#Manage Tenants

The App management module provides centralized oversight of applications and their available versions, enabling a streamlined app lifecycle from version management to batch application. You can group multiple applications into reusable collections and deploy them to one or many tenants in a single action.

By default, all tenants added to the app management service are listed in the table. You can view the following information of each tenant.

• Tenant – The tenant name. The organization name is displayed below the tenant name. Click a tenant name to drill down to the tenant level and access the Device management > Overview page directly.

• Status – The status of the tenant in this module.

  • Monitoring – The tenant data is scanned, and the data is under monitoring.

  • Expired – The service subscription of the customer has expired.

  • In progress – When you add the User and device management service and consent app for the tenant, this status will appear.

  • Failed – When Elements attempts to update the tenant information at 00:00 UTC but encounters errors, for example, the app required by the User and device management service was not found, this status will appear.

  • Out of policy – The service subscription of the customer is no longer compliant with policy. Service jobs will be suspended after 15 days, and service reports will no longer be updated. After this grace period, service jobs will be paused, and service reports will no longer be updated.

• Apps – The total number of apps within the tenant. Click the number link to access the Apps page where all applicable apps within the tenant are listed.

• App collections – The total number of app collections within the tenant. Click the number link to access the App collections tab of the Apps page where all available app collections of the tenant are listed.

• Apps with new version detected – The number of apps that have an update available. Click the number link to access the Apps page with the corresponding apps listed.

• Last updated time – The last updated time of the tenant.

Click Refresh to view the latest tenant list. Please note that the newly enrolled tenants will be displayed only after the daily sync job is completed.

#Add a Tenant

When you assign the User and device management service to a customer and consent to the app during the process of onboarding the customer or adding services for the customer, the customer’s tenant will be automatically displayed in this module.

If an existing customer has tenants that want to use the functionalities of this module, you can add those tenants to the module.

Refer to the following steps to add a new tenant of an existing customer to the module:

1. On the App management page, click Add tenant in the upper-right corner.

2. Select a customer from the drop-down list.

3. Complete the subscription information for this service:

   • Subscription type – Select the subscription type for this service: Trial or Subscription.

     NOTE

     For Trial, you can assign up to 5 customers, and the subscription expiration date is fixed. This number is calculated among all premium services.

   • Source – Select a value to indicate the source of your subscription.

   • Payment type – Select the payment type.

   • User seats – Select the number of users you want to assign the subscription.

   • Subscription expiration date – By default, Same as pooled subscription is selected to keep the same expiration date as the pooled subscription. You can select Expire now or select Specify a time to set an expiration date for the customer’s subscription.

   • Contract end date – Click the calendar button and select the contract end date.

4. Click Continue.

5. Select a tenant of the customer.

   If there are no available tenants for the customer, you can click Add new tenant. For detailed instructions on how to add a tenant, refer to Add a Microsoft 365 Tenant.

6. If the APElements Security and Analysis app for the tenant has already been consented, a green checkmark icon will appear. Click Save to add the tenant.

   This typically occurs during the process of assigning the User and device management service to a customer and consenting to the app during the process of onboarding customer or adding services.

7. If the APElements Security and Analysis app for the tenant needs to be consented, complete the following steps:

   1. Click Authenticate.

   2. The permissions required for this app are displayed. Review the permissions and click Accept.

   3. A page appears indicating that the app was authorized. Close this page, and you will be redirected back to the Add tenant window.

   4. Click Save to add the tenant.

#Disconnect a Tenant

You can disconnect tenants from this module. Upon disconnection, the tenants will no longer appear in the module pages, and all user management data, device management data, and app management data of these tenants will be permanently deleted.

When a customer’s subscription for the User and device management expires, the functionalities provided by the service will be unavailable for all tenants of the customer. Click the Expired link, and the Edit subscription window appears, allowing you to update the subscription for the customer directly.

You can also disconnect the expired tenants from the module. To disconnect a tenant, select the tenant, click Disconnect tenant, then enter Yes in the text box and click Disconnect in the confirmation window.

