Troubleshooting Intune App Installation Failures
A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?
Quick Answer
The answer is to review the Intune management extension logs on the device. This is the correct first step because when a required app assignment shows a failed installation status on a compliant Windows 10 device, the Intune management extension logs contain the granular error codes and execution details needed to pinpoint why the installation failed, such as a missing dependency or a script error. On the Microsoft 365 Endpoint Administrator MD-102 exam, this scenario tests your understanding of the Intune agent-side troubleshooting hierarchy, where local logs take precedence over console checks when device compliance and assignment are confirmed. A common trap is jumping to the Company Portal or re-assigning the app, but required apps bypass the portal entirely. Remember the mnemonic "Logs First, Console Last" to avoid wasting time on irrelevant console settings.
⚠ Common exam trap
Candidates often assume a compliant device means all Intune operations will succeed, overlooking that the Intune management extension is a separate component with its own failure modes unrelated to device compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the Intune management extension logs on the device.
The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the Intune management extension logs on the device.
Why this is correct
Reviewing the Intune management extension logs reveals why the Win32 app agent failed to install, since that extension handles Win32 app delivery and its local log records specific error codes. This directly satisfies the stem's 'Failed' installation status on an enrolled, compliant device, where compliance is not the blocker.
- ✗
Verify the device compliance policy.
Why it's wrong here
Compliance is already confirmed in the stem, so rechecking the compliance policy cannot explain an installation failure. Compliance gating is tempting because non-compliance blocks app delivery, and verifying it would be the right first step when a device shows as non-compliant rather than merely failed.
- ✗
Check the Company Portal app version.
Why it's wrong here
The Company Portal app version governs the self-service interface, not the Intune Management Extension's installation of a required app, so it cannot cause this failure. Checking it is tempting because an outdated Company Portal can break user-initiated installs, which would make it the right first check in that scenario.
- ✗
Reassign the app to the user.
Why it's wrong here
Reassignment does not address an existing 'Failed' installation state; the assignment already reaches the device, so the failure lies in installation requirements or detection rules. Reassigning is tempting because assignment scope errors do block delivery, and it would be correct if the app were simply not targeted to the user.
Go deeper
Related to this question
Learn chapter
Managing Microsoft 365 Apps and Office Updates
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?
medium- A.Windows Update log (C:\Windows\WindowsUpdate.log)
- ✓ B.Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs
- ✓ C.The IntuneManagementExtension.log file in the agent directory.
- D.Windows Registry under HKLM\Software\Microsoft\Intune
- ✓ E.Windows Event Logs under Applications and Services Logs > Microsoft > Windows > AppLocker
Why B: Option B is correct because the Intune Management Extension (IME) is the agent that actually downloads and installs Win32 apps on Windows 11, and its logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs (notably IntuneManagementExtension.log, AppWorkload.log, and AgentExecutor.log) record the app download, detection, and installation results. Option C is correct because IntuneManagementExtension.log is the primary IME log file that captures the Win32 app processing pipeline, including Win32AppInventory, detection rule evaluation, and installer execution outcomes. Option E is correct because AppLocker event logs under Applications and Services Logs > Microsoft > Windows > AppLocker (e.g., AppLocker/EXE and DLL) can reveal whether an application control policy blocked the Win32 installer or its payload from executing. Option A is not relevant because WindowsUpdate.log records Windows Update and servicing activity, not Intune Win32 app deployment. Option D is not relevant because Win32 app deployment state is not stored in HKLM\Software\Microsoft\Intune; IME data resides under registry keys such as HKLM\SOFTWARE\Microsoft\IntuneManagementExtension and in the IME working directories, and the registry is not the recommended troubleshooting log location.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.