Troubleshooting Intune App Installation Failures
A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?
Quick Answer
The answer is to review the Intune management extension logs on the device. This is the correct first step because when a required app assignment shows a failed installation status on a compliant Windows 10 device, the Intune management extension logs contain the granular error codes and execution details needed to pinpoint why the installation failed, such as a missing dependency or a script error. On the Microsoft 365 Endpoint Administrator MD-102 exam, this scenario tests your understanding of the Intune agent-side troubleshooting hierarchy, where local logs take precedence over console checks when device compliance and assignment are confirmed. A common trap is jumping to the Company Portal or re-assigning the app, but required apps bypass the portal entirely. Remember the mnemonic "Logs First, Console Last" to avoid wasting time on irrelevant console settings.
⚠ Common exam trap
Candidates often assume a compliant device means all Intune operations will succeed, overlooking that the Intune management extension is a separate component with its own failure modes unrelated to device compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the Intune management extension logs on the device.
The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the Intune management extension logs on the device.
Why this is correct
Logs will show the specific error.
- ✗
Verify the device compliance policy.
Why it's wrong here
Device is already compliant, so this is not the issue.
- ✗
Check the Company Portal app version.
Why it's wrong here
Required apps install silently, not through Company Portal.
- ✗
Reassign the app to the user.
Why it's wrong here
Assignment is already in place.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are troubleshooting a Windows 11 device that fails to install a required Win32 app deployed via Intune. Which THREE logs or locations should you review?
medium- A.Windows Update log (C:\Windows\WindowsUpdate.log)
- ✓ B.Intune Management Extension logs in %ProgramData%\Microsoft\IntuneManagementExtension\Logs
- ✓ C.The IntuneManagementExtension.log file in the agent directory.
- D.Windows Registry under HKLM\Software\Microsoft\Intune
- ✓ E.Windows Event Logs under Applications and Services Logs > Microsoft > Windows > AppLocker
Why B: The Intune Management Extension (IME) is the agent responsible for processing Win32 app deployments on Windows 11 devices. Its logs, located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs, provide detailed information about the download, detection, and installation phases of Win32 apps, making them the primary source for troubleshooting installation failures.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.