Lab 03: Manage applications

Lab scenario

You are Jordan Chen, Modern Endpoint Administrator at Contoso Healthcare. With devices enrolled and managed (Labs 01-02), you now need to deploy applications to users and devices. You’ll use multiple deployment methods: Microsoft Store apps, Win32 packages, Microsoft 365 Apps, and the Enterprise App Catalog. You’ll also configure App Protection Policies to secure corporate data on mobile and unenrolled devices.

By the end of this lab, you’ll have:

Deployed a Microsoft Store app
Packaged and deployed a Win32 application with custom detection rules (tagged with the Pharmacy scope tag from Lab 01)
Deployed Microsoft 365 Apps with update channel configuration
Added and assigned an app from the Enterprise App Catalog
Configured app supersedence to automatically upgrade an application (still scoped to the pilot cohort and tagged Pharmacy)
Created an App Protection Policy for mobile devices
Monitored app deployment status, troubleshot failures, and diagnosed an intentional app-assignment conflict

Lab Duration

Estimated Time: 100 minutes

Instructions

Before you begin

This lab requires:

Completion of Lab 01 (devices enrolled, groups configured)
Access to the Contoso Microsoft 365 tenant (<TenantPrefix>.onmicrosoft.com)
Global Administrator or Intune Administrator credentials
SEA-DEV1 (enrolled device, Megan Bowen signed in)
SEA-DEV2 (enrolled device, Joni Sherman signed in)
Internet access on SEA-DEV1 to download the official 7-Zip installer directly from 7-zip.org for Exercise 2 — there’s no pre-packaged app asset; you download the real installer yourself
Microsoft Intune Suite trial active (activated in Lab 01 prerequisites) — required for Exercise 4 (Enterprise App Catalog)

Exercise 1: Deploy Microsoft Store apps

Scenario

Microsoft Store apps are modern Windows applications distributed through the Microsoft Store. Intune can deploy Store apps to managed devices without requiring users to access the Store directly.

Task 1: Add a Microsoft Store app

On SEA-DEV1, open Microsoft Edge and navigate to https://intune.microsoft.com.
Sign in as **admin@.onmicrosoft.com**.
If prompted to stay signed in, select No.
In the Microsoft Intune admin center, select Apps, and then select All apps.
Select + Create from the top toolbar.
In the Select app type pane, set Platform to Windows, then set App type to Microsoft Store app (new). Select Select.
On the App information tab, select Search the Microsoft Store app (new).
In the Search the Microsoft Store app (new) pane, search for Microsoft To Do.
Select Microsoft To Do: Lists, Tasks & Reminders from the search results.
Select Select.
On the App information page, verify the app details:
- Name: Microsoft To Do
- Publisher: Microsoft Corporation
- Description: (auto-populated from Store)
Select Next, then select Next again to skip the Scope tags tab.
On the Assignments page, under Required, select Add group.
Search for and select dyn-Windows-Devices.
Select Select.
Select Next.
On the Review + create tab, select Create.

You have successfully added and assigned a Microsoft Store app.

Task 2: Verify app installation on SEA-DEV1

On SEA-DEV1, wait 5–10 minutes for the app to install automatically.

[!NOTE] Installation can start within minutes or take a few hours. Force a sync to speed it up.
To force a device sync, open Settings (press Windows + I).
Navigate to Accounts → Access work or school.
Select the Connected to Contoso entry (or **Connected to ** if the display name differs).
Select Info → Scroll down and select Sync.
Wait for the sync to complete (typically 1–2 minutes).
After sync, open the Start menu and search for Microsoft To Do.
Verify the app appears in the search results and can be launched.

[!NOTE] You can also sync from Devices → Windows → SEA-DEV1 → Sync → Yes. To check installation, open Monitor → All apps on the device page and review Installation status for Microsoft To Do.

You have successfully verified Microsoft Store app installation.