#Manage Apps for a Tenant

When you click the number link in the Apps column for a tenant on the App management > Tenants page, you switch to the tenant level Apps page with the Apps tab selected.

In the Apps tab, the table lists all apps in the tenant. You can view details such as app name, type, devices using the app, total applicable devices, devices where installation failed, app package file, version, assignment status, publisher, app collection, source, and managed from. Click Refresh to load the latest app list.

You can also click Export to export the report of apps.

To delete an app, select the app and click Delete. Click OK in the confirmation window to confirm the deletion. The app will no longer be viewed or managed from either Elements or the Intune portal.

#Update Version for Winget Apps

In the App details page of a Winget app, click Update version in the upper-right corner to update the app to a new version. In the Edit application page, complete the steps to update the app version. For detailed instructions, refer to Add a Winget App.

#Update Package File for an App

Select an app in the app list and click Update package file to access the Edit application page where you can update the app package file to the latest version or edit the application details. Alternatively, click Update package file in the upper-right corner of the App details page.

• To update the app package file, complete the steps below:

  1. Click the file link on the top of the App information step.

  2. In the App package file window, Upload file option is selected by default. Click Browse to browse to the app package file that you want to update.

     Alternatively, you can switch to Select from file hub and select a package from the file hub. All files including the latest version in the package are selectable. Select the app package file that you want to use from the drop-down list.

  3. Click Select to update the app package file.

• To edit the application details, locate the corresponding field and make changes.

  The steps to edit application details are similar to the app creation steps. Refer to the sections below for detailed information.

#View App Details

Click an app of which the name is in bold to access the App details page. On the top of the page, you can view the app name, type, and created time. There are several tabs on this page, and the tabs are dynamic based on the app type.

• Basics – In this tab, the essentials, device status, user status, scope tags, files, app information, and release notes can be viewed.

  Values of the editable fields are highlighted in light blue. Click the pencil button in an editable field to edit the corresponding information.

• App settings – In this tab, the app settings can be viewed. You can also change the language for the app as required.

  NOTE

  This tab is only available for apps of the Microsoft Edge (Windows 10 and later) type.

• Configure app suite – In this tab, you can view configuration settings format, configure app suite information, configure app suite, and manage properties.

  NOTE

  This tab is only available for apps of the Microsoft 365 Apps (Windows 10 and later) type.

• Assignments – In this tab, you can view and manage the app assignments.

  • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

  • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

  • Available with or without enrollment – Select the groups for which you want to make this app available with or without enrollment. Apps with this assignment are displayed in the Company Portal app and website for users to optionally install without requiring the device to be enrolled.

  • Uninstall – The app is uninstalled from devices in the selected groups if Intune has previously installed the application onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

  Assign the app to users and devices by the following actions:

  • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add.

  • Add all users – Click Add all users to assign this app to all users.

  • Add all devices – Click Add all devices to assign this app to all devices.

• Device install status – This tab shows a device status list. The following information is available in the table, including the name of the device on platforms that allow naming a device, the name of the user, the operating system of the device, the version number of the app, the status of the app, the details of the status, and the date of the device’s last sync with Intune. You can manage the columns displayed in the table and filter specific records by app status.

  Click Export all to export the device install status, or click Refresh to view the latest data in the table.

• User install status – The tab shows a user status list. The following information is available in the table, including the name of the user in Microsoft Entra ID, the unique name of the user, the number of failed app installations for the user, the number of apps installed by the user, the number of apps that are pending installation, the number of apps not installed by the user, and the number of apps that are not applicable. Click a user name to view the device and app information for the user. You can manage the columns displayed in the table and filter specific records by app status.

  Click Export all to export the user install status, or click Refresh to view the latest data in the table.

• Audit logs – In this tab, you can view all action records performed to the current app. You can click Refresh to view the latest audit logs, or click Export to export the audit logs into an Excel.

There are more tabs for Windows app (Win32) apps on the App details page.

On the App details page of apps that are created via app package files, you can click Update package file in the upper-right corner of the page to update the app package file or edit the application.

For Winget apps, you can click Update version in the upper-right corner to update the app to the latest version or edit the application details.

