Deploy Windows Apps with Microsoft Intune (Without Asking Dave to Click Next)

If you want to deploy Windows apps with Microsoft Intune, the first surprise arrives when you select Create. Intune hands you a menu of Microsoft Store apps, Microsoft 365 Apps, Edge, web links, line-of-business apps, Win32 apps and, if you’re licensed for it, the Enterprise App Catalog.

They all get software onto a Windows device, but they don’t behave the same way. Some pull straight from Microsoft, some need you to upload an installer, and some need packaging, detection rules and a quiet word with whoever decided /S, /silent and /verysilent were all perfectly reasonable standards.

In this guide I work through every Windows app type using my own lab: VLC from the Microsoft Store, Microsoft 365 Apps, Edge, Redact Ninja as a web link, Audacity as an MSI, WinRAR packaged as Win32 and Visual Studio Code from the Enterprise App Catalog. I also cover assignments, detection rules, supersedence, monitoring and troubleshooting.

By the end you should be able to look at any application and decide how to deploy it, and why.

Never miss a guide: subscribe here and check out my YouTube channel.

I walk through every app type in my video, if you’d rather watch than read:

Every way to deploy Windows apps with Microsoft Intune

Here are the seven app types I cover, with the lab app I used for each. The real differences are where the software comes from, who packages it and who keeps it updated.

App type	Lab example	Packaging needed?	Who updates it	Best for
Microsoft Store app (new)	VLC UWP	No	Microsoft Store	Apps already in the Store
Microsoft 365 Apps	Word, Excel, Outlook, Teams	No	Your Microsoft 365 update channel	The Office suite
Microsoft Edge, version 77 and later	Edge Stable	No	Edge automatic updates	Managed Edge installs
Windows web link	Redact Ninja	No	The website owner	SaaS and internal web apps
Line-of-business app	Audacity MSI	Upload the installer	You	Simple MSI and MSIX packages
Windows app (Win32)	WinRAR	Yes, as .intunewin	You, ideally with supersedence	Most traditional Windows software
Enterprise App Catalog app	Visual Studio Code	Prepared by Microsoft	Catalogue updates you approve	Common third-party apps

You add all of them from the same place: Apps > All Apps > Create, then pick the app type from the Select app type pane.

Before you start: questions to answer for every app

Before you touch the portal, answer these. They are far more useful than picking whichever option in the drop-down looks closest.

Question	Why it matters
Where does the app come from?	Store, vendor MSI, plain EXE, or is it really just a website?
Does it install silently?	Intune can’t click Next, Next, Agree, Install, Finish.
Per-user or per-device?	Decides whether it installs in System or User context.
How will Intune detect it?	MSI product code, file, registry key or a script.
Who needs it?	Required for everyone, or Available for those who ask.
How is it updated?	Store, vendor auto-update, or you repackaging every release.
How will you remove it?	Uninstall assignment, uninstall command, or simply unassigning a link.

Prerequisites and licensing

Requirement	Details
Intune licence	Microsoft Intune Plan 1 for each user, included in Microsoft 365 Business Premium, E3, E5 and E7.
Windows edition	Pro, Enterprise or Education. Windows Home can’t take MSI, Win32, Microsoft 365 Apps, Edge or Microsoft Store app (new) deployments.
Enrolment	Devices enrolled in Intune. Win32 and Store apps use the Intune Management Extension (IME), which installs itself when needed.
Admin role	Intune Administrator, or the Intune Application Manager role for delegated app admins.
Enterprise App Catalog	Enterprise App Management: included in Microsoft 365 E5 and E7 from July 2026 (rolling out gradually), otherwise the Intune Suite or a standalone add-on.
Size limits	Win32 apps up to 30 GB each; Windows LOB packages up to 8 GB.

If you’d rather personal Windows devices didn’t turn up in Company Portal at all, sort that first with my guide to block personal Windows devices in Intune.

Required, Available or Uninstall: pick the assignment first

However you add an app, the bigger decision comes at the Assignments step. These are the three you’ll use most.

Assignment	What happens	I use it for
Required	Intune installs it automatically on targeted users or devices.	Company Portal, security tools, VPN clients, Microsoft 365 Apps
Available for enrolled devices	Users install it themselves from Company Portal.	VLC, PowerToys, optional utilities, departmental tools
Uninstall	Intune removes it from targeted users or devices.	Retiring software, or tidying up after Dave

If a user removes a Required app, Intune reinstalls it within 24 hours rather than waiting for the normal 7 day re-evaluation cycle. Required is for “this device needs this app”, not for “Dave might fancy VLC one afternoon”.

