Packaging Win32 apps¶

The Windows app (Win32) type is how most Windows software reaches devices through Intune. It's flexible enough for almost any installer, and most "Intune can't deploy this app" problems turn out to be packaging mistakes. This guide covers the parts people get wrong.

The workflow¶

flowchart LR
    A[Get the silent install<br/>and uninstall commands] --> B[Package with<br/>IntuneWinAppUtil.exe]
    B --> C[Add app in Intune:<br/>commands, requirements, detection]
    C --> D[Test on a clean<br/>test device]
    D --> E[Assign to pilot,<br/>then broad]

1. Package the app¶

Download the Microsoft Win32 Content Prep Tool and run:

IntuneWinAppUtil.exe -c C:\Packages\7zip\Source -s 7z-x64.msi -o C:\Packages\7zip\Output -q

Keep the source folder lean: everything in it is uploaded and downloaded to every device. Apps can be up to 30 GB.

2. Program settings¶

The 32-bit trap¶

The Intune Management Extension runs install commands from a 32-bit process. On 64-bit Windows, paths like C:\Windows\System32 are silently redirected to SysWOW64, and HKLM\SOFTWARE writes go to WOW6432Node. To run 64-bit PowerShell from an install command, use the Sysnative path:

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoProfile -File .\Install.ps1

3. Requirements¶

Requirement rules decide whether a device should get the app at all. If a requirement isn't met, the app shows as Not applicable, not Failed.

• OS architecture: x64, x86 and Arm64 as appropriate. Many apps now ship separate Arm64 builds.
• Minimum OS version.
• Additional rules: file, registry or script checks, for example "only install the plug-in if the host app is present".

4. Detection rules¶

Detection rules tell Intune whether the app is installed. Get them wrong and Intune reinstalls forever, or reports failure for a successful install.

# Detected = exit 0 with output. Not detected = no output (or a non-zero exit).
$minimum = [version]'24.09'
$path = 'C:\Program Files\7-Zip\7z.exe'

if (Test-Path $path) {
    $installed = [version](Get-Item $path).VersionInfo.ProductVersion
    if ($installed -ge $minimum) {
        Write-Output "7-Zip $installed detected"
        exit 0
    }
}
exit 0

5. Dependencies and supersedence¶

• Dependencies install other Win32 apps first, such as a runtime the app needs. Choose whether Intune installs the dependency automatically.
• Supersedence replaces an older app with a newer one. Choose update (install the new version over the old) or replace (uninstall the old app first, using its uninstall command).
• Keep chains short. Long dependency and supersedence chains are hard to troubleshoot and slow to evaluate.

6. Assign and roll out¶

• Assign Required to a pilot group first. Check App install status before widening.
• Use an installation deadline for disruptive updates, and notifications set to show only restart prompts for quiet background installs.
• During classic Autopilot, don't mix Win32 and MSI line-of-business apps. Package everything as Win32.
• New apps and changes reach devices when the Intune Management Extension checks in, which it does every hour and after the service or device restarts.

Troubleshooting¶

Common problems:

Learn more¶

• Win32 app management
• Add, assign and monitor a Win32 app
• Prepare Win32 app content for upload