Employee laptop inventory (2026): free IT asset inventory for every Mac and app
List every app and version on every Mac, including personal ones: system_profiler, Apple Business, Mosyle, Fleet, JumpCloud, Workbrew and Caspian compared.
Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.
Key takeaways
- On one Mac,
system_profilerlists every app and version for free. - For an Apple fleet under 30 devices, Mosyle Business FREE costs nothing.
- If an engineer will run a server, Fleet's self-hosted tier is free.
- For personal or unenrolled Macs plus SaaS apps, Caspian's See plan is free.
- Join hardware and software lists on the serial number, and keep the owner column current.
An employee laptop inventory lists every laptop, its owner, and every app and version installed on it. On one Mac, macOS builds the list for free with system_profiler. For a fleet, the free options are Apple Business, Mosyle Business FREE up to 30 devices, Fleet's open-source tier, and Caspian's free See plan, which also covers personal Macs.
Caspian publishes this article and sells a product in this space: Caspian, the IT automation platform for scale-ups. We say where another tool fits better. Facts and prices were checked on 4 November 2026.
| Tool | Free limit | Apps and versions per Mac | Security state (FileVault, firewall, OS) | Unenrolled or BYOD Macs | SaaS apps and AI tools | Self-hosting needed | Paid list price |
|---|---|---|---|---|---|---|---|
system_profiler | Free, one Mac at a time | Yes | With extra commands | Only if you sit at the Mac | No | No | Free |
| Caspian See | Free, no device cap stated | Yes | Yes | Yes, agent | Yes | No | €10 per active user per month (Act) |
| Apple Business | Free | App Store apps | Settings through Blueprints | User Enrollment, limited | No | No | Free |
| Mosyle Business FREE | 30 devices | Yes | Yes | BYOD enrolment, limited | No | No | $1 per device per month |
| Fleet Free | No device cap | Yes | Yes | BYOD enrollment listed | No | Yes | $7 per host per month |
| JumpCloud Free | 10 users, 10 devices | Yes | Yes | Agent | SaaS Management listed | No | See JumpCloud pricing |
| Workbrew | No device cap | Yes, plus packages | Not stated | Through your MDM | No | No | See Workbrew |
What belongs in an employee laptop inventory?
Two lists joined on the serial number: the hardware list (laptop, owner, model, OS) and the software list (apps and versions per laptop). Add the security state and the last check-in, and you can answer the questions auditors and customers ask.
| Field | Source on a Mac | Why IT needs it |
|---|---|---|
| Serial number and model | system_profiler SPHardwareDataType | The key that joins every other list |
| Owner | HR system or directory | Who to ask, and what to collect when they leave |
| macOS version | sw_vers | Patch status |
| Apps and versions | system_profiler SPApplicationsDataType | Outdated and unapproved software |
| Where each app came from | obtained_from field in the JSON output | App Store versus downloaded |
| FileVault | fdesetup status | Encryption proof |
| Firewall | socketfilterfw --getglobalstate | Network exposure |
| Last check-in | Your tool | Lost or unmanaged laptops |
The owner column is the one spreadsheets lose first. A laptop without a current owner is how a leaver's Mac stays in a drawer with a logged-in session.
How do you list every app on one Mac for free?
Run system_profiler SPApplicationsDataType in Terminal, or open System Information and choose Software, then Applications. Both are built into macOS and list every app with its version and source.
For a file you can process, use JSON:
system_profiler -json SPApplicationsDataType > apps.json
Each entry carries the app name, version, obtained_from (Apple, App Store, identified developer or other), last modified date and path (Lifli, Mac software inventory, checked 4 November 2026). The obtained_from field separates App Store apps from downloads, which is where unapproved software shows up.
This is the right answer for five Macs you can walk up to. It stops working at fifty, for three reasons: someone has to run it on every Mac, the result is out of date the next day, and remote laptops never come back to the office for the run.
Why does an MDM not show every app?
An MDM shows apps on the Macs enrolled in it. Personal and contractor Macs are usually not enrolled, and on a personal Mac enrolled through Apple's User Enrollment, the MDM cannot list all installed apps.
Lifli puts the first half plainly: "There is no way to audit a Mac remotely that was never enrolled" in an MDM (Lifli). That is true for MDMs. An agent installed as a normal app can report from an unenrolled Mac, which is the gap Caspian Desktop and Kolide fill.
The second half comes from Apple. Under User Enrollment, Apple lists the query "List the installed apps" for iOS and iPadOS, not macOS, and it excludes "user-installed apps from the App Store" (Apple, User Enrollment information, checked 4 November 2026). Apple's WWDC session adds that personal apps are "unavailable to the MDM server" under User Enrollment (WWDC21). That protects the person, and it means BYOD Macs are missing from the app list.
Which free laptop inventory tools work for Macs?
Five options cost nothing to start: Apple Business, Mosyle Business FREE, Fleet's open-source tier, JumpCloud Free for small fleets, and Caspian's See plan. They differ on device caps, self-hosting and BYOD.
Caspian (See plan, free). This section describes our own product. Install Caspian Desktop and each Mac reports its apps and versions, FileVault, firewall, Gatekeeper, screen lock and macOS version, including Macs that are not enrolled in an MDM. The See plan also shows every SaaS app and AI tool in use, from Google Workspace or Microsoft Entra, and who has access. See is free; Act, where Caspian installs apps and handles joiners and leavers after your approval, is €10 per active user per month excluding VAT, all their laptops included, 30 days free with no card, billed monthly (pricing, checked 4 November 2026). Sign-up is self-serve. Caspian also reads devices from Jamf, Iru and Intune if you already run one, and supports Windows. On a personal Mac it works on the work account only and collects no personal files, messages or browsing.