User assignment or device assignment?

A user assignment follows the person, and a device assignment follows the laptop. An optional tool like VLC suits a user-based Available assignment, while a security agent that must exist whoever signs in suits a device-based Required one.

Assignment target and install context are related but separate. A Win32 app assigned to a user group can still install in System context, which is usually what you want for machine-wide software.

How to deploy Windows apps with Microsoft Intune in 7 steps

Each step below is one app type, in roughly the order I’d check them for a new app. All seven start from Apps > All Apps > Create.

Step 1: Microsoft Store app (new) with VLC

If an app is already in the Microsoft Store, this is where I look first. There’s no installer to download, nothing to wrap and no detection rule to research.

1. Select Microsoft Store app (new) from the Select app type pane.
2. Select Search the Microsoft Store app (new) and search for the app. I used VLC UWP from VideoLAN.
3. Check the prefilled Name, Publisher, Package identifier and Installer type. Mine said UWP.
4. Choose the Install behavior: System or User.
5. Assign it. I made VLC Available for enrolled devices to a user group, so people install it from Company Portal.

Check the Installer type rather than assuming. Store apps can be UWP or Win32, and Win32 apps in Microsoft Store app (new) are still in preview, so label them clearly in your documentation.

You may still see Microsoft Store app (legacy) in the list. It belongs to Microsoft Store for Business and Education, which retired on 31 March 2023, and it only hangs around so older apps can still be managed.

Feature	Store app (legacy)	Store app (new)
Search the Store from Intune	No	Yes
Required and Uninstall assignments	No, Available only	Yes
Install status monitoring	Limited	Yes
Win32 apps from the Store	No	Yes, in preview
System or User context	No	Yes, for UWP apps
Use for new deployments	No	Yes

Store apps keep themselves updated, as long as you haven’t enabled the Turn off Automatic Download and Install of updates policy. Paid apps and apps with ARM64 installers aren’t supported.

I’d still package the same app as Win32 if I needed custom switches, a config file, dependencies or supersedence. The easiest method isn’t always the right one.

Step 2: Microsoft 365 Apps

Microsoft 365 Apps has its own app type, so you never have to treat Office like a random Win32 package. Under the Microsoft 365 Apps heading, select Microsoft 365 Apps for Windows 10 and later.

Then configure the app suite with the configuration designer, or upload your own Office Deployment Tool XML if you already have one.

Setting	What to choose
Apps	Excel, OneNote, Outlook, PowerPoint, Teams, Word. Untick anything you don’t license or need.
Architecture	64-bit, unless an elderly add-in insists on 32-bit.
Update channel	Whichever matches your change process. Current Channel moves fastest; the Enterprise channels move more slowly.
Remove other versions	Yes, if any MSI-based Office is still lurking.
Shared computer activation	Only for shared or multi-user devices.

Publisher still appears for now, but it retires on 13 October 2026 and leaves Microsoft 365. Finally. Leave it unticked on new deployments and get those .pub files converted.

Try to land the install when Office isn’t open. If Word is running when Intune installs the suite, the install can fail and unsaved work can go with it. Full details are in Add Microsoft 365 Apps to Windows devices (Microsoft Learn).

Step 3: Microsoft Edge

Edge has a dedicated type too. Under the Microsoft Edge, version 77 and later heading, select Microsoft Edge for Windows 10 and later, pick a channel and assign it.

Channel	Good for
Stable	Almost everyone. Updates every four weeks.
Beta	A pilot ring for IT and keen early adopters.
Dev	People who enjoy surprises. Updates weekly.

Intune installs Edge in System context, with automatic updates on by default. If a user-context Edge already exists, the system install replaces it.

Deployment answers “is Edge installed?” and configuration answers “how should Edge behave?”. Handle the second with Microsoft Edge settings in the settings catalog, not by repackaging the browser.

Removing the assignment doesn’t remove Edge. Intune only uninstalls it with an Uninstall assignment, and only if Intune installed it in the first place through that same deployment.

Step 4: Windows web link with Redact Ninja

Not every app needs an installer. Sometimes the app is a website, and wrapping a website in an EXE so it feels more official is a cry for help.

1. Select Windows web link.
2. Enter a Name, Description and Publisher.
3. Enter the App URL. Mine was https://redactninja.com/.
4. Add a category and logo so it looks the part in Company Portal, then assign it.

