# Deploying Applications with Intune

> Chapter 11 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/deploying-applications-intune

**Official objective:** 3.1 — Deploy applications to managed devices using Intune

## Introduction

Deploying applications with Microsoft Intune solves the problem of managing software on hundreds or thousands of company devices without ever touching them. Instead of IT staff visiting each computer to install software, Intune lets you push applications out from the cloud to every device automatically. For the MD-102 exam, understanding how to create, assign, and monitor these application deployments is a core skill you must master.

## The Department Store Kit Assembly Analogy

The back stockroom of a large department store, just before the holiday rush. 

The store manager needs to get 500 new display tables assembled and placed on the sales floor. Each table comes in a flat box with a manual (the application package). Some tables are simple, needing just a screwdriver (a standard installer). Others are complex, requiring a custom tool (a script or a specific configuration) to avoid wobbling. The manager has a team of assemblers (the IT department and the devices themselves). In the old way, the manager would hand each assembler a stack of manuals and a box of tables, and they'd work independently at their own stations (doing everything manually for each computer). 

Now, the manager uses a new system. He creates a 'master plan' (the Intune deployment policy) that specifies exactly which table model goes to which department (device group) and when. He uploads the digital assembly manuals and tool instructions to a central app (Intune). The assemblers' smart scanners (the Intune management agent on each device) automatically check the plan. When a scanner sees 'Floor model, blue, to Electronics section' (policies targeting a specific device group), it downloads the correct manual and directs the assembler to build that table right now. If a table needs a special bolt that's missing, the scanner halts the build and reports back to the manager's dashboard 'There's an issue with the blue table's leg' (a failed deployment report). The manager can then update the manual for that one table online, and the scanner on the floor will download the fix and resume assembly without anyone walking over to the assembler. The new system ensures every table is built identically, to the correct specifications, and any problems are instantly visible in the central planning office.

## Core explanation

Intune is a cloud-based service, meaning it runs on Microsoft's servers on the internet, not on a computer in your office. Its job is to help you manage company devices: laptops, phones, and tablets. One of the most powerful things it does is let you install software—applications—on those devices without needing to be there in person. This is called 'deploying applications'.

Let us break down the basic terms. An 'application' (often just called an 'app') is any piece of software you want to run on a device, like Microsoft 365, Adobe Reader, or a company-specific tool. A 'managed device' is any phone, tablet, or computer that is registered with Intune and follows your company's rules. 'Deploying' simply means sending that software to those managed devices.

Why does this matter? In the past, IT staff would have to physically go to each computer, put a CD or USB drive in, and run the installer. If a company had 1,000 computers, that was a huge job. Intune replaces this manual, time-consuming process with an automated one.

Here is how it works at a high level:

First, you need to prepare the application for deployment. This usually means getting an installation file. For Windows computers, this is often an .exe or .msi file. An .msi file is a special installer that Windows understands natively. For phones, it might be an .apk for Android or an .ipa for iOS. This file is called the 'app source' or 'package'.

Second, you upload this package into Intune. Intune stores it in the cloud. You then configure 'deployment settings'. These settings include:

- 'Required' – The app is automatically installed on the device. The user cannot skip it.
- 'Available' – The app shows up in the Company Portal (a special app on the device where users can install approved software). The user can choose to install it.
- 'Uninstall' – Intune will remove the app from the device.

You also assign the app to 'groups'. Groups are collections of users or devices. For example, you might create a group called 'Sales Team' and assign the Sales CRM app to that group. Only users in that group will get the app. You can also target groups of devices, like 'All Windows 11 Laptops'.

Once assigned, Intune sends a signal to the device. The device will check in, often automatically, and see that a new app is required. It then downloads the package from the Intune cloud and runs the installer in the background. The user might see a notification, but they usually do not need to do anything.

Intune also reports on the deployment. You can see if the app installed successfully on 98% of devices and failed on 2%. You can investigate the failures and fix them, perhaps by updating the application package or checking why a specific device model cannot install it. This reporting dashboard is crucial for IT staff to know if their work is actually doing what they intended.

There are different 'deployment types' you need to know for the exam. The most common are:

- 'Line-of-business (LOB) apps' – These are apps you have built yourself or obtained privately. You upload the installer directly to Intune.
- 'Microsoft Store apps' – These are apps from the Microsoft Store. Intune can integrate with the store to deploy these apps without you having to download the package yourself.
- 'Web apps' – These are links to websites. They do not install software; they just add a shortcut on the device that opens a specific webpage.
- 'Android and iOS store apps' – You link to the app in the Google Play Store or Apple App Store.