Apple Business. Free MDM since April 2026 with zero-touch enrollment and App Store app distribution (Apple Newsroom). A full inventory of apps from outside the App Store is not described.
Mosyle Business FREE. Up to 30 Apple devices free, with BYOD enrolment; Premium is $1 per device per month with a 30-licence minimum (TechBag, from Mosyle's pricing page, checked 4 November 2026). The best free pick for an Apple fleet under 30 devices.
Fleet. Open source, built on osquery, so "which Macs have this app at this version" is a SQL query. The free tier is self-hosted with community support; Premium is $7 per host per month (Fleet pricing; Fleet, checked 4 November 2026). Pick it if an engineer will run the server.
JumpCloud Free. JumpCloud's System Insights reports installed apps with version and last-opened date on macOS, and JumpCloud has offered a free account for up to 10 users and 10 devices (JumpCloud blog; check current terms on JumpCloud pricing). Pick it for a mixed Mac and Windows fleet.
Workbrew. Free with "no device or user limits", and lists Homebrew packages, npm packages, VS Code extensions and apps per Mac (Workbrew, checked 4 November 2026). It deploys through your MDM. Pick it for an engineering team where most risk sits in developer tooling.
Is a laptop inventory the same as IT asset inventory software?
IT asset inventory software tracks the hardware a company owns: serial number, model, owner, purchase date and state. A laptop inventory adds the software layer: every app and version on each machine. Most small teams need both in one list, joined on the serial number, and the free tools below cover the hardware columns as well as the app list. Dedicated IT asset management suites add purchasing, warranty and depreciation tracking, which a 100 to 250 person company can often keep in a spreadsheet.
How do the free inventory options compare?
The comparison table is at the top of this page. "Not stated" means the vendor page does not say.
How do you keep the inventory current?
Pick a tool that reports on its own, run a weekly review of three exceptions, and tie the owner field to the HR system so leavers update the list without a manual step.
The three exceptions worth a weekly look:
- Laptops that have not checked in for 14 days.
- Apps more than one major version behind, or apps from outside your approved list.
- Laptops whose owner left or changed team.
The third one is where a spreadsheet inventory breaks. HR records the leaver, and nobody tells the spreadsheet. NIST SP 800-53 control PS-4 asks organisations to retrieve "all security-related organizational system-related property" when someone leaves (CSF Tools, PS-4, checked 4 November 2026).
Building that join by hand means exporting the HR list, the MDM list and the Google Workspace user list every month and matching them in a sheet. That export-and-match is the step the free Caspian scan removes: laptops, apps and owners in one view, read-only, with leavers flagged. Start for free: self-serve, no card needed, and the scan runs as soon as you connect.
Checklist: an employee laptop inventory you can copy
- Every laptop has a serial number, model and current owner.
- The owner comes from the HR system or directory, not a spreadsheet.
- Every laptop lists its apps and versions, refreshed at least daily.
- We record where each app came from (App Store or download).
- FileVault, firewall and macOS version are recorded per laptop.
- Personal and contractor Macs that touch company data are in the list.
- We review laptops not seen in 14 days every week.
- We review outdated and unapproved apps every week.
- Leavers' laptops are collected or wiped on their last day.
- The inventory collects device data only: no keystrokes, screenshots or browsing history.
What does Caspian read, and with which rights?
Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.
Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.
FAQ
How do I see all apps installed on a Mac?
Run system_profiler SPApplicationsDataType in Terminal, or open System Information and choose Software, then Applications. Both are built into macOS and list every app with its version and source.
What is the best free tool for a Mac laptop inventory?
For under 30 Apple devices, Mosyle Business FREE. For an engineering team willing to self-host, Fleet's open-source tier. For Macs that include personal and contractor laptops, Caspian's free See plan, which uses an agent that runs without MDM enrolment.
Can an MDM list the apps on a personal Mac?
Not fully. Under Apple's User Enrollment, the installed-apps query is listed for iOS and iPadOS only, and personal apps are unavailable to the MDM. An agent installed with the person's consent can report the app list instead.
Can I inventory a Mac that was never enrolled in an MDM?
Not with an MDM. You need an agent installed on the Mac as a normal app, such as Caspian Desktop or Kolide, or someone running system_profiler on the machine.
How often should a laptop inventory update?
At least daily for apps and security state, and on the same day for owner changes. Review laptops not seen in 14 days, outdated apps and leavers' laptops every week.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Mac software inventory | Lifli | Checked 4 Nov 2026 | Medium (third party) |
| User Enrollment information | Apple | Checked 4 Nov 2026 | High |
| Discover account-driven User Enrollment | Apple | WWDC21 | High |
| Introducing Apple Business | Apple | 24 Mar 2026 | High |
| Mosyle Business | TechBag | Checked 4 Nov 2026 | Medium (third party citing vendor) |
| Fleet pricing | Fleet | Checked 4 Nov 2026 | High (vendor page) |
| List applications on laptops | JumpCloud | 15 Sep 2020 | Medium (older vendor post) |
| Workbrew free | Workbrew | Checked 4 Nov 2026 | High (vendor page) |
| NIST SP 800-53 PS-4 | CSF Tools | Checked 4 Nov 2026 | High |
| Pricing | Caspian | Checked 4 Nov 2026 | High (our own page) |
Try it on your own laptops: start for free, no card needed. Or add Caspian to Slack, Teams or Google Chat.
← All resources