You can delete an app by clicking Delete in the upper-right corner of the App details page.

#Add an Android Enterprise system app

Complete the following steps to add and deploy an Android Enterprise system app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Android Enterprise system app app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

8. Click Create to add the app and manage it by the app management service.

#Add an Android store app

Complete the following steps to add and deploy an Android store app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Android store app app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Available with or without enrollment – Select the groups for which you want to make this app available with or without enrollment. Apps with this assignment are displayed in the Company Portal app and website for users to optionally install without requiring the device to be enrolled.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

8. Click Create to add the app and manage it by the app management service.

#Add a Built-In app

Complete the following steps to add and deploy a built-in app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Built-In app app type, and click Select.

3. In the Built-In app step, click Add app.

4. Select the apps that you want to include from the Select Built-in apps window and click Select.

5. Click Next after you have finished adding apps.

6. Select the scope tags from the drop-down list to optionally add scope tags for the apps and click Apply.

7. Click Create to add the apps and manage them by the app management service.

#Add an iOS store app

Complete the following steps to add and deploy an iOS store app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the iOS store app app type, and click Select.

3. In the App information step, click Search the App Store.

4. In the Search the App Store window,

   1. Select the App Store country/region locale.

   2. Enter the name of the app in the search box and press Enter on the keyboard. Intune will search the store and return a list of matched results.

   3. Select the app you want and click Select.

5. Click Next after you have finished populating the fields.

6. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

7. Click Next to go to the Assignments step.

8. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Available with or without enrollment – Select the groups for which you want to make this app available with or without enrollment. Apps with this assignment are displayed in the Company Portal app and website for users to optionally install without requiring the device to be enrolled.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

9. Click Create to add the app and manage it by the app management service.

#Add an iOS/iPadOS web clip, macOS web clip, or Windows web link App

Complete the following steps to add and deploy an iOS/iPadOS web clip, macOS web clip, or Windows web link app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the iOS/iPadOS web clip, macOS web clip, or Windows web link app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Available with or without enrollment – Select the groups for which you want to make this app available with or without enrollment. Apps with this assignment are displayed in the Company Portal app and website for users to optionally install without requiring the device to be enrolled.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

8. Click Create to add the app and manage it by the app management service.

#Add a Line-of-business App

Complete the following steps to add and deploy a Line-of-business app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select Line-of-business app, and click Select.

3. In the App information step, click Select app package file.

4. In the App package file window, the Upload file option is selected by default. Click Browse to browse to a Windows installation file with the proper extension.

   Alternatively, you can switch to Select from file hub and select a package from the file hub. All files including the latest version in the package are selectable. Select an app package file from the drop-down list.

5. When you finish reviewing the app details, click Select.

6. Click Next after you have finished populating the fields.

7. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

8. Click Next to go to the Assignments step.

9. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

10. Click Create to add the app and manage it by the app management service.

#Add a macOS app (DMG) App

Complete the following steps to add and deploy a macOS app (DMG) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the macOS app (DMG) app type, and click Select.

3. In the App information step, click Select app package file.

4. In the App package file window, the Upload file option is selected by default. Click Browse to browse to a macOS DMG file with the extension .dmg.

   Alternatively, you can switch to Select from file hub and select a package from the file hub. All files including the latest version in the package are selectable. Select an app package file from the drop-down list.

5. When you finish reviewing the app details, click Select.

6. Click Next after you have finished populating the fields.

7. In the Requirements step, select the minimum operating system version on which the app can be installed.

8. Click Next to go to the Detection rules step.

9. In the Detection rules step, configure the rules to detect the presence of the app.

   • Ignore app version – For apps that have an autoupdate mechanism, enable this setting. Disable this setting to install the app when it has not been installed on the device, or if the deploying app's version number does not match the version that's already installed on the device.