Exercise 2: Package and deploy a Win32 application

Scenario

Win32 apps are traditional Windows desktop applications (.exe, .msi installers). You’ll package a Win32 app using the Microsoft Win32 Content Prep Tool, create a detection rule, and deploy it to managed devices.

Task 1: Prepare the Win32 app package

[!IMPORTANT] Download the official 7-Zip MSI directly from 7-zip.org. Don’t use a pre-packaged app asset, portable build, or third-party mirror.

Open Microsoft Edge and navigate to https://www.7-zip.org/download.html — the official 7-Zip download page (published by Igor Pavlov, the actual author).
Download the current 64-bit Windows x64 .msi package (not the .exe installer, and not any “portable” edition from a third-party mirror).
Open Terminal (Admin) (right-click Start → Terminal (Admin)). On Windows 11, this opens Windows Terminal with a PowerShell tab.
On the Do you want to allow this app to make changes to your device? prompt, select Yes.

Download the Microsoft Win32 Content Prep Tool from its official Microsoft GitHub repo:

New-Item -ItemType Directory -Path "C:\Program Files\IntuneWinAppUtil" -Force
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/microsoft/Microsoft-Win32-Content-Prep-Tool/master/IntuneWinAppUtil.exe" -OutFile "C:\Program Files\IntuneWinAppUtil\IntuneWinAppUtil.exe"
Test-Path "C:\Program Files\IntuneWinAppUtil\IntuneWinAppUtil.exe"

The output should return True.

Create the source folder and move the downloaded MSI into it:

New-Item -ItemType Directory -Path "C:\LabAssets\Win32-App\Source" -Force
Move-Item "$env:USERPROFILE\Downloads\7z*.msi" "C:\LabAssets\Win32-App\Source\"
Get-ChildItem "C:\LabAssets\Win32-App\Source\7z*.msi"

Note the exact downloaded MSI filename (for example, 7z<version>-x64.msi). You’ll need it for the next command.

[!NOTE] Use the downloaded 7-Zip .msi file as the example payload. If you use a different installer, update the filename, app name and publisher, install and uninstall commands, and detection path throughout Exercises 2, 5, and 7.
Navigate to the Win32 Content Prep Tool directory:
```
cd "C:\Program Files\IntuneWinAppUtil"
```
Run the content prep tool to package the app (replace <MSI filename> with the exact downloaded MSI filename):
```
.\IntuneWinAppUtil.exe -c "C:\LabAssets\Win32-App\Source" -s "<MSI filename>" -o "C:\LabAssets\Win32-App\Output"
```
- -c: Source folder containing the app files
- -s: Setup file (the MSI installer)
- -o: Output folder for the .intunewin package
When prompted Do you want to create it (Y/N)? for the output folder, enter Y.
Wait for the packaging to complete (typically 10–30 seconds).
Verify the .intunewin file was created:
```
Get-ChildItem "C:\LabAssets\Win32-App\Output\*.intunewin"
```
The output should show the generated .intunewin file.

You have successfully packaged a Win32 app using the Intune Win32 Content Prep Tool.

Task 2: Add the Win32 app to Intune

In the Microsoft Intune admin center, navigate to Apps → All apps.
Select + Create from the top toolbar.
In the Select app type pane, set Platform to Windows and App type to Windows app (Win32). Select Select.
On the App information tab, select Select app package file.
In the App package file pane, select the folder icon next to Select a file, and navigate to C:\LabAssets\Win32-App\Output\.
Select the .intunewin file you created in Task 1 and select OK.

[!NOTE] Intune pre-fills Name, Description, and App version from the package. Publisher is blank and must be entered manually.
On the App information page, confirm the auto-populated fields look correct.
Set Publisher to Igor Pavlov, and adjust the Description if you want:
- Description: 7-Zip file archiver for Windows
Select Next.
On the Program page, the Install command and Uninstall command are auto-populated from the MSI package metadata — confirm they look correct:
- Install command: msiexec /i "<filename>.msi" /qn
- Uninstall command: msiexec /x "{<product-code-GUID>}" /qn
Confirm Install behavior is set to System (already the default for this package).
Change Device restart behavior from the pre-selected default (App install may force a device restart) to Determine behavior based on return codes.

