From the blog

AppWorkload.log and the Win32app Policies inside

New to the log? Start here: when the agent checks in for apps, and how to pull the Win32 app policies out of the log by hand. The first post in a series on michaeltheadmin.com.

Read the post
Reference

Every policy field, explained. No log needed.

Look up any field: what it means, its values and when you see them, what the agent does with it, and the source behind every line.

Browse the Reference

Drop AppWorkload logs here Drop to open

See every Win32 app policy in an AppWorkload*.log, decoded field by field, with the source behind each value.

Where to find it on a device
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
Older, rotated AppWorkload logs work too. Open several at once to compare snapshots.

Runs entirely in your browser. Nothing is uploaded.

01 · Snapshots Every “Get policies” check-in Each policy list in the log becomes a snapshot on a timeline, with what changed since the last one.
02 · Related apps Dependencies and supersedence, nested See which apps install, require, update or replace each other, right in the app list.
03 · Explained Click any field to learn it Raw value, meaning, and the source: Documented Observed Community Analyzed Undocumented How the sources work →
Who's behind it
Michael Escamilla

Built by Michael Escamilla

Customer Engineer at Patch My PC

An IT system administrator for over 10 years, focused on endpoint management with Configuration Manager and Microsoft Intune. He writes about it as Michael The Admin.

michaeltheadmin.com

Unofficial. Not affiliated with Microsoft. Sources: Microsoft Learn, lab logs, community research, and analysis of the decompiled agent.
Background: AppWorkload.log and the Win32app Policies inside on michaeltheadmin.com