   • Included apps – Provide the apps that are contained in the uploaded file. Included app bundle IDs and build numbers are used for detecting and monitoring app installation status of the uploaded file.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

10. Click Next to go to the Scope tags step.

11. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

12. Click Next to go to the Assignments step.

13. Choose how you want to assign the app to users and devices.

    • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

    • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

    Assign the app to users and devices by the following actions:

    • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

    • Add all users – Click Add all users to assign this app to all users.

    • Add all devices – Click Add all devices to assign this app to all devices.

14. Click Create to add the app and manage it by the app management service.

#Add a macOS app (PKG) App

Complete the following steps to add and deploy a macOS app (PKG) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the macOS app (PKG) app type, and click Select.

3. In the App information step, click Select app package file.

4. In the App package file window, the Upload file option is selected by default. Click Browse to browse to a macOS PKG file with the extension .pkg.

   Alternatively, you can switch to Select from file hub and select a package from the file hub. All files including the latest version in the package are selectable. Select an app package file from the drop-down list.

5. When you finish reviewing the app details, click Select.

6. Click Next after you have finished populating the fields.

7. In the Program step, configure the app installation and removal commands for the app.

   • Pre-install script – Provide a script that runs before the app is installed.

   • Post-install script – Provide a script that runs after the app installs successfully.

8. In the Requirements step, select the minimum operating system version on which the app can be installed.

9. Click Next to go to the Detection rules step.

10. In the Detection rules step, configure the rules to detect the presence of the app.

    • Ignore app version – For apps that have an autoupdate mechanism, enable this setting. Disable this setting to install the app when it has not been installed on the device, or if the deploying app's version number does not match the version that's already installed on the device.

    • Included apps – Provide the apps that are contained in the uploaded file. Included app bundle IDs and build numbers are used for detecting and monitoring app installation status of the uploaded file.

11. Click Next to go to the Scope tags step.

12. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

13. Click Next to go to the Assignments step.

14. Choose how you want to assign the app to users and devices.

    • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

    • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

    Assign the app to users and devices by the following actions:

    • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

    • Add all users – Click Add all users to assign this app to all users.

    • Add all devices – Click Add all devices to assign this app to all devices.

15. Click Create to add the app and manage it by the app management service.

#Add a Managed Google Play App

Complete the following steps to add and deploy a Managed Google Play app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Managed Google Play app app type, and click Select.

3. On the Add app page, the Managed Google Play app store is displayed. Select an app to view the app details.

4. Click Select to select the app.

5. Click Sync to sync the app with the Managed Google Play service.

   NOTE

   If the current store mode is custom, click Reset to basic mode to reset the Play Store to basic.

#Add a Microsoft 365 Apps (Windows 10 and later) App

Complete the following steps to add and deploy a Microsoft 365 Apps (Windows 10 and later) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft 365 Apps (Windows 10 and later), and click Select.

3. In the App information step, provide information about the app suite.

4. Click Next after you have finished populating the fields.

5. In the Configure app suite step, you can choose to configure app suite using the configuration designer or using XML data.

   Select Configuration designer from the Configuration settings format drop-down list to configure app suite using the configuration designer.

   • Select Office apps – Select the standard Microsoft 365 apps that you want to assign to devices by choosing the apps in the drop-down list.

   • Select other Office apps (license required) – Select additional Microsoft 365 apps that you want to assign to devices and that you have licenses for by choosing the apps in the drop-down list. These apps include licensed apps, such as Microsoft Project Online desktop client and Microsoft Visio Online Plan 2.

   • Architecture – Define whether the 32-bit or 64-bit edition of Microsoft 365 Apps is installed on devices.

   • Default file format – Choose whether you want to use Office open XML format or Office open document format.

   • Update channel – Choose how Office is updated on devices.

     After you choose a channel, you can choose the following:

     • Remove other versions – Choose Yes to remove other versions of Office (MSI) from user devices.

     • Version to install – Choose the version of Office that should be installed, Latest or Specific.

     • Specific version – If you select Specific as the version to install above, you can select to install a specific version of Office for the selected channel on end user devices.

   • Use shared computer activation – Select Yes when multiple users share a computer. Normally, users can only install and activate Microsoft 365 Apps on a limited number of devices. Using Microsoft 365 Apps with shared computer activation does not count against that limit.