[!NOTE] Leave Installer type, Uninstaller type, Installation time required (mins), Allow available uninstall, and the Return codes table at their pre-populated defaults.
Select Next.
On the Requirements page, configure:
- Check operating system architecture: Yes. Specify the systems the app can be installed on.
- Under the architecture checkboxes, check Install on x64 system only (leave x86 and ARM64 unchecked)
- Minimum operating system: Windows 10 1607
[!NOTE] Leave Disk space required, Physical memory required, Minimum number of logical processors required, Minimum CPU speed required, and Configure additional requirement rules blank.
Select Next.
On the Detection rules tab, configure:
- Rules format: Manually configure detection rules
Select +Add under Detection rules.
In the Detection rule pane, configure:
- Rule type: MSI
- MSI product code: Leave as auto-populated (Intune reads this from the .intunewin package’s embedded MSI metadata)
Select OK.
Select Next.
On the Dependencies tab, select Next (no dependencies required).
On the Supersedence tab, select Next (will configure supersedence in a later task).
On the Scope tags tab, select + Select scope tags, add Pharmacy (created in Lab 01 Exercise 2 Task 6), select Select, then select Next.
On the Assignments tab, under Required, select +Add group.
Search for and select sg-Intune-Pilot-Users.
Select Select.
Select Next.
On the Review + create tab, select Create.

You have successfully added a Win32 app with a custom detection rule.

Task 3: Monitor Win32 app installation

On SEA-DEV1, force a device sync:
- Settings → Accounts → Access work or school → Connected to Contoso → Info → Sync
Wait 10–15 minutes for the app to install.

[!NOTE] Win32 app installation can take longer than Store apps because Intune downloads the package, runs the installer, and verifies detection.
In the Microsoft Intune admin center, navigate to Apps → All apps → 7-Zip.
Select Device install status from the left navigation.
Review the installation status for each device:
- Installed: App successfully installed and detection rule passed
- In progress: Installation is running
- Failed: Installation failed (review error code and message)
- Not applicable: Device not targeted by the assignment
If installation failed, select the failed device to view detailed error information.

You have successfully monitored Win32 app installation status.

Exercise 3: Deploy Microsoft 365 Apps

Scenario

Microsoft 365 Apps (formerly Office 365 ProPlus) provide Word, Excel, PowerPoint, Outlook, and other productivity tools. You’ll deploy the suite to managed devices with a specific update channel configuration.

Task 1: Add Microsoft 365 Apps

In the Microsoft Intune admin center, navigate to Apps → All apps.
Select + Create from the top toolbar.
In the Select app type pane, set Platform to Windows and App type to Microsoft 365 Apps for Windows 10 and later. Select Select.
On the App suite information tab, configure:
- Suite Name: Microsoft 365 Apps (Current Channel)
- Suite Description: Microsoft 365 Apps with Current Channel updates
Select Next.
On the Configure app suite page, leave Configuration settings format set to Configuration designer.
Under Select Office apps, open the dropdown and check:
- Excel
- Outlook
- PowerPoint
- Teams
- Word
[!NOTE] Don’t look for a standalone OneDrive option. Leave Select other Office apps (license required) at 0 selected.
Under App suite information, configure:
- Architecture: 64-bit (toggle, already selected by default)
- Default file format: Office Open XML Format — this field is required; the page shows a validation error until you pick one
- Update channel: Current Channel — also required
- Remove other versions: Yes (default)
- Version to install: Latest (default; leave Specific version disabled)
Under Properties, configure:
- Use shared computer activation: No (default)
- Accept the Microsoft Software License Terms on behalf of users: Yes
- Install background service for Microsoft Search in Bing: No
Scroll down and, under Languages, select English.
Select Next.
On the Scope tags page, select Next (no scope tag needed for this deployment).
On the Assignments page, under Required, select Add group.
Search for and select dyn-Windows-Devices.
Select Select.
Select Next.
On the Review + create tab, select Create.

