Adding and Assigning Win32 Apps to Intune (Wrapping)

Overview

This article provides a step-by-step guide on packaging and deploying Win32 applications using Microsoft Intune.

Prerequisites

An active Intune subscription
The IntuneWinAppUtil.exe wrapper tool (downloadable from GitHub)
The Win32 application you wish to deploy (in this example, we'll use Cloudflare)
Administrative privileges on the target devices

Please review the Application types here: Specific App Type Details. For Win32 Apps, please review this: Prepare Win32 app content for upload

Step 1: Prepare the Application

Create Install and Uninstall Scripts:
1. Create an install.cmd and uninstall.cmd file for your application. Intune will use these scripts to install and uninstall the application on target devices.
2. For MSI-based applications, you can use the msiexec command with the appropriate parameters in your scripts. You can find the uninstall property code by opening the MSI file in Orca and navigating to Property > Uninstall Property.

A computer screen shot of a blue screenDescription automatically generated

Create an install.cmd and uninstall.cmd.

A screenshot of a computerDescription automatically generated

As you're going through this process, capturing the build is necessary. Use this link: Applications to store information about the app build you're making. Create a folder with an appropriate name. For instance, a new build of Forticlient would have a respective folder:

and inside the folder we have two screen shots: build.PNG and apputil.PNG (this is the bare minimum to document)

build.PNG - should include screenshot of build content folder, install command switches, uninstall command switches, any additional referenced material, transform files...etc... as shown below

apputil.PNG - should include screenshot of IntuneWinAppUtil at the time of packaging (if packaged with IntuneWinAppUtil.exe as shown below in step 2)

2. Package the Application:

Use the IntuneWinAppUtil.exe wrapper tool to package the application and its associated scripts into an .intunewin file, which will be uploaded to Intune.

A computer screen shot of a blue screenDescription automatically generated

Note: The file created install.Intunewin will be the file we upload to Intune Apps.

Navigate to "All Apps" in the left-hand menu, and then Create

Choose the app type you want to add. In this case, select "Windows app (Win32)" and then press the select button. You can review the different application types here:

A screenshot of a computerDescription automatically generated

A screenshot of a computer errorDescription automatically generated

Click on “Select app package file” and then browse to the .intunewin file you’ve created for this application

A screenshot of a computerDescription automatically generated

2. Configure App Information:

Fill in the Name, Description, and Publisher fields.
Specify the install.cmd and uninstall.cmd files.
Choose the appropriate OS architecture (32-bit or 64-bit).
Select the Minimum operating system required by the application. This information is in the MSI file under Property > InstallPrerequisites or LaunchCondition.

A screenshot of a computer screenDescription automatically generated

Fill out install.cmd and uninstall.cmd; the rest are at your discretion.

A screenshot of a computerDescription automatically generated

Choose OS architecture

A screenshot of a computer programDescription automatically generated

Choose the Minimum operating system (can be found in MSI with Orca under Property > InstallPrerequisites or LaunchCondition)

*if none specified, can just choose the first one*

A screenshot of a computerDescription automatically generated

3. Set Up Detection Rules:

Detection rules determine whether the application is already installed on a device.
You can use various detection methods, such as file existence, registry keys, or MSI product codes.
In this example, we'll use a registry value to detect the presence of Cloudflare.

Setup Detection Rules

A screenshot of a computerDescription automatically generated

For this example, we will use the registry value.

A screenshot of a computerDescription automatically generated

How the detection method logic works:

A yellow text on a white backgroundDescription automatically generated

If it doesn't find our provided registry value, it will fail and install the app.

If it does find the registry value we provided, it will pass and skip installation.

4. Configure Dependencies, Supersedence, and Scope Tags (Optional):

You can specify any dependencies the application requires, such as the .NET Framework. Dependencies make sure the program doesn't install until those dependencies are met or installed first.
You can also configure supersedence to replace an older application version with the new one.
Scope tags can be used to limit the deployment to specific devices or users.

We will skip dependents in this example, but you could have .NET Framework as a dependency.

Supersedence: we could select this Cloudflare app to supersede a previous Cloudflare app, but it's not required, so we're skipping it.

Scope tags can limit tagged assets; however, we will skip and rely on Assignments.

Step 3: Assign the Application

Select Assignment Type:
1. Required: Forces the installation of the application on assigned devices.
2. Available: Makes the application available for users to install from the Company Portal.
3. Uninstall: Uninstall the application from assigned devices.
Choose Assignment Groups:
1. Select the user or device groups to which you want to assign the application.

Required will force the installation to assigned groups via Intune client.

Available will make the installation available via the company portal.

Uninstall will make the app uninstall from devices in the selected groups if Intune has previously installed the application onto the device via an "Available for enrolled devices" or "Required" assignment using the same deployment.

A screenshot of a computerDescription automatically generated

For All new applications, please assign as "Available for enrolled devices" to test group with the SG-INT-APP* prefix

(be sure to clean up & remove old test groups when done)

You can further configure the assignment details by clicking one of the links (such as "As soon as possible")

Review all the details of the application you have built and then click the blue Create button. Once your application has been added to Intune, you can hop to one of the clients in the targeted assignments groups and force a client sync. This will initiate the client to reach out for the latest assignments. You can do this by clicking Start > Settings > Accounts > Access work or school > clicking the DXU domain entry then info as shown:

Scroll down and select Sync

After successful sync you can check company portal for the application you've published to your test machines

We can cover troubleshooting failed apps in another topic.

Version 1.0 | January 24, 2025 | Author: Keith Franz, System Administrator III