About Software

The Software module gives you a site-wide catalog of every software product discovered on your audited devices, with per-version granularity and an install map that shows which devices have each product. It is your starting point for license compliance, standardization sweeps, and answering "who has what installed?" without inspecting devices one by one.

How software discovery works

Software inventory is a by-product of audits, not a separate scan. As Audit Service and Audit Agent collect device snapshots from Windows, macOS, and Linux endpoints, AlloyScan extracts the installed-product list from each snapshot and aggregates the results into a single, deduplicated catalog scoped to the current site.

The catalog presents two roll-up views over the same underlying data:

By name & version — one row per unique product name plus version pair. Use this view when version-level differences matter (for example, a vulnerable build of a runtime).
By name — multiple versions of the same product collapse into a single row, with the Version column showing Multiple versions. Use this view when you only care that a product is present somewhere in the estate.

Each catalog row exposes an Install count that tells you how many devices have the product. Clicking a product opens its detail view — the install map — listing every device, the version installed there, the install date, and the install key.

Why classification exists

Inventory alone tells you what is present; it does not tell you what should be present. Software classification lets you mark each product against your organization's policy:

Required — products that must be present (for example, a corporate antivirus or a baseline tool).
Regular — the default classification, applied to everything that is neither mandated nor banned.
Forbidden — products that must not be present (unlicensed software, decommissioned tools, shadow-IT applications).

Classification is a label on the product itself, so once you set it, every install of that product across every device inherits the meaning. This turns the catalog into a compliance lens: how many Forbidden products are deployed, where are the Required products missing, and what changed between audits.

How software changes are tracked

When Change tracking is enabled, the Required software, Forbidden software, and Regular software sub-attributes determine which products generate installation, removal, and version-change events. These events appear in Software > Change history.

Changes to Software group membership are recorded separately in Admin Center > Logs > Change log as Added and Deleted events for the Software group entity. These configuration events are recorded even when Change tracking is disabled.

Without Change tracking, you still see the current catalog state, but AlloyScan ignores newly detected software Change events.

Key distinctions

Catalog vs install map. The catalog (the grid) is one row per product; the install map (product detail) is one row per device that has the product.
Software group vs Tag. A Software group is a per-product policy classification with a fixed enum (Required / Regular / Forbidden). A Tag is a free-form label applied to devices, not products.
Install count vs unique device count. Install count is the number of devices reporting the product; a single device with two versions of the same product contributes two install rows in By name & version but one in By name.

Limitations