Finally, a key concept is 'application wrapping'. For some types of apps, especially older Windows software, you might need to wrap the installer in a special tool called the 'Microsoft Win32 App Packaging Tool'. This prepares it so Intune can manage it properly. Another key tool is 'Microsoft Intune Management Extension'. This is a helper program that sits on Windows devices to allow Intune to run complex installers and scripts.

## Real-world context

Sarah is the IT administrator for a mid-sized company with 500 employees. Everyone uses a company-issued Windows laptop. The HR department has just bought a new time-tracking application called 'TimeWise Pro'. The vendor sent Sarah a single .msi file.

Sarah's first step is to log into the Intune admin centre, which is a website at 'intune.microsoft.com'. She clicks on 'Apps' and then 'All apps'. She clicks 'Add' to create a new deployment. A screen asks her what type of app it is. She selects 'Windows app (Win32)' because that works with the management extension and supports modern features. She uploads the TimeWise Pro .msi file.

Next, Sarah fills out the 'App information' section: name, description (Time tracking for HR), and publisher. Then she sets the 'Install command'. This is the exact text the computer will run to install the app. The vendor documentation says to use 'msiexec /i "TimeWisePro.msi" /quiet /norestart'. This command tells Windows to run the installer silently (no pop-ups) and not restart the computer. She also sets an 'Uninstall command' so she can remove it later if needed.

Now, Sarah must assign the app. She clicks 'Assignments'. She chooses 'Required' for the 'All HR Users' group, which she already created in Microsoft Entra ID (the central directory of people and groups). She sets a deadline: 'Install by tomorrow at 5 PM'. This means the app must be installed on every HR user's laptop by that time. She also sets 'Available' for the 'All Users' group, so any employee can optionally install the app from the Company Portal if they want.

Sarah clicks 'Review + create' and then 'Create'. The deployment is now live. Over the next few hours, each HR user's laptop checks in with Intune. The laptop sees the new required app, downloads the .msi file, and runs the silent install command. The user might see a small spinning icon in the system tray for a moment, but otherwise, the app just appears on their start menu.

The next day, Sarah checks the 'App install status' report. She sees 48 of 50 devices installed successfully. Two devices are marked 'Failed'. She clicks on them to see the error code. The error says 'Another installation is already in progress'. Sarah realises those two users were actively in a Zoom meeting when the install tried to run. Intune will automatically retry the installation later. She also notices that a new laptop joined the company today and was automatically enrolled in Intune. Within an hour, TimeWise Pro was installed on that laptop too, without any extra work from Sarah. This is the power of app deployment with Intune.

## Exam focus

The MD-102 exam tests your understanding of how to set up, configure, and monitor application deployments in Intune. It is not a purely theoretical test; you need to know the practical steps and the exact names of settings.

Here are the specific concepts the exam loves to test:

- The difference between 'Required', 'Available', and 'Uninstall' assignments. A common question will describe a scenario: 'Users in the Sales group must have the CRM app installed automatically. What assignment type should you use?' The correct answer is 'Required'. A trap is they might offer 'Available', which lets users choose, not force the install.
- The purpose of 'Enrollment Groups' vs 'Device Groups'. Enrollment groups control which devices are auto-enrolled into Intune when a user signs in with a work account. Device groups are what you assign apps to. You must know the distinction.
- How to specify the 'Install command' and 'Uninstall command' correctly. The exam may give you an installation command that uses '\quiet' instead of '/quiet'. You need to spot the correct syntax.
- The application 'detection rules'. This is how Intune knows if the app is already installed so it does not try to install it again. The simplest rule is checking if a file exists at a certain path (e.g., 'C:\Program Files\TimeWise\TimeWise.exe'). The exam will ask you to choose the best detection method for a given app.
- The difference between 'Line of Business (LOB)' apps and 'Microsoft Store' apps. A scenario might ask: 'You have an app that is available in the Microsoft Store. How should you deploy it?' The correct answer is to use the Microsoft Store app type, not a LOB upload.
- The use of 'scope tags'. Scope tags let you limit which administrators can see and manage specific apps. The exam might present a scenario where one admin should only manage apps for the Finance team. You would create a scope tag named 'Finance' and assign it to the admin and the Finance apps.
- Common deployment errors and how to fix them. A question might give you an error like 'The application was not installed because the device is in kiosk mode'. You need to know that kiosk mode devices have restrictions that can block app installs.
- The role of the 'Company Portal'. The exam may test that users install 'Available' apps from the Company Portal, and they can also restart their device or check compliance there.