You have successfully configured and assigned Microsoft 365 Apps.

Task 2: Monitor Microsoft 365 Apps installation

On SEA-DEV1, force a device sync.
Wait 15–30 minutes for Microsoft 365 Apps to download and install.

[!NOTE] Microsoft 365 Apps is about 3 GB and can take 20–40 minutes to install. You can continue to the next exercise and check status later.
In the Microsoft Intune admin center, navigate to Apps → All apps → Microsoft 365 Apps (Current Channel).
Select Device install status from the left navigation.
Review the installation progress for each device.
After installation completes, on SEA-DEV1, open the Start menu and open one of the following apps:
- Excel
- Word
- PowerPoint
- Outlook
In the application, select File, and then select Account. Ensure the product information shows Subscription product for and a product name of Microsoft 365 Apps for enterprise.
Close the application you opened.

You have successfully deployed and monitored Microsoft 365 Apps installation.

Exercise 4: Use the Enterprise App Catalog

Scenario

The Enterprise App Catalog (part of Microsoft Intune Enterprise Application Management) provides a curated library of third-party applications with pre-configured installers, detection rules, and icons. You’ll add an app from the catalog and deploy it to devices.

Task 1: Browse the Enterprise App Catalog

In the Microsoft Intune admin center, navigate to Apps → All apps.
Select + Create from the top toolbar.
In the Select app type pane, set Platform to Windows and App type to Enterprise App Catalog app. Select Select.

[!NOTE] If Enterprise App Catalog app doesn’t appear, wait 5–10 minutes after activation and refresh.
On the Select app page, select Search the Enterprise App Catalog to browse the available apps in the catalog.

The catalog includes popular enterprise apps such as:
- Google Chrome
- Mozilla Firefox
- Zoom
- Adobe Acrobat Reader
- VLC Media Player
- Notepad++
Search for or select Google Chrome from the list.
Select Next.
On the Configuration tab, use Search for a branch if you want a different release, or select the default row. Confirm the row shows:
- Package name: Google Chrome (x64) (msi)
- Language: en-US
- Architecture: x64
- Version: (current release, e.g. 150.0.7871.129)
Select Next.
On the Updates tab, note the banner: “This selection is a one-time choice for this app. You will need to create a new app to make a different selection.”
Under Update method, select Update with supersedence.
Review the read-only App information (App name, Package name, Version, Publisher, Architecture, Application size, Privacy URL, App store URL) and App commands that appear after you select Update with supersedence (Install command, pre-built as "%SystemRoot%\System32\msiexec.exe" /i "googlechromestandaloneenterprise64.msi" /qn) — none of this needs editing.
Select Select.

You have successfully browsed the Enterprise App Catalog and selected an app.

Task 2: Configure and assign the app

On the App information page, review the pre-populated details:
- Name: Google Chrome (x64) (msi)
- Description: (auto-populated)
- Publisher: Google LLC
- Developer: Google LLC
Select Next.
On the Program page, review the auto-populated fields — none need editing:
- Installer type: Command line
- Install command: "%SystemRoot%\System32\msiexec.exe" /i "googlechromestandaloneenterprise64.msi" /qn (matches the Install command you reviewed on the Updates tab in Task 1)
- Uninstaller type: Command line
- Uninstall command: "%SystemRoot%\System32\msiexec.exe" /x {<product-code-GUID>}
- Installation time required (mins): 60
- Allow available uninstall: Yes
- Install behavior: grayed out/non-editable for this app — leave as is
- Device restart behavior: Determine behavior based on return codes — already the default here, unlike the Win32 app you configured manually in Exercise 2
Select Next.
On the Requirements page, review the pre-configured requirements and select Next.
On the Detection rules tab, review the pre-configured detection rule:
- Rule type: Registry
- Key path: HKLM\...\CurrentVersion\Uninstall\{<product-code-GUID>}
Select Next.
On the Supersedence page, select Next (no supersedence relationship needed — this is the first version of this app).
On the Assignments page, under Available for enrolled devices, select Add group.
Search for and select sg-Intune-Pilot-Users.
Select Select.
Select Next.
On the Review + create tab, select Add app.