   • Accept the Microsoft Software License Terms on behalf of users – Select Yes if you do not require end users to accept the license agreement. Intune then automatically accepts the agreement.

   • Install background service for Microsoft Search in Bing – Select Yes to install a background service that helps determine whether a Microsoft Search in Bing extension for Google Chrome is installed on the device.

   • Languages – By default, Intune will install Office with the default language of the operating system. If you want to install additional languages with the app suite, click the link below, select desired languages, and click OK.

   Alternatively, select Enter XML data to configure app suite using a custom configuration file.

   1. Add your configuration XML.

      NOTE

      For more information about configuring the XML data, refer to Configuration options for the Office Deployment Tool.

   2. Click Validate XML to validate the XML policy format.

6. Click Next to go to the Scope tags step.

7. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

8. Click Next to go to the Assignments step.

9. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

10. Click Create to add the app and manage it by the app management service.

#Add a Microsoft 365 Apps for macOS or Microsoft Defender for Endpoint (macOS) App

Complete the following steps to add and deploy a Microsoft 365 Apps for macOS or Microsoft 365 Apps for macOS app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft 365 Apps for macOS or Microsoft Defender for Endpoint (macOS) app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

8. Click Create to add the app and manage it by the app management service.

#Add a Microsoft Edge, version 77 and later (macOS) App

Complete the following steps to add and deploy a Microsoft Edg, version 77 and later (macOS) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft Edge, version 77 and later (macOS) app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the channel you want to use to deploy the app, and click Next.

6. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

7. Click Next to go to the Assignments step.

8. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

9. Click Create to add the app and manage it by the app management service.

#Add a Microsoft Edge, version 77 and later (Windows 10 and later) App

Complete the following steps to add and deploy a Microsoft Edge, version 77 and later (Windows 10 and later) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft Edge, version 77 and later (Windows 10 and later) app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the channel and language you want to use to deploy the app, and click Next.

6. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

7. Click Next to go to the Assignments step.

8. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

9. Click Create to add the app and manage it by the app management service.

#Add a Microsoft Store app (legacy)

Complete the following steps to add and deploy a Microsoft Store app (legacy):

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft Store app (legacy) app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

8. Click Create to add the app and manage it by the app management service.

#Add Microsoft Store apps (new)

Complete the following steps to add and deploy a Microsoft Store app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Microsoft Store app (new) app type, and click Select.

3. In the App information step of the Add app page, click Search the Microsoft Store app (new) link. The Microsoft Store provides a large variety of apps designed to work on Microsoft devices. Enter keywords in the search box and press Enter to search for the app you want to add. Select the desired app and click Select.

4. The app information is presented with the selected app’s metadata. Specific fields are prepopulated. Edit the app information as required.

5. Click Next after you have finished populating the fields.

6. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

7. Click Next to go to the Assignments step.

8. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

9. Click Create to add the app and manage it by the app management service.

#Add a Web link App

Complete the following steps to add and deploy a Web link app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Web link app type, and click Select.

3. In the App information step, add the app details.

4. Click Next after you have finished populating the fields.

5. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

6. Click Next to go to the Assignments step.

7. Choose how you want to assign the app to users and devices.

   • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

   • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

   • Available with or without enrollment – Select the groups for which you want to make this app available with or without enrollment. Apps with this assignment are displayed in the Company Portal app and website for users to optionally install without requiring the device to be enrolled.

   • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

   Assign the app to users and devices by the following actions:

   • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

   • Add all users – Click Add all users to assign this app to all users.

   • Add all devices – Click Add all devices to assign this app to all devices.

8. Click Create to add the app and manage it by the app management service.

#Add a Windows app (Win32) App

Complete the following steps to add and deploy a Windows app (Win32) app:

1. Click Create app in the upper-left corner, and select Create from Intune.

2. Select the Windows app (Win32) app type, and click Select.

3. In the App information step, click Select app package file.

4. In the App package file window, Upload file option is selected by default. Click Browse to browse to a Windows installation file with the extension .intunewin.