Trap patterns to watch for:
- Confusing 'device groups' with 'user groups'. Assignments can target either. If the app needs to be installed before any user signs in, you must target a device group. If it can wait for a user session, a user group is fine.
- Forgetting that 'Available' assignments still require the user to install the app themselves. The exam will test that you know 'Available' does not mean automatic installation.
- Mixing up app types. A .msi file is a Win32 app, not a Microsoft Store app. You need to know the correct app type for different file extensions (.msi, .exe, .appx, .apk, .ipa).

Key definitions to memorise:
- 'Install intent': The desire to have an app installed (Required, Available, Uninstall).
- 'Detection rule': How Intune checks existing installations.
- 'Administrative Template': A way to configure app settings using group policy-like settings in Intune.

## Step by step

1. **Prepare the Application Package** — Obtain the installation file (e.g., .msi, .exe, .apk) and determine the correct install and uninstall commands from the vendor documentation. For complex .exe files, you may need to package them using the Microsoft Win32 App Packaging Tool.
2. **Add the Application to Intune** — In the Intune admin centre, navigate to Apps > All apps > Add. Select the correct app type (Windows app, Android store app, etc.). Upload the package and fill in details like name, description, and publisher. This creates a digital copy in the Intune cloud.
3. **Configure Detection Rules** — Set up a detection rule, such as checking for a specific file path or registry key. This tells Intune if the app is already installed, preventing duplicate installations and confirming successful installation.
4. **Assign the Application to Groups** — Choose the assignment type (Required, Available, Uninstall) and target specific Microsoft Entra ID user groups or device groups. Set a deadline for required installations. This step specifies who gets the app and when.
5. **Review and Create the Deployment** — Review all settings on the final summary page, then click 'Create'. Intune processes the deployment and begins checking devices to apply the policy. The deployment is now live but not instant.
6. **Monitor Deployment Status** — Go to Apps > All apps > select the app > Device install status. Review the report for success and failure percentages. For failures, click into the device to see error details and troubleshoot remotely.

## Comparisons

### Required Assignment vs Available Assignment

**Required Assignment:**
- App is automatically installed on the device without user action.
- User cannot skip or uninstall the app (if configured as mandatory).
- Used for critical business apps that everyone must have.

**Available Assignment:**
- App appears in the Company Portal for the user to install voluntarily.
- User chooses when or if to install the app.
- Used for optional tools or applications that users may not need.

### Line-of-Business (LOB) App vs Microsoft Store App

**Line-of-Business (LOB) App:**
- You upload the app package directly from a file (.msi, .exe, etc.).
- You manage the entire lifecycle, including updates, manually.
- Suitable for custom or proprietary company software.

**Microsoft Store App:**
- You link to an app that exists in the Microsoft Store.
- Updates are handled by the Microsoft Store automatically.
- Best for standard apps like Office, Teams, or Adobe Reader.

### User Group Targeting vs Device Group Targeting

**User Group Targeting:**
- App is assigned based on the user identity, not the specific machine.
- App installs after the user signs in on the device.
- Useful when multiple users share a device and need different apps.

**Device Group Targeting:**
- App is assigned based on the device identity, regardless of who signs in.
- App can be installed before any user signs in, useful for pre-provisioning.
- Best for shared devices or kiosk scenarios.

## Diagram

_This diagram shows the step-by-step flow of deploying an application from the Intune admin centre to a managed device._

```mermaid
flowchart TD
    A[Intune Admin Centre] -->|Add App| B(Application Package)
    B --> C{Detection Rules}
    C --> D[Assign to Group]
    D --> E[Device Check-in]
    E --> F[Install on Device]
    F --> G{Success?}
    G -->|Yes| H[Deployment Report: Success]
    G -->|No| I[Deployment Report: Failure]
    I --> J[Review Error Logs]
    J --> K[Update App or Retry]
```