You have successfully added and assigned an app from the Enterprise App Catalog.

Task 3: Verify app availability in the Company Portal

On SEA-DEV1, open the Start menu and search for Company Portal.
Launch the Company Portal app.

[!NOTE] If Company Portal isn’t available, install it from the Microsoft Store at https://apps.microsoft.com/detail/9wzdncrfj3pz?hl=en-US&gl=US.
Sign in as **MeganB@.OnMicrosoft.com** (if not already signed in).
Navigate to the Apps section.
Verify Google Chrome appears in the available apps list.
Select Install to install the app.
Wait for installation to complete.
Open the Start menu and verify Google Chrome is present.

You have successfully installed an app from the Company Portal.

Exercise 5: Configure app supersedence

Scenario

App supersedence allows you to automatically upgrade or replace applications. When a user has an older version installed, Intune automatically uninstalls it and installs the newer version.

Task 1: Create a second version of the Win32 app

For this task, you’ll simulate a new version by creating a second Win32 app entry from the same package.

[!NOTE] For this lab, reuse the same .intunewin package from Exercise 2 Task 1 under the new app name.

In the Microsoft Intune admin center, navigate to Apps → All apps → + Create.
Set Platform to Windows and App type to Windows app (Win32). Select Create.
Walk through the wizard exactly as you did in Exercise 2 Task 2 (Program, Requirements, Detection rules, Dependencies, Assignments), with these differences:
- App information: select Select app package file and upload the same <filename>.intunewin package from C:\LabAssets\Win32-App\Output\
- Name to 7-Zip v2.0
- Description to Updated version of 7-Zip
- Set Publisher to Igor Pavlov.
- On the Supersedence tab, select + Add.
  - In the Add apps pane, select the existing instance of 7-Zip and then select Select.
  - Below Uninstall previous version, select Yes, and then select Next.
- Scope tags: add Pharmacy (same as the original app) — keeps Pharmacy delegation consistent across both versions.
- Assignments: assign Required to sg-Intune-Pilot-Users (same as the original app).
On the Review + create tab, select Create.

You have successfully configured app supersedence to automatically upgrade from v1 to v2.

Task 2: Verify app supersedence behavior

On SEA-DEV1, force a device sync.
Wait 10–15 minutes for Intune to detect the supersedence relationship and upgrade the app.
In the Microsoft Intune admin center, navigate to Apps → All apps → 7-Zip v2.0.
Select Device install status and verify SEA-DEV1 shows Installed.
Navigate to 7-Zip (the original app) and select Device install status.
Verify the status shows Superseded or Not installed.

You have successfully verified app supersedence automatically replaced the old app with the new version.

Exercise 6: Create an App Protection Policy

Scenario

App Protection Policies (APP) secure corporate data on mobile devices and BYOD (bring-your-own-device) scenarios without requiring full device enrollment. You’ll create an APP for iOS/Android that prevents copy/paste, requires a PIN, and enforces conditional access.