   Alternatively, you can switch to Select from file hub and select a package from the file hub. All files including the latest version in the package are selectable. Select an app package file from the drop-down list.

5. When you finish reviewing the app details, click Select.

6. Click Next after you have finished populating the fields.

7. In the Program step, configure the app installation and removal commands for the app.

   • Install command – Add the complete installation command line to install the app. Click Select reference and select a reference to add to the install command if needed. The reference will be added as an environment variable in the install command.

   • Uninstall command – Add the complete command line to uninstall the app based on the app's GUID. Click Select reference and select a reference to add to the uninstall command if needed. The reference will be added as an environment variable in the uninstall command.

   • Installation time required (mins) – The number of minutes the system will wait for install program to finish. The default value is 60 minutes. If the app takes longer to install than the configured installation time, the system will fail the app installation. The maximum timeout value is 1440 minutes (1 day).

   • Allow available uninstall – Enable this setting to provide the uninstall option for this app for users from the Company Portal or disable it to prevent users from uninstalling the app from the Company Portal.

   • Install behavior – Set the install behavior to either System or User.

   • Device restart behavior – Select one of the following options:

     • Determine behavior based on return codes – Select this option to restart the device based on the return codes, which means that the device will restart based on the configured return code. With this configuration, a hard reboot return code will immediately trigger a restart of the device, and a soft reboot return code will notify the user that a restart is required to finish the installation.

     • No specific action – Select this option to suppress device restarts during the app installation of MSI-based apps.

     • App install may force a device restart – Select this option to allow the app installation to finish without suppressing restarts, which means that the Win32 app installation is allowed to complete without suppressing restarts. With this configuration, a hard reboot return code will notify the user that a restart of the device will be triggered in 120 minutes, and a soft reboot return code will only notify the user that a restart is required to finish the installation.

     • Intune will force a mandatory device restart – Select this option to always restart the device after a successful app installation.

   • Specify return codes to indicate post-installation behavior – Add the return codes that are used to specify either app installation retry behavior or post-installation behavior. Return code entries are added by default during app creation. However, you can add more return codes or change existing return codes.

8. Click Next to go to the Requirements step.

9. In the Requirements step, specify the requirements that devices must meet before the app is installed:

   • Check operating system architecture – Choose the architectures needed to install the app.

   • Minimum operating system – Select the minimum operating system needed to install the app.

   • Disk space required (MB) – The free disk space needed on the system drive to install the app.

   • Physical memory required (MB) – The physical memory (RAM) required to install the app.

   • Minimum number of logical processors required – The minimum number of logical processors required to install the app.

   • Minimum CPU speed required (MHz) – The minimum CPU speed required to install the app.

   • Configure additional requirement rules – Configure additional requirement rules if needed by clicking Add requirement rule.

10. Click Next to go to the Detection rules step.

11. In the Detection rules step, configure the rules to detect the presence of the app.

    • Rules format – Select how the presence of the app will be detected.

      • You can choose to manually configure the detection rules by selecting Manually configure detection rules and clicking Add detection rule.

      • Alternatively, you can select Use a custom detection script to use a custom script to detect the presence of the app.

        • Script file – Select a PowerShell script that will detect the presence of the app on the client.

        • Script content – The script content will be displayed and can be copied directly.

        • Run script as 32-bit process on 64-bit clients – Choose to run the script in a 32-bit or 64-bit process on 64-bit clients. 32-bit clients run the script in a 32-bit process.

        • Enforce script signature check and run script silently – Enable this setting to verify that a trusted publisher has signed the script, which will allow the script to run with no warnings or prompts displayed. The script will run unblocked. Disable it to run the script without signature verification.

12. Click Next to go to the Dependencies step.

13. Software dependencies are applications that must be installed before this application can be installed. Click Add dependency, select applications that must be installed before your Win32 app can be installed, and click Select. Choose whether to automatically install the dependent apps by clicking the toggle under the Automatically install column.