It suits HR portals, helpdesk systems, SaaS tools and internal web apps. Users find them in Company Portal instead of hunting for a link in an email from 2019.

There’s also a plain Web link type, which is cross-platform. For a Windows-only catalogue, Windows web link is the clearer fit.

Step 5: Line-of-business app with Audacity

Line-of-business (LOB) is the older, simpler upload model. Select Line-of-business app, upload the file, and Intune reads the details from the package.

Windows LOB apps accept .msi, .appx, .appxbundle, .msix and .msixbundle files. In my lab I uploaded the Audacity 4.0 MSI, and Intune filled in most of the app information from the installer.

LOB is fine for a simple MSI with no dependencies, no special requirements and standard detection. You own updates, so each new version means uploading a new file.

Use LOB when	Use Win32 when
The MSI is simple and well behaved	You need custom detection rules
Built-in installer metadata is enough	You need dependencies or supersedence
No scripts or requirement rules	You need requirement rules or scripts
It isn’t installing during Autopilot alongside Win32 apps	Other Win32 apps install during Autopilot

Step 6: Windows app (Win32) with WinRAR

Win32 is where Intune app deployment gets powerful, which is another way of saying Intune expects you to tell it a lot more. You package the installer, give it silent commands, describe how to detect it, and optionally add requirements, dependencies and supersedence.

For my lab I used WinRAR, with the installer winrar-x64-723.exe.

Find the silent install switch

A person clicks Next, Next, Agree, Install, Finish. Intune can’t, so the installer needs an unattended switch. WinRAR uses /S, and the capital S is very important.

Installer frameworks can’t agree on anything: NSIS uses /S, Inno Setup uses /SILENT or /VERYSILENT, and MSI uses /qn. Silent switches also have a gift for staying the same for ten years, then changing the week you automate them.

Good vendors document their switches, and the Exampad+ IT admin guide is what every software maker should provide. When the vendor goes quiet, I check this silent install cheat sheet on GitHub for clues.

Then test the command by hand from an elevated PowerShell prompt before Intune ever sees it:

$p = Start-Process -FilePath '.\winrar-x64-723.exe' -ArgumentList '/S' -Wait -PassThru
$p.ExitCode

Exit code 0 and no wizard means you’re in business. If a window pops up, Intune isn’t going to have a great time with it either.

Package it with the Microsoft Win32 Content Prep Tool

Download the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) and keep it outside your source folder, because it zips everything in that folder into the package. I use this layout:

C:\Packaging\Apps\WinRAR\Source    (installer goes here)
C:\Packaging\Apps\WinRAR\Output    (the .intunewin lands here)

Run the tool with no parameters to be prompted, or do it in one line:

IntuneWinAppUtil.exe -c C:\Packaging\Apps\WinRAR\Source -s C:\Packaging\Apps\WinRAR\Source\winrar-x64-723.exe -o C:\Packaging\Apps\WinRAR\Output -q

The output is winrar-x64-723.intunewin, which is the format Intune needs for a Win32 app. Use the latest version of the tool, or Intune warns you the package was built with an older one. More detail is in Prepare Win32 app content for upload (Microsoft Learn).

Add the app and set the commands

Select Windows app (Win32), upload the .intunewin file and fill in the app information.

Then set the Program step. These are my WinRAR values:

Setting	WinRAR lab value
Installer type	Command line
Install command	winrar-x64-723.exe /S
Uninstall command	"C:\Program Files\WinRAR\Uninstall.exe" /S
Allow available uninstall	No
Install behavior	System
Device restart behavior	Determine behavior based on return codes

Fix the uninstall command

The fix is the full path, in quotes because of the space in Program Files:

"C:\Program Files\WinRAR\Uninstall.exe" /S

Environment variables such as %ProgramFiles% aren’t expanded in the uninstall command, so write the path out in full. For MSI-based apps, use the product code instead:

msiexec /x "{PRODUCT-GUID}" /qn

System or User install behaviour

System installs in the device context with admin rights, so users don’t need to be local administrators. That’s what I use for machine-wide software like WinRAR.

User installs in the signed-in user’s context, for apps built to live in a user profile. Don’t pick User just because the assignment is user-based, because an installer that needs admin rights will simply fail.

Detection rules: how Intune knows it worked

Intune doesn’t take the installer’s word for it. After the install, it checks a detection rule to prove the app is actually there.