Task 1: Create an iOS App Protection Policy

In the Microsoft Intune admin center, select Apps, and then select Protection.
Select + Create → iOS/iPadOS to create a new policy.
On the Basics tab, configure:
- Name: APP - iOS Data Protection
- Description: Protects corporate data in Microsoft apps on iOS devices
Select Next.
On the Apps tab, select + Select public apps.
In the app picker, search for and select:
- Microsoft Outlook
- Microsoft Teams
- Microsoft Word
- Microsoft Excel
- Microsoft PowerPoint
- Microsoft OneDrive
- Microsoft 365 Copilot
Select Select.
Select Next.
On the Data protection tab, configure:
- Data transfer:
  - Send org data to other apps: Policy managed apps
  - Save copies of org data: Block
  - Allow user to save copies to selected services: OneDrive for Business, SharePoint
  - Receive data from other apps: Policy managed apps
  - Restrict cut, copy, and paste between apps: Policy managed apps with paste in
- Encryption:
  - Encrypt org data: Require
- Functionality:
  - Sync policy managed app data with native apps or add-ins: Block
  - Printing org data: Block
  - Restrict web content transfer with other apps: Microsoft Edge
Select Next.
On the Access requirements tab, configure:
- PIN for access: Require
- PIN type: Numeric
- Select Minimum PIN length: 6
- Override biometrics with PIN after timeout: Require
- Work or school account credentials for access: Require
- Recheck the access requirements after (minutes of inactivity): 30
Select Next.
On the Conditional launch tab, review the default conditions:
- App conditions:
  - Max PIN attempts: 5 (Action: Reset PIN)
  - Offline grace period: 1440 minutes (Action: Block access)
  - Offline grace period: 90 days (Action: Wipe data)
- Device conditions:
  - Jailbroken/rooted devices: (Action: Block access)
[!NOTE] These four rows are pre-populated defaults. You don’t need to add conditions.
Select Next and skip Scope tags.
On the Assignments page, under Included groups, select Add groups.
Search for and select sg-Intune-Pilot-Users.
Select Select.

[!NOTE] This page doesn’t include built-in All users or All devices assignments. Use Add groups under Included groups or Excluded groups.
Select Next.
On the Review + create tab, select Create.

You have successfully created an iOS App Protection Policy.

Task 2: Create an Android App Protection Policy

On the **App Protection** tab, select + Create → Android to create a new policy.
On the Basics page, configure:
- Name: APP - Android Data Protection
- Description: Protects corporate data in Microsoft apps on Android devices
Select Next.
On the Apps tab, select + Select public apps.
Search for and select the same Microsoft apps as the iOS policy (Outlook, Teams, Word, Excel, PowerPoint, OneDrive).
Select Select and then select Next.
On the Data protection tab, configure:
- Data transfer
  - Backup org data to Android backup services: Allow (default)
  - Send org data to other apps: change from the default All Apps to Policy managed apps
  - Save copies of org data: Block
  - Restrict cut, copy, and paste between apps: Policy managed apps with paste in
  - Transfer telecommunication data to: Any dialer app (default)
  - Transfer messaging data to: Any messaging app (default)
- Encryption
  - Encrypt org data: Require (default)
  - Encrypt org data on enrolled devices: Require (default)
- Functionality
  - Sync policy managed app data with native apps or add-ins: change from the default Allow to Block
  - Printing org data: change from the default Allow to Block
  - Restrict web content transfer with other apps: change from the default Any app to Microsoft Edge
[!NOTE] Leave Org data notifications (Allow) and Start Microsoft Tunnel connection on app-launch (No) at their defaults.
Select Next.
On the Access requirements tab, configure:
- PIN for access: Require (default)
- PIN type: Numeric (default)
- Simple PIN: Allow (default)
- Select minimum PIN length: change from the default 4 to 6
- Biometrics instead of PIN for access: Allow (default)
- Override biometrics with PIN after timeout: Require (default)
- Timeout (minutes of inactivity): 30 (default)
- Class 3 Biometrics (Android 9.0+): Not required (default)
- PIN reset after number of days: No (default)
- Select number of previous PIN values to maintain: 0 (default)
- App PIN when device PIN is set: Require (default)
- Work or school account credentials for access: Require
- Recheck the access requirements after (minutes of inactivity): 30
Select Next.
On the Conditional launch tab, review the default conditions and select Next.
On the Scope tags tab, select Next.
On the Assignments page, under Included groups, select Add groups and select sg-Intune-Pilot-Users.
Select Next → Create.

You have successfully created an Android App Protection Policy.