14. Click Next to go to the Supersedence step.

15. In the Supersedence step, you can add apps that the current app will supersede. Click Add app, select the apps to apply the supersedence relationship in the Add Apps window, and click Select. In the list of superseded apps, modify the Uninstall previous version option for each selected app to specify whether an uninstall command will be sent by Intune to each selected app.

16. Click Next to go to the Scope tags step.

17. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

18. Click Next to go to the Assignments step.

19. Choose how you want to assign the app to users and devices.

    • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

    • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

    • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

    Assign the app to users and devices by the following actions:

    • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

    • Add all users – Click Add all users to assign this app to all users.

    • Add all devices – Click Add all devices to assign this app to all devices.

20. Click Create to add the app and manage it by the app management service.

#Add a Winget App

Complete the following steps to add and deploy a Winget app:

1. Click Create app in the upper-left corner, and select Create from Winget.

2. In the App information step, click Search the Winget app.

3. Enter keywords in the search box and press Enter to search for the app you want to add.

4. Select the version, install behavior, architecture, and language for the app to specify the app package you want to add, and then click Select.

5. The app information is presented with the selected app’s metadata. Specific fields are prepopulated. Edit the app information as required.

6. Click Next after you have finished populating the fields.

7. In the Program step, configure the app installation and removal commands for the app.

   • Installation time required (mins) – The number of minutes the system will wait for install program to finish. The default value is 60 minutes. If the app takes longer to install than the configured installation time, the system will fail the app installation. The maximum timeout value is 1440 minutes (1 day).

   • Allow available uninstall – Enable this setting to provide the uninstall option for this app for users from the Company Portal or disable it to prevent users from uninstalling the app from the Company Portal.

   • Device restart behavior – Select one of the following options:

     • Determine behavior based on return codes – Select this option to restart the device based on the return codes, which means that the device will restart based on the configured return code. With this configuration, a hard reboot return code will immediately trigger a restart of the device, and a soft reboot return code will notify the user that a restart is required to finish the installation.

     • No specific action – Select this option to suppress device restarts during the app installation of MSI-based apps.

     • App install may force a device restart – Select this option to allow the app installation to finish without suppressing restarts, which means that the Win32 app installation is allowed to complete without suppressing restarts. With this configuration, a hard reboot return code will notify the user that a restart of the device will be triggered in 120 minutes, and a soft reboot return code will only notify the user that a restart is required to finish the installation.

     • Intune will force a mandatory device restart – Select this option to always restart the device after a successful app installation.

8. Click Next to go to the Requirements step.

9. In the Requirements step, specify the requirements that devices must meet before the app is installed:

   • Minimum operating system – Select the minimum operating system needed to install the app.

   • Disk space required (MB) – The free disk space needed on the system drive to install the app.

   • Physical memory required (MB) – The physical memory (RAM) required to install the app.

   • Minimum number of logical processors required – The minimum number of logical processors required to install the app.

   • Minimum CPU speed required (MHz) – The minimum CPU speed required to install the app.

   • Configure additional requirement rules – Configure additional requirement rules if needed by clicking Add requirement rule.

10. Click Next to go to the Detection rules step.

11. In the Detection rules step, configure the rules to detect the presence of the app.

    • Rules format – Select how the presence of the app will be detected.

      • You can choose to manually configure the detection rules by selecting Manually configure detection rules and clicking Add detection rule.

      • Alternatively, you can select Use a custom detection script to use a custom script to detect the presence of the app.

        • Script file – Select a PowerShell script that will detect the presence of the app on the client.

        • Script content – The script content will be displayed and can be copied directly.

        • Run script as 32-bit process on 64-bit clients – Choose to run the script in a 32-bit or 64-bit process on 64-bit clients. 32-bit clients run the script in a 32-bit process.

        • Enforce script signature check and run script silently – Enable this setting to verify that a trusted publisher has signed the script, which will allow the script to run with no warnings or prompts displayed. The script will run unblocked. Disable it to run the script without signature verification.

12. Click Next to go to the Dependencies step.

13. Software dependencies are applications that must be installed before this application can be installed. Click Add dependency, select applications that must be installed before your Win32 app can be installed, and click Select. Choose whether to automatically install the dependent apps by clicking the toggle under the Automatically install column.