## Common misconceptions

- **Misconception:** When I deploy an app as 'Available', it will automatically install on the users' devices. **Reality:** An 'Available' deployment only makes the app visible in the Company Portal for users to install themselves. It is not automatic. For automatic installation, you must use the 'Required' assignment. (The word 'Available' sounds like the app is available to be used, leading beginners to think it will appear automatically. In reality, it only means the user can choose to install it.)
- **Misconception:** I can deploy any .exe file to a Windows device without any extra preparation. **Reality:** Intune cannot natively handle all .exe files. You often need to package them using the Microsoft Win32 App Packaging Tool, especially if require detection rules or complex install commands. (People are used to double-clicking .exe files to install them, so they assume Intune can just 'run' them. Intune needs structured installation information to manage the app lifecycle.)
- **Misconception:** Intune will install the app immediately after I click 'Create' in the admin centre. **Reality:** Deployments are asynchronous. The device must check in with Intune to receive the policy. This check-in frequency can be every few hours or can be forced by the user via the Company Portal or Settings. It is not instant. (The admin centre interface gives a feeling of instant action. Beginners expect cloud commands to execute in real-time, but Intune works on a polling model where devices pull commands when they check in.)
- **Misconception:** If an app deployment fails on a device, I must visit that device to fix it. **Reality:** You can often fix failures remotely. You can check the error logs, update the app package in Intune, assign a new version, or use a script to uninstall the faulty version, all from the admin centre. (IT in the past required physical access. The 'cloud first' approach of Intune removes the need for on-site visits for most software issues. Beginners often do not realise the power of remote troubleshooting.)
- **Misconception:** Deploying a web app installs a program on the device. **Reality:** A web app deployment only creates a shortcut to a website on the device's start menu or app list. It does not install any software. (The name 'web app' is misleading. Beginners think it is an actual application, but it is just an easier way to give users quick access to company websites.)

## Key takeaways

- Intune application deployment allows you to install software on company devices without physical access, using 'Required', 'Available', or 'Uninstall' assignment types.
- The 'Install command' and 'Uninstall command' must be precise, as Intune executes these exact strings to manage the app lifecycle on the device.
- Detection rules are essential for preventing reinstallation and for confirming whether deployment succeeded or failed.
- App types include Line-of-Business (LOB), Microsoft Store, web links, and store-specific types for Android and iOS.
- Scope tags give you granular control over which admins can see and manage specific groups of applications.
- Devices check in with Intune periodically; deployments are not instant and may take several hours to apply.

## FAQ

**How long does it take for Intune to install an app on a device?**

It depends on the device's check-in schedule, which is usually every 8 hours by default. You can trigger a manual sync from the device or use a compliance policy to force a faster check-in.

**Can I deploy an app to a user who does not have a Microsoft 365 license?**

Yes, Intune licenses are separate for the device itself. The user only needs an Intune license if you want to manage user-based policies. Apps can be deployed to devices regardless of the user's M365 license.

**What happens if an app deployment fails on some devices?**

Intune logs the error and retries automatically. You can view the error details in the admin centre, update the app package, or use a script to fix the issue remotely. You do not need to visit the device.

**Can I deploy an app from the Microsoft Store without uploading anything?**

Yes, you can use the 'Microsoft Store app (new)' or 'Microsoft Store app (legacy)' type in Intune. You search for the app in the store and link it directly, so you do not need to handle the installation file yourself.

**What is the difference between a 'device group' and a 'user group' for app assignments?**

A device group is a collection of specific computers or phones. A user group is a collection of people. If you want the app installed before a user signs in, target a device group. If the app can wait for the user session, use a user group.

**Can I deploy apps to iPhone or Android phones through Intune?**

Yes, Intune supports iOS and Android. For iPhones, you link to the app in the Apple App Store. For Android, you link to the Google Play Store or upload an .apk file as a LOB app. The device must be enrolled in Intune.

## Check your understanding

1. **What is the primary difference between a 'Required' and an 'Available' application assignment?**

   Answer: A 'Required' assignment automatically installs the app on the device, while an 'Available' assignment makes the app visible in the Company Portal for the user to install manually.

2. **What must you configure to prevent Intune from trying to install an app that is already present?**

   Answer: You must configure a detection rule, such as checking for a specific file path or registry key, so Intune can verify if the app is already installed.

3. **Which app type would you choose to deploy a custom .msi file that your company built?**

   Answer: You would choose the 'Windows app (Win32)' or 'Line-of-business' app type, depending on whether you need the Microsoft Intune Management Extension capabilities.

4. **How does Intune handle app deployment to a device that is offline?**

   Answer: Intune does not push commands instantly; the device must check in. When the device comes online and performs its scheduled check-in, it will receive and execute the deployment policy.

5. **What is the purpose of the Company Portal?**

   Answer: The Company Portal is an app on the device where users can install 'Available' applications, view their device compliance status, and contact IT support.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/deploying-applications-intune