Month 5: Apps for every paw

App types

Microsoft Store app (new): Store apps installed through WinGet. Win32: any installer (EXE, MSI, scripts) wrapped as an .intunewin file. Line-of-business (LOB): a single MSI, MSIX/APPX, iOS .ipa or Android .apk. Microsoft 365 Apps and Microsoft Edge have their own app types. iOS store and Managed Google Play apps come from the stores. Enterprise App Catalog apps arrive prepackaged.

Exam tip Installer with extra files, custom switches, dependencies or detection needs = Win32. Single plain MSI with no extras = LOB is possible.

Packaging a Win32 app

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) against the setup folder to produce a .intunewin file. In Intune, set the install and uninstall commands, install behavior (System or User), return codes, requirements (OS, architecture, disk space), and a detection rule that proves the app is installed (MSI product code, file, registry or script).

IntuneWinAppUtil.exe -c C:\src\label
  -s labelsetup.exe -o C:\out

Install:   labelsetup.exe /S
Detection: file exists
  C:\Program Files\Kibble\Label\
  label.exe  version >= 4.2.0

Exam tip Return codes: 0 success, 3010 soft reboot, 1641 hard reboot, 1618 retry (another install running).

Dependencies, supersedence and assignments

A Win32 app can have dependencies (install the runtime first) and supersedence (replace or update an older version). Assign with an intent: Required (installs automatically), Available for enrolled devices (users install from Company Portal) or Uninstall. Use groups and filters like any policy.

Exam tip "Users choose when to install" = Available in Company Portal. "Must be on every PC" = Required.

Deploying Microsoft 365 Apps

Intune's Microsoft 365 Apps (Windows 10 and later) app type lets you pick apps, 64-bit, update channel (Current, Monthly Enterprise, Semi-Annual Enterprise) and languages with the configuration designer, or paste a configuration XML. The other route is the Office Deployment Tool (ODT): setup.exe plus your XML, wrapped as a Win32 app, which gives you detection rules and return codes.

<Configuration>
 <Add OfficeClientEdition="64"
  Channel="MonthlyEnterprise">
  <Product ID="O365ProPlusRetail">
   <Language ID="en-us" />
  </Product>
 </Add>
</Configuration>

Exam tip In classic Autopilot, Win32-wrapped ODT avoids the LOB-plus-Win32 collision. Block the ESP on it only if users truly need Office at first sign-in.

Policies for Microsoft 365 Apps

Office settings (macros, add-ins, privacy, save locations) can come from Intune: settings catalog with the Office ADMX settings, or Apps > Policies for Microsoft 365 apps, which uses the Cloud Policy service. The Microsoft 365 Apps admin center (config.office.com) adds cloud policy configurations, servicing profiles that manage update rollout, and inventory and security update status.

Exam tip Cloud Policy applies by user, even on unmanaged devices where the user signs in to Office. Intune device policies need enrolled devices.

Store apps for Apple and Android

Apple: buy licenses in Apple Business Manager > Apps and Books, download the location (VPP) token and upload it to Intune. Synced apps then assign with device licensing (no Apple Account needed) or user licensing. Android: connect Managed Google Play, approve apps in the embedded store, sync, and assign. Private apps and web links work there too.

Exam tip Renew the Apple VPP token yearly. An expired token is a classic cause of "app won't install" on iPads.

Quiet Time policies

Apps > Quiet Time > Policies mutes Outlook mail and Teams notifications on iOS/iPadOS and Android after work: a Date range (holidays), Days of the week (all day or certain hours), or Non-working time (Teams, using the Working Time integration). You can allow users to change the settings.

Exam tip "Stop work email buzzing staff's phones after hours" = Quiet Time policy, not an app protection policy.

App protection policies

An app protection policy (APP) protects company data inside apps like Outlook, Teams, Edge and OneDrive, on enrolled or unenrolled (BYOD) devices. Data protection: block backup of org data, limit transfer to policy managed apps, restrict cut/copy/paste, encrypt org data, control saving and printing. Access requirements: app PIN or biometrics. Conditional launch: block or wipe on jailbroken or rooted devices, old OS or app versions, or too many PIN attempts.

Exam tip On Android, unenrolled devices need the Company Portal app installed (as a broker) for app protection to apply. No enrollment needed.

Targeting and selective wipe

Target an APP at user groups, for apps on all device types, or only unmanaged or managed devices. Microsoft's data protection framework suggests levels from basic to high. When someone leaves, app selective wipe removes only the org data from the protected apps, leaving the rest of the phone alone.

Exam tip APP applies per user and per app. That's why it works on phones Intune has never enrolled.

Conditional Access for app protection

To make sure only protected apps reach company data, create a Conditional Access policy for iOS and Android with the grant Require app protection policy. The older Require approved client app grant was retired on June 30, 2026: existing policies using it are read-only, and new policies should use only Require app protection policy.

Exam tip Native mail apps can't carry an app protection policy, so this grant blocks them and pushes users to Outlook.

App configuration policies

App configuration policies preset app settings. Managed devices: delivered through the MDM channel to enrolled iOS or Android Enterprise devices, for example Outlook account setup or allowed accounts. Managed apps: delivered through the app protection channel to apps with the Intune SDK, enrolled or not, for example Edge's home page or the Tunnel for MAM keys.

Exam tip Unenrolled phone + preset Edge settings = managed apps policy. Enrolled iPad + preset Outlook account = managed devices policy.

Pick the right app type

Intune deploys many app types. Which one you choose decides how you prepare it.

• Win32 app: any .exe/.msi/.ps1 installer, wrapped into an .intunewin file with the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)
• Line-of-business (LOB): a single .msi, .msix/.appx (Windows), .pkg (macOS), .ipa (iOS) or .apk uploaded as is
• Microsoft Store app (new): picked from the Store through the WinGet catalog, updated automatically
• Microsoft 365 Apps: built-in app type for Office
• Store apps for iOS/Android: from Apple Business Manager (VPP) or managed Google Play
• Web link / web clip: a shortcut to a web app

Preparing a Win32 app

Run IntuneWinAppUtil with the setup folder, the setup file and an output folder; upload the .intunewin; then fill in what Intune needs to manage it.

• Install and uninstall command lines (silent switches, for example msiexec /i app.msi /qn)
• Install behavior: System or User
• Requirements: OS version, architecture, disk space, or a custom script
• Detection rules: MSI product code, file/folder, registry key or a script that proves it installed
• Dependencies (install another app first) and supersedence (replace an older app)
• Return codes (for example 3010 = soft reboot)

Exam tip No detection rule = Intune can't tell the install worked, so it reports failure or keeps retrying.

Assigning it

Assign to groups as Required (installs automatically), Available for enrolled devices (shows in Company Portal) or Uninstall. Use filters to narrow a group (for example only Windows 11 devices). Test with a pilot group first.

Exam tip For most app types, Available goes to user groups only. Exceptions: Win32 apps (and apps for Android Enterprise fully managed/COPE devices) can be Available to user or device groups. Required can go to user or device groups.