Task 3: Understand App Protection Policy enforcement

App Protection Policies are enforced at the application level, not the device level. Here’s how they work:

User installs a managed app (e.g., Outlook) from the App Store or Google Play.
User signs in with work account (user@<TenantPrefix>.onmicrosoft.com).
Intune recognizes the managed identity and applies the App Protection Policy.
User is prompted to set a PIN (6 digits or more).
App Protection controls are enforced:
- User cannot copy data from Outlook to personal apps (e.g., Gmail)
- User cannot save attachments outside OneDrive or SharePoint
- App data is encrypted at rest
- App is wiped if device is jailbroken/rooted
Conditional Access integration (optional): If combined with a Conditional Access policy, non-compliant users are blocked from signing in.

You now understand how App Protection Policies enforce data protection on mobile devices.

Exercise 7: Monitor app deployment and troubleshoot failures

Scenario

You’ll use the Intune admin center to monitor app deployment across all devices, identify failed installations, and troubleshoot common issues.

Task 1: Review app monitoring reports

In the Microsoft Intune admin center, navigate to Apps → Monitor → App protection status.
Review the App protection status report. It shows columns for each user, app, and platform combination.
In the breadcrumbs, select **Apps Monitor** to return to the list of reports.
Select App install status to open the report. The report lists the install status for apps, including those with failures, and includes these columns:
- App name
- Publisher
- Platform
- Version
- Install failure %
- Device failures
- User failures
Select the App name to open the app (e.g. 7-Zip v2.0), then under Monitor select Device install status.
Review the Status column for each device (see Status details for the reason on failures):
- Installed: The app installed successfully and passed its detection rule.
- Failed: The installation failed — check Status details for the error.
- Pending: The installation is in progress or awaiting the next device sync.
- Not installed: The app is not installed on the device.

You have successfully reviewed app monitoring reports.

Task 2: Investigate a failed app installation

[!NOTE] If you don’t have apps with install failures, use these steps for reference.

In the Microsoft Intune admin center, navigate to Apps → All apps.
Select an app that showed installation failures from the previous task (e.g., 7-Zip).
Select Device install status from the left navigation.
Locate a device with status Failed and select it.
Review the error details:
- Error code: Numeric code (e.g., 0x80070005 = Access Denied)
- Error message: Description of the failure
- Last modified: Timestamp of last installation attempt
Common failure reasons and resolutions:
- 0x80070005 (Access Denied): App installer requires elevation—set install behavior to “System” instead of “User”
- Detection rule not met: App installed successfully but detection rule failed—verify detection rule logic
- Download failed: Device has no internet connectivity or cannot reach Intune endpoints
- Disk space insufficient: Device does not have enough free space for installation

You have successfully investigated a failed app installation.

Task 3: Export app install status to CSV

In the Microsoft Intune admin center, navigate to Apps → Monitor → App install status.
Select an app from the list (e.g., Microsoft 365 Apps (Current Channel)).
On the Device install status page, select Export from the top toolbar, and then select Yes to confirm.
Wait for the export to complete (typically 1–2 minutes).
Open the exported .zip file (for example, DeviceInstallStatusByApp_<id>.zip). It contains the CSV report.
Open the CSV in Excel and review the columns:
- Device name
- UserPrincipalName
- Platform
- AppInstallState_Ioc (status) (Installed, Failed, In Progress)
- AppInstallStateDetails (error message)
- Last ModifiedDate

You have successfully exported app installation data for reporting.

Task 4: Diagnose an intentional app-assignment conflict

App assignment intents can collide just like configuration profiles can. The classic example is one admin marking an app Required for a broad group while another admin marks the same app Uninstall for an overlapping group. Intune flags this in the App install status view as a conflict, and neither install nor uninstall completes cleanly. You’ll deliberately create this situation, find it, and resolve it.

In the Microsoft Intune admin center, navigate to Apps → All apps → 7-Zip (the v1 app you deployed in Exercise 2 — not the v2.0).
Select Properties from the left navigation, then in the Assignments section select Edit.
Under Uninstall, select + Add group.
Search for and select sg-Intune-Pilot-Users (the same pilot cohort that already has 7-Zip v2.0 assigned as Required via supersedence). Select Select.
Select Review + save → Save.