Setting	WinRAR lab value
Rules format	Manually configure detection rules
Rule type	File
Path	C:\Program Files\WinRAR
File or folder	WinRAR.exe
Detection method	File or folder exists
Associated with a 32-bit app on 64-bit clients	No

You can also detect by MSI product code, registry key or a custom PowerShell script. A script counts as detected when it exits with 0 and writes something to STDOUT.

A perfect install with a wrong detection rule is still a failed deployment. Intune can’t find what you told it to look for, reports Failed (often 0x87D1041C) and may try again later, while the user happily carries on using the app.

Requirements, dependencies and supersedence

Feature	What it does	Example
Requirements	Only installs where the device qualifies: architecture, minimum OS, disk space, memory, or a script.	Skip devices that could never run the app
Dependencies	Installs other Win32 apps first, even if they aren’t assigned.	A runtime before the app that needs it
Supersedence	Updates or replaces an older Win32 app.	WinRAR 7.23 replaced by a newer build

Supersedence is one of the main reasons I choose Win32 for apps that need proper lifecycle management. Turn on Uninstall previous version to replace an app, or leave it off when the new installer upgrades in place.

Pair supersedence with Auto-update on an Available assignment and Company Portal users get the new version without lifting a finger. Dependencies must be Win32 apps too, so an MSI LOB or Store app can’t be one. The full rules are in Add Win32 app supersedence (Microsoft Learn).

Step 7: Enterprise App Catalog with Visual Studio Code

After all that Win32 work, the Enterprise App Catalog is a pleasant contrast. It’s a Microsoft-hosted collection of prepackaged Win32 apps, Microsoft and third-party, with install commands, requirements and detection rules already prepared.

1. Select Enterprise App Catalog app.
2. Select Search the Enterprise App Catalog, find the app (I used Visual Studio Code) and select Next.
3. Pick the package by name, language, architecture and version.
4. Review the prefilled Program, Requirements and Detection steps, then assign it.

Enterprise App Management, the feature behind the catalogue, isn’t part of Intune Plan 1. From July 2026 it’s included in Microsoft 365 E5 and E7 (rolling out gradually); otherwise you need the Intune Suite or the standalone add-on.

The catalogue removes packaging work, not testing. You still check the version, test the install, choose assignments and own the outcome, because you’re responsible for making sure catalogue apps meet your requirements. Sadly, clicking Deploy still doesn’t transfer the blame to Microsoft and let you go home early.

Stage the rollout with deployment plans (preview)

Intune now has deployment plans, in public preview, for rolling out apps in rings instead of all at once. You’ll find them under Devices > Manage devices > Deployments.

A deployment plan is a reusable template of rings, groups and timing, and a deployment applies it to one Win32 or Enterprise App Catalog app. Rings activate at least an hour apart, and you can pause, resume or cancel the rollout.

For apps, only Required intent is supported, not Available or Uninstall. It’s ideal for pushing a new WinRAR to IT first and the head teacher’s office last. See Deployment plans and deployments in Microsoft Intune (Microsoft Learn).

Which method should you choose?

When someone hands me a new application, I work down this list and stop at the first answer that fits:

1. Is it just a website? Use Windows web link.
2. Is it Microsoft 365 Apps or Edge? Use the dedicated Microsoft app type.
3. Is it in the Microsoft Store, and does the Store version suit you? Use Microsoft Store app (new).
4. Do you have Enterprise App Management, and is it in the catalogue? Use Enterprise App Catalog.
5. Is it a simple MSI or MSIX with no special needs? A line-of-business app may be enough.
6. Does it need custom switches, detection, requirements or dependencies? Package it as Windows app (Win32).

The order keeps the amount of packaging I own to a minimum. Less custom packaging means fewer detection rules, fewer switches and fewer things to break next year.

So should you make every app Win32? No. Win32 is powerful, and power comes with maintenance: if VLC is in the Store, building folders and detection rules for it buys you nothing. Equally, the Enterprise App Catalog won’t cover bespoke or internal software, so Win32 skills aren’t going anywhere.

Company Portal: your self-service app catalogue

Not every app needs forcing onto every machine. Available assignments put apps in Company Portal, where users install them when they need them.

Required (everyone gets it)	Available (people choose)
Microsoft 365 Apps	VLC
Security and VPN tools	PowerToys
Company Portal itself	Visual Studio Code
Core business apps	Audacity

Once you publish more than a handful, create app categories under Apps > App categories (Productivity, Development, Media, Utilities) and mark a few apps as featured. A little organisation makes Company Portal feel like a deliberate service rather than someone emptying the software cupboard onto the floor.

