How Intune device sync works

What happens during a Windows device sync?

A sync is a request from the device to Intune that says, in effect, “tell me what has changed.” When the check-in completes, the device receives any new or updated assignments and configuration, evaluates whether each policy applies, takes action, and reports status back to the service. Nothing about a sync forces an install on its own; it only makes the device aware of work sooner.

• The device authenticates and checks in with the Intune service.
• Intune returns applicable policy, configuration, and app assignment information.
• The device evaluates assignment targeting, requirement rules, and detection state locally.
• For Win32 apps and PowerShell scripts, the Intune Management Extension processes the install, uninstall, or reporting work.

How often does Intune actually check in?

There is not one schedule, there are two, and conflating them is the most common source of confusion. The general Windows MDM check-in handles configuration profiles, compliance, and most device policy. It runs on a variable schedule that is commonly around every 8 hours, and it runs more frequently in the period right after enrollment while the device settles into management.

Win32 apps and PowerShell scripts are a separate channel. They are handled by the Intune Management Extension (IME), the “Microsoft Intune Management Extension” service, which checks for new Win32 app and script policy roughly every hour. The IME also re-evaluates after a device restart and whenever its service restarts. So if you publish a new Win32 app, the relevant clock for that work is the ~1 hour IME cycle, not the ~8 hour MDM cycle. A manual sync forces an immediate check-in across these channels rather than waiting for the next scheduled pass.

Manual sync options for faster pilot testing

During a pilot you do not want to wait an hour to see whether a new Required or Available assignment reaches a test machine. A manual sync triggers the check-in immediately. There are three places to start one, plus a restart as a heavier reset.

• Windows Settings: Settings > Accounts > Access work or school > select the work account > Info > Sync. This is the most direct on-device option and does not require Company Portal.
• Company Portal: open the app, go to Settings, and choose Sync. This is the natural choice when a pilot user is testing an Available app and watching its status.
• Intune admin center: Devices > All devices > select the device > Sync. Use this remote action for help-desk and remote validation when you cannot touch the machine.
• Restart: a reboot triggers a fresh IME evaluation and is useful when app processing appears stuck or there are pending changes.

Which sync method should you use?

What a manual sync can and cannot accelerate

A sync compresses waiting time, not the rules of delivery. Policy still depends on assignment, eligibility, and device connectivity, so a sync only helps once everything else is correct. It will not paper over a misconfiguration, and syncing repeatedly against a device that is not eligible accomplishes nothing.

• Targeting: the app must be assigned to a group the user or device belongs to. Sync cannot fix the wrong group.
• Group membership timing: Azure AD/Entra group changes and Intune assignment evaluation take time to propagate; a brand-new membership may not be reflected on the very next check-in.
• Requirement rules: evaluated before the install command runs. If the device fails an OS, architecture, disk, memory, or custom requirement rule, the app is filtered out as not applicable no matter how often you sync.
• Detection rules: if a detection rule already reports the app as installed, Intune treats the install as complete and does nothing further.
• Connectivity and device state: an offline, sleeping, or unhealthy device cannot check in until it can reach the service.

Using the Intune Management Extension to confirm a sync worked

Because Win32 apps live on the IME channel, the most reliable way to confirm a forced check-in actually triggered app processing is to look at the agent itself. Restarting the Microsoft Intune Management Extension service prompts an immediate re-evaluation of Win32 and script policy, which is handy when a sync from the UI does not appear to do anything.

Restart-Service -Name IntuneManagementExtension -Force

Then read the logs to see what the agent did. The IME writes to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, with IntuneManagementExtension.log and AppWorkload.log being the most useful for app delivery. Open them with CMTrace for readable, color-coded output. For a deeper walkthrough of which file shows what, see the Intune Management Extension logs guide.

How sync connects to the rest of app deployment

Sync sits in the middle of the delivery chain. Upstream is assignment, which decides who gets the app and whether it installs automatically or appears in Company Portal. Downstream is the on-device work performed by the Intune Management Extension, governed by requirement rules, detection logic, install context, and return codes. A forced check-in is simply how you tell the device to start that chain sooner during testing. When a sync does not produce the expected result, treat it as a signal to inspect the surrounding pieces rather than to keep clicking Sync.