[!IMPORTANT] The Uninstall assignment for 7-Zip and the Required assignment for 7-Zip v2.0 overlap. This intentionally creates a conflict.
Trigger a sync on SEA-DEV1 (Settings → Accounts → Access work or school → Sync). Wait 5–10 minutes for Intune to evaluate.
In Apps → All apps → 7-Zip, select Device install status. Locate SEA-DEV1 (or any pilot device) and observe the status — you should see Conflict or an explicit failure with an error message indicating multiple intents.

[!NOTE] You might see Conflict in the status column or a specific error in the per-device drill-in.
Resolve the conflict. The supersedence path is the correct one (v1 → v2.0 is automatic), so remove the redundant Uninstall assignment on v1:
- On 7-Zip → Properties → Assignments → Edit.
- Under Uninstall, hover over sg-Intune-Pilot-Users and select the Remove icon (trash can).
- Select Review + save → Save.
Trigger another sync on SEA-DEV1, wait 5–10 minutes, and re-check Device install status on 7-Zip v2.0. Confirm SEA-DEV1 shows Installed with no remaining conflict on the v1 app.

You have successfully diagnosed and resolved an app-assignment conflict.

Lab Summary

Congratulations! You’ve completed Lab 03: Manage applications.

In this lab, you accomplished the following:

Exercise 1: Deploy Microsoft Store apps

Added a Microsoft Store app (Microsoft To Do) to Intune
Assigned the app as Required to automatically install on devices
Verified installation on a managed device

Exercise 2: Package and deploy a Win32 application

Packaged a Win32 app using the Intune Win32 Content Prep Tool
Created a custom file-based detection rule
Tagged the deployment with the Pharmacy scope tag for delegated administration
Deployed the app to pilot users and monitored installation status

Exercise 3: Deploy Microsoft 365 Apps

Configured Microsoft 365 Apps with Current Channel updates
Assigned the suite to all Windows devices
Monitored the large app deployment process

Exercise 4: Use the Enterprise App Catalog

Browsed the Enterprise App Catalog (Intune Suite or Microsoft 365 E5 feature)
Added Google Chrome with pre-configured settings and detection rules
Deployed the app as Available in the Company Portal

Exercise 5: Configure app supersedence

Created a newer version of an app (tagged Pharmacy)
Configured a supersedence relationship to automatically replace the old version
Verified automatic upgrade behavior on devices

Exercise 6: Create an App Protection Policy

Created iOS and Android App Protection Policies
Configured data protection controls (copy/paste restrictions, encryption, PIN requirements)
Understood how APP enforces data protection without device enrollment

Exercise 7: Monitor app deployment and troubleshoot failures

Reviewed app monitoring reports
Investigated failed app installations and interpreted error codes
Exported app install status data to CSV for reporting
Diagnosed and resolved an intentional Required vs. Uninstall app-assignment conflict

Key Takeaways:

Microsoft Store apps provide modern, lightweight application deployment
Win32 apps require packaging with the Content Prep Tool and custom detection rules
Microsoft 365 Apps deployment includes update channel configuration for phased rollouts
Enterprise App Catalog (Intune Suite or Microsoft 365 E5) simplifies third-party app deployment with pre-configured installers
App supersedence automates application upgrades without manual uninstall/reinstall
App Protection Policies secure corporate data on mobile/BYOD devices without full enrollment
Scope tags carry through the app surface just like configuration and compliance — tag clinical/regulated apps at create time so delegated admins (Pharmacy Helpdesk, Lab 05) can manage them
App assignment conflicts (Required vs. Uninstall on overlapping groups) surface in App install status; resolve by removing the redundant intent and using audit logs (Lab 05) to find who introduced it
Intune provides comprehensive monitoring and troubleshooting for app deployment

Next Steps: In Lab 04, you’ll protect devices using Microsoft Defender for Endpoint integration, endpoint security policies, BitLocker encryption, Microsoft Tunnel Gateway, and Microsoft Cloud PKI.

END OF LAB