with a registry key as the detection rule. It is the same publish-and-assign flow as any other application you deploy through Intune.
- 02
Assign it
To a group, to a set of devices, to whatever scope you already use. Deploy to your whole estate or to the machines you want reporting.
- 03
It registers itself
Each machine finds its Entra device identity, registers, is verified against your Intune estate, and starts reporting. No per-device setup and nobody touching the machine.
A device licence is bought and assigned to a specific machine running the agent, the same way a user licence is assigned to a person. The device licence costs the same on every plan. Moving up a plan changes what a user licence costs and what the console can do — never what the agent costs. Licence the machines you want reporting and leave the rest. You pay for what you assign, not for the size of your estate. A licence can be released and reassigned to another machine, cancelled, or resumed before the cancellation takes effect.
Stated plainly
What the agent does not do.
It is an inventory agent. It is deliberately not a monitoring agent, and the difference matters to a works council as much as to a security reviewer.
Windows only — there is no macOS, iOS, Android or Linux agent No alerting, thresholds or change detection — it reports, the console presents No real-time data — it reports on a cycle you set No remote control and no remote scripting No automated remediation, policy enforcement or patch deployment No software packaging or distribution It collects device configuration and inventory — not files, not documents, not browsing
In pilot
Put it on one machine and see what comes back.
Avyna Core is in pilot — we take a small number of organizations at a time. The fastest way to judge the agent is to deploy it to a single device and open the page it produces.