Before
The SOC team likely had to retrieve device inventory manually, review installed applications one device or employee at a time, and distinguish standard Apple applications from software requiring attention. They also had to refresh the spreadsheet and notify the relevant channel after completing the review.
How it works
- Authenticate to the device-management environment and retrieve computer inventory containing employee, location, and installed-application details.
- Refresh each employee's spreadsheet range and evaluate every installed application, excluding entries with Apple bundle identifiers while recording the remaining software details.
- Notify the relevant operations channel with the updated monitoring report and the available uninstall instruction.
Workflow details
- Authentication and inventory retrieval: The workflow creates an authentication token and uses it to retrieve paginated computer inventory records, including user, location, and installed-application information for company devices.
- Employee-level processing: It iterates through the retrieved device or user records and clears the existing spreadsheet range associated with each user before writing the latest application data.
- Application filtering: Each installed application is evaluated by its bundle identifier. Applications whose bundle identifiers contain `com.apple` are excluded so that the inventory focuses on non-default software.
- Inventory update: For applications that pass the filter, the workflow appends the application name, version, installation path, and bundle identifier to the spreadsheet for the relevant user.
- Operational notification: After processing each user iteration, the workflow posts a message to the relevant operations channel with a link to the application monitoring report and instructions for starting an uninstall process when needed.
What changed
The monthly inventory process now retrieves current device and application data, applies the Apple-bundle filter, refreshes the spreadsheet, and delivers the report notification as part of one automated run. Human involvement shifts to reviewing the resulting inventory and deciding whether any application should be uninstalled.
Work removed
Manually retrieving computer inventory, clearing old spreadsheet ranges, reviewing applications one by one, excluding Apple default applications, copying application names and version details into the spreadsheet, and posting the report notification.
Expected outcome
A conservative expectation is that each monthly run removes at least three recurring action types—inventory collection, spreadsheet refresh, and report notification—while maintaining a current record of non-Apple applications.
