App management¶
Intune can install, update, configure, protect and remove apps on every platform it manages. Add apps under Apps > All apps > Create, or per platform under Apps > Platforms.
App types by platform¶
| App type | Use for |
|---|---|
| Windows app (Win32) | Almost everything: EXE, MSI and scripted installs, packaged as .intunewin. The most flexible type. See Packaging Win32 apps. |
| Enterprise App Catalog app | Common third-party apps prepackaged and hosted by Microsoft, with detection and updates built in (Enterprise App Management) |
| Microsoft Store app (new) | Store apps delivered through the Windows Package Manager (WinGet), installed in system or user context, kept up to date automatically |
| Microsoft 365 Apps | Office, with channel, architecture, language and app selection built in |
| Microsoft Edge | Edge for Windows 10. Windows 11 already includes it, so just configure it. |
| Line-of-business (MSI, MSIX) | Simple single-file packages. Prefer Win32, especially during Autopilot. |
| Web link | A shortcut to a web app |
| App type | Use for |
|---|---|
| macOS app (PKG) and macOS app (DMG) | Most third-party apps, installed by the Intune management agent |
| Line-of-business (PKG) | Signed packages installed through MDM |
| Apps and Books (VPP) | App Store apps you've licensed in Apple Business |
| Microsoft 365 Apps and Microsoft Edge | Built-in app types |
| App type | Use for |
|---|---|
| Apps and Books (VPP) | Licensed App Store apps, usually with device licensing so no Apple account is needed |
| iOS store app | Free App Store apps, which still need the user's Apple account to install |
| Line-of-business (.ipa) | In-house apps signed for enterprise distribution |
| Web clip | A web app icon on the home screen |
| App type | Use for |
|---|---|
| Managed Google Play | Public apps you approve, plus private apps and web apps published to your organization only |
| Line-of-business (.apk) | AOSP devices and special cases |
| System apps | Enabling built-in apps on corporate devices |
Assignment intents¶
| Intent | Behavior | Notes |
|---|---|---|
| Required | Installs automatically, and reinstalls if removed | Assign to device groups for apps needed before sign-in, user groups otherwise |
| Available for enrolled devices | Shows in Company Portal for users to install | Assign to user groups |
| Uninstall | Removes the app | Don't let Uninstall and Required assignments overlap. The result depends on the group types involved and is hard to predict. |
| Available with or without enrollment (mobile) | For app protection scenarios on unenrolled devices | Users install from the public store |
For Win32 apps you can also set an availability date, an installation deadline, end-user notification behavior, restart grace periods and Delivery Optimization priority per assignment.
Microsoft 365 Apps¶
The built-in Microsoft 365 Apps app type covers most organizations:
- Update channel: Monthly Enterprise Channel is the usual choice. Current Channel gets features first. Semi-Annual Enterprise Channel suits change-averse environments.
- Architecture: 64-bit unless you have old 32-bit add-ins.
- Remove other versions: Yes, to clean up MSI-based Office.
- Shared computer activation: for shared devices, Remote Desktop session hosts and multi-session.
If you need full control (custom XML, specific languages, Visio and Project licensing), package the Office Deployment Tool as a Win32 app instead.
Enterprise App Management¶
Enterprise App Management adds a Microsoft-hosted Enterprise App Catalog of prepackaged Win32 apps, such as browsers, PDF readers and developer tools. Each app comes with install commands, detection rules and requirements already filled in. Update them with supersedence when new versions appear, or let catalog apps update automatically. You can override the install command with your own PowerShell script if needed.
It's included in Microsoft 365 E5 and E7 from July 2026. Devices need access to aam-content-cdn.manage.microsoft.com to download catalog content.
Apple Apps and Books¶
- Buy (or "buy" free) apps in Apple Business and sync them with the Apps and Books location token.
- Assign with device licensing. It doesn't need an Apple account on the device and works for devices without user affinity.
- Tokens can use DDM management on iOS/iPadOS 18 and later, which supports Required and Uninstall assignments only. Check before switching a token that has Available assignments.
- Allow automatic app updates on the token, and override per app if you need to hold a version.
Managed Google Play¶
- Approve public apps in the Managed Google Play iframe in Intune, then assign them.
- Publish private apps (visible only to your organization) and web apps from the same place.
- Choose the update mode per app: default, high priority, or postponed.
- For work profile devices, only apps you've approved appear in the work profile's Play Store.
Company Portal¶
Company Portal is the user's app store and self-service tool. Make it good:
- Brand it under Tenant administration > Customization: logo, colors, support contacts, privacy statement.
- Mark key apps as featured, and write useful descriptions.
- On Windows, deploy Company Portal as a Microsoft Store app (new) in system context, assigned to devices, so it's there before users sign in.
Monitoring apps¶
| Question | Where |
|---|---|
| Which apps failed to install, and where? | Apps > Monitor > App install status |
| What's installed on this device? | Device > Managed apps, or Discovered apps for the device inventory |
| Which apps are installed across the fleet? | Apps > Monitor > Discovered apps |
| Why did a Win32 app fail? | The Intune Management Extension logs. See Packaging Win32 apps. |