Prove it worked: monitoring your deployments

Deployment isn’t finished when you click Create. Go to Apps > All Apps, select the app and check Device install status and User install status.

Status	Meaning
Installed	Intune detected the app on the device.
Not Installed	The app isn’t present.
Failed	The install or the detection rule failed.
Install Pending	The install is in progress.
Not Applicable	The device didn’t meet the requirements.

For a view of what is actually installed across your fleet, managed by Intune or not, see my guide to Microsoft Intune App Inventory.

Troubleshooting Win32 app deployments

When an app fails, resist the urge to delete it and start again. Work through the chain instead:

1. Assignment. Is the user or device actually in the targeted group, and not caught by an exclusion?
2. Install context. Does System or User match how the installer works?
3. Install command. Does it run silently when you test it by hand?
4. Requirements. Does the device meet the architecture, OS and disk space rules?
5. Detection rule. Does the file, registry key or product code match reality?
6. Dependencies. Did a dependent app fail first?
7. Logs. Read the Intune Management Extension logs on the device.

IME logs live in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. These are the ones I open first:

Log	What it tells you
AppWorkload.log	Win32 app check-ins, downloads, installs, applicability and detection.
AppActionProcessor.log	Detection and applicability checks.
IntuneManagementExtension.log	The main IME log: check-ins and policy processing.
AgentExecutor.log	PowerShell script executions.

To watch an install as it happens, tail the app log in PowerShell:

Get-Content -Path 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log' -Tail 50 -Wait

The IME checks in for new Win32 apps every 8 hours. In a lab, open Company Portal and select Settings > Sync to hurry it along, then go and make a cup of tea.

Updating and uninstalling apps

How you update and remove an app depends on how you deployed it, so think about it before you choose the method. The easiest installer today can become the most maintenance next year.

App type	Lab app	Updates	Removal
Microsoft Store app (new)	VLC	The Store keeps it current	Uninstall assignment
Microsoft 365 Apps	Microsoft 365 Apps	Your update channel	Uninstall assignment
Microsoft Edge	Edge	Edge auto-updates	Uninstall assignment, if Intune installed it
Windows web link	Redact Ninja	The website owner	Remove the assignment
Line-of-business app	Audacity MSI	Upload each new version	Uninstall assignment
Windows app (Win32)	WinRAR	New package plus supersedence	Uninstall assignment, using your uninstall command
Enterprise App Catalog app	Visual Studio Code	Supersedence or auto-update	Uninstall assignment, using the prepared command

Deploy Windows apps with Microsoft Intune gotchas

Install and uninstall on the same group. The install wins and the app stays. Check assignments before blaming Intune.

Entra registered devices. Store apps set to User context fail from Company Portal on Microsoft Entra registered devices. Use System.

Edge left behind. Unassigning Edge leaves it installed. Use an Uninstall assignment instead.

Environment variables. They aren’t expanded in the Win32 uninstall command. Use full paths, or wrap the command in a script inside the package.

Antivirus scanning. Exclude the IME content folders (on x64, C:\Program Files (x86)\Microsoft Intune Management Extension\Content and C:\Windows\IMECache) from antimalware scans, or installs can fail in odd ways.

Supersedence targeting. A superseding app isn’t targeted automatically. Assign it, or the agent ignores it.

Win32 Store apps. They’re still in preview, and the publisher hosts the content, so check firewall requirements with the vendor.

Should you deploy Windows apps with Microsoft Intune this way?

Yes, with the right tool for each app. VLC doesn’t need the same treatment as WinRAR, Microsoft 365 Apps shouldn’t be packaged like Audacity, and a website doesn’t need an installer at all.

The useful skill isn’t memorising where every Intune button lives. It’s asking where the app comes from, how it installs, who needs it, how Intune will detect it, how it updates and how you’ll prove it worked.

And if you find yourself writing a 300-line PowerShell wrapper for an app that’s already in the Microsoft Store, close VS Code and make a cup of tea first.

Deploy Windows apps with Microsoft Intune FAQs

Further reading

• Add Microsoft Store apps to Microsoft Intune (Microsoft Learn)
• Add, assign and monitor a Win32 app in Microsoft Intune (Microsoft Learn)
• Microsoft Intune Enterprise Application Management (Microsoft Learn)
• Troubleshoot Win32 app issues (Microsoft Learn)
• How to set up Microsoft Intune App Inventory
• Intune Remediations: fix problems before users notice
• How to block personal Windows devices in Intune

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.