Packaging Your Windows Applications

We have configured our Windows policies and enrolled our devices, but in most environments, we are going to need to deploy some applications.

In this chapter, we are going to run through the different application types that are available and how to deploy them into your environment.

When managing Windows devices, applications are critical, and packaging them correctly will ensure a smooth experience for end users. By following this chapter, you will learn how to package and deploy applications to your devices using the modern methods supported by Intune.

In this chapter, we will cover the following recipes:

• Using the Microsoft Store integration
• Packaging into MSIX
• Packaging Win32 applications
• Managing app supersedence and dependencies
• Deploying Office applications
• Updating Office applications
• Windows app protection

Chapter materials

Before starting, we will not be covering MSI Line-of-business applications as it is best practice to wrap these into a Win32 application, which is extremely straightforward. There are a couple of reasons for this:

• MSI Line-of-Business applications execute using the standard msiexec service, whereas Win32 uses the Intune Management Extension (IME) to deploy. This means that neither is aware of the other, which can lead to clashes during Autopilot provisioning, where the installer service is busy on the other application.
• Win32 applications give significantly more functionality around requirements, detection, and supersedence, none of which are available with an MSI Line-of-Business deployment.

Assigning applications

We also need to look at assignment options as they are the same across all app types. We have the following three options:

• Required: This will force an install and will only appear in Company Portal under Installed Applications...

Technical requirements

For this chapter, you will need a modern web browser and a PowerShell code editor such as Visual Studio Code or PowerShell ISE.

All the scripts that will be referenced can be found here: https://github.com/PacktPublishing/Microsoft-Intune-Cookbook.

If you wish to test the policies, you will need a corporate-managed device running each device platform for testing. For Linux, it will need to be running Ubuntu.

Using the Microsoft Store integration

We start by looking at the Microsoft Store integration, which no longer uses the Microsoft Store for Business and instead integrates directly into the store source within Winget. This is also how Windows applications such as Notepad and Calculator are deployed and updated.

Important note

Store apps that are deployed via Intune will continue to receive updates even if the Windows Store is blocked for end users via a policy.

Fortunately, this change has also reduced the number of steps to deploy an application!

How to do it…

Follow these steps to deploy your first Windows Store application:

1. To start, click Apps and then Windows.
2. Click Add.
3. In the fly-out, select Microsoft Store app (new) (it may just be called Microsoft Store app), and click Select.
4. Click Search the Microsoft Store app (new).
5. In the fly-out, search for the application you are looking for.

Important note

It is worth noting that...

Packaging into MSIX

MSIX is one of the newer packaging formats available and operates by monitoring an application installation, grabbing any changes to the filesystem, registry, and so on, and then wrapping them into a single file that can be installed at the user level. One advantage of MSIX is that you can use it as AppAttach on Azure Virtual Desktop environments to make applications available on a per-user level rather than having to install it directly onto the host machine in a multi-user environment.

Important note

An MSIX package can be reverted by the end user, do not package any applications that have a database included, as reverting will wipe any additions that have been made. Client-server apps are fine, but not those with databases built into them.

Getting started

There are some prerequisites for MSIX packages:

• Code signing certificate: All packages have to be signed before deployment. You have two options here – you can either purchase a public...

Packaging Win32 applications

Packaging into Win32 will be your primary method of application deployment, so this recipe is an important one to follow.

Getting started

Before we do any packaging, we need to keep our application source code tidy so that we can easily work out what is what when we need to update that weird and wonderful application in 2 years!

Important note

The packaging tool will grab every file in the Source directory you point it to, so make sure that the directory only has source files in it. If you point it at your Downloads folder, for example, you will find yourself wondering why a 2 MB installer is showing as 45 GB when packaged!

The packaging tool creates an intunewin file, which is effectively an encrypted ZIP file that uploads with a manifest into Azure Blob storage. When installing, your computer downloads, decrypts, and runs the installation specified.

This is entirely personal preference, but this folder layout works well:

...

Managing app supersedence and dependencies

This recipe looks at the functionality around application supersedence and application dependencies. As it involves amending existing applications we will not be looking at automating and instead why you would use these and how to implement them.

Application supersedence

When a new version of an application is released, you have a few available options:

• Replace the IntuneWin file with a new one and amend the detection method so that it matches the newer version
• Create a new application and swap the assignments
• Use application supersedence

Everything will work fine, but supersedence gives you the option to remove the previous version before installing, or just do a straight update. It also makes things easier to manage as you do not have to worry about duplicate assignments or monitoring multiple applications.

Dependencies

One drawback of Intune/Autopilot is their inability to sequence applications like Configuration...

Deploying Office applications

The Microsoft Office Suite of Applications (now known as Microsoft 365 apps) is more than likely one of the most important applications required on your devices. For that reason, we need to be sure they are deployed correctly, reliably, and ideally forced on the Enrollment Status Page (ESP).

Getting started

Within Intune, there are three different ways to deploy Microsoft 365 apps, one of which is a lot more consistent than the other. The best method is to wrap it as a Win32 application using the Office Deployment Tool (ODT). We will cover this in this recipe as we can then control the deployment of it during the ESP. We also know it will be installed using the Intune Management Extension (IME), which prevents applications from clashing.

Before we look at how to deploy as a Win32 application, we should look at the other options available within the portal – that is, using the graphical user interface (GUI) with either configuration designer...

Updating Office applications

Now that we have deployed our Office applications, we need to make sure they remain updated. As these are core apps, it is recommended to use a similar ring approach as what we used with Windows updates, both to check for any potential issues with the line of business and also to look for any significant UI changes that may need communicating with the organization.

Getting started

Before running through the preferred approach, there are different ways to handle Office updates. We will have a look at the two main options now and then run through the configuration.

Office portal

One option is to use the Office Admin portal itself, which can be accessed at https://config.office.com.

Here, you can configure Office policies to set any configuration setting via Policy Management and also use the Cloud Updates menu to handle updates and version deployment.

This is a good option, but as it falls outside of the Intune portal, it is another portal...

Windows app protection

With more users accessing corporate data from personal devices, application protection is more important than ever.

At the time of writing, Windows Mobile Application Management (MAM) is a new addition and only supports the Microsoft Edge browser. For that reason, we are going to configure MAM in this recipe and then also add conditional access policies to block anything that is not Microsoft Edge for personal devices.

Getting started

The first thing to watch here is that personal devices are not allowed to enroll in Microsoft Intune; otherwise, they will bypass the conditional access rules. This will be covered in Chapter 13, Tenant Administration.

How to do it…

Follow these steps to configure Windows application protection:

1. The first step is to enable MAM across the tenant. This only has to be done once.
2. In Tenant administration, click on Connectors and tokens and then Mobile Threat Defense.
3. Add a connector for Windows...