14. Click Next to go to the Supersedence step.

15. In the Supersedence step, you can add apps that the current app will supersede. Click Add app, select the apps to apply the supersedence relationship in the Add Apps window, and click Select. In the list of superseded apps, modify the Uninstall previous version option for each selected app to specify whether an uninstall command will be sent by Intune to each selected app.

16. Click Next to go to the Scope tags step.

17. Select the scope tags from the drop-down list to optionally add scope tags for the app and click Apply.

18. Click Next to go to the Assignments step.

19. Choose how you want to assign the app to users and devices.

    • Required – The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

    • Available for enrolled devices – Assign the app to groups of users who can install the app from the Company Portal app or website.

    • Uninstall – The app is uninstalled from devices in the selected groups if the application has previously been installed onto the device via an “Available for enrolled devices” or “Required” assignment using the same deployment.

    Assign the app to users and devices by the following actions:

    • Add group – Click Add group, select the mode Included or Excluded, and select the groups that you want to include in / exclude from the app, and click Add. Then, you can further choose whether to set End user notifications, Installation deadline, and Restart grace period. You can also edit the Filter mode value to apply a filter to include or exclude certain devices from this assignment.

    • Add all users – Click Add all users to assign this app to all users.

    • Add all devices – Click Add all devices to assign this app to all devices.

20. Click Create to add the app and manage it by the app management service.

#Manage App Collections

When you click the number link in the App collections column for a tenant on the App management > Tenants page, you switch to the tenant level Apps page with the App collections tab selected.

In the App collections tab, you can view the app collections that are applied to this tenant. For each collection, you can view the number of apps in it, the last modified time, and the user who modified the collection. You can also perform the following actions:

• View app collection details – Click a collection name to access the App collection details page. You can view the following tabs.

  • Basics – In this tab, you can view the essentials and scope tags of the app collection.

    NOTE

    When you configure the category or scope tags and click Apply changes, you can choose the action to perform:

    • Append – Select this option to merge the scope tags with the existing scope tags.
    • Overwrite – Select this option to replace the existing scope tags with the scope tags of this app collection. This will remove all existing scope tags that are not included in the new scope tags.

  • Apps – In this tab, you can view the apps included in the collection. The app name, type, package, description, and app package file are displayed. Click Refresh to view the latest app list.

  • Assignments – In this tab, you can view and manage the assignments of the app collection.

    NOTE

    When you configure assignments and click Apply changes, you can choose the action to perform:

    • Append – Select this option to merge the assignments with the existing app assignments. Conflicted assignments will not be appended.
    • Overwrite – Select this option to replace the existing app assignments with the assignments of this app collection. This will remove all existing app assignments that are not included in the new assignments.

  • Audit logs – In this tab, you can view all action records performed on the app collection. Click Refresh to view the latest audit logs, or click Export to export the audit logs into an Excel file.

• Export – To export report of app collections, click Export and select Current columns or All columns to export the currently displayed app collections with the currently displayed columns or all columns in the report, and select xlsx or csv as the report type.

• Refresh – Click Refresh to view the latest app collections.

#Process Center

On the Process center page, apps-related action records within the tenant are listed in the table.

When specific actions are initiated, corresponding processes are started to complete them. You can monitor the status of these processes by clicking the Process center link in the notification that appears once the process has started. Additionally, you can access this process center by clicking Process center from the left navigation.

On this page, you can perform the following actions:

• Refresh – Click Refresh to refresh the data displayed in the table.

• Filter process – You can filter the process status shown in the table. To filter specific processes to view, click Filter in the upper-right corner. You can expand the fields in the filter and select specific options. Then, click Apply changes to apply the updates and only view the processes that match the filters.

• Export – You can click Export to export all action records report. Select Current columns or All columns to export records with the currently displayed columns or all columns in the report, select xlsx or csv as the report type, and click Export.

• Cancel – For the processes that have not started, you can select the process and click Cancel to cancel the action. Click OK in the confirmation window to confirm the cancellation.