How to deploy a Win32 app with Intune

Deploying a Win32 app with Intune is four decisions wrapped around one upload: what the install and uninstall commands are, how Intune detects that the app is present, what the device must look like before it tries (requirements), and who gets it (assignment). Get detection right and everything else is straightforward; get it wrong and you spend a week reading IntuneManagementExtension.log.

The deeper treatment — packaging conventions, supersedence, dependencies, and how the Enrollment Status Page orders installs — is in Intune Win32 app deployment. Microsoft 365 Apps themselves have a dedicated app type covered in Intune app deployment for Microsoft 365 Apps.

Prerequisites

Intune Administrator or Application Manager role.
The installer (MSI or EXE) and its silent switches, tested by hand on a clean VM: msiexec /i app.msi /qn for MSI; vendor-specific for EXE (/S, /silent, /quiet — check the vendor docs, and test).
The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) on a packaging workstation.
The install and uninstall verified to exit with code 0 and to leave a reliable marker (a registry key under Uninstall, a versioned file) for detection.
A pilot device group, and the Intune Management Extension installed on target devices (it installs itself on first Win32 or PowerShell assignment).

Steps

Progress 0/4

1.Package the installer↓
2.Create the app↓
3.Assign↓
4.Sync a pilot device↓

Progress is saved in this browser only.

1. Package the installer

Put the installer and any supporting files in a folder by themselves, then:

Code

IntuneWinAppUtil.exe -c C:\Pkg\7zip -s 7z2400-x64.msi -o C:\Pkg\Out -q

The output .intunewin is an encrypted archive of the source folder. Keep the source folder and a README with the commands you used; you will need them for the next version.

2. Create the app

Intune → Apps → Windows → Add → Windows app (Win32). Upload the .intunewin. Fill in Name, Publisher, a Description users will see in Company Portal, and a logo.

Program:

Install command: msiexec /i "7z2400-x64.msi" /qn /norestart (or the EXE with its silent switches).
Uninstall command: msiexec /x "{product-code-GUID}" /qn /norestart — get the GUID from the MSI's properties or Get-Package.
Install behavior: System for machine-wide installs (the norm); User only for per-user installers that must run in the user context.
Device restart behavior: Determine behavior based on return codes; add the vendor's "success, reboot needed" code (3010 is already there for MSI).

Requirements: Operating system architecture: 64-bit, Minimum operating system: Windows 10 22H2 (or your floor). Add a disk space or registry requirement if the app genuinely needs it; do not add requirements that duplicate the assignment scope.

Detection rules: for an MSI, Rules format: Manually configure → MSI with the product code — Intune fills it from the package. For an EXE, a Registry rule on HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<key> → DisplayVersion → Version comparison: Greater than or equal to the version you are deploying. A File rule on the main executable with a version comparison is the alternative. Remember 32-bit apps live under WOW6432Node, and tick Associated with a 32-bit app on 64-bit clients accordingly.

Return codes: leave the defaults unless the vendor documents others.

3. Assign

Pilot: Required to INT-Devices-Windows-Pilot (or Available for enrolled devices to a user group so they can install from Company Portal on demand). Production: Required to All devices with a filter, or Available to All users, per the assignment model in bulk-assigning Intune policies. Add the app to the Enrollment Status Page blocking list only if a device is unusable without it — every ESP app adds minutes to provisioning.

4. Sync a pilot device

Devices → the device → Sync. Win32 apps install through the Intune Management Extension, which checks in roughly hourly; a sync from the device (Settings → Accounts → Access work or school → Info → Sync) is faster.

Verify

Apps → the app → Device install status shows Installed for the pilot; Failed rows show the return code and a link to the error detail.
On the device, C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log (open in CMTrace or the Support Center log viewer) shows the download, the install command, the exit code, and the detection result — in that order. Detection failing after exit 0 is the FAQ case.
Company Portal (for Available assignments) lists the app and installs it on request.

Roll back

Change the assignment to Uninstall for the same group to remove the app using the uninstall command — this is why the uninstall command has to be right from the start. Removing the assignment altogether leaves the app installed. For a bad package version, upload the corrected .intunewin, adjust detection, and let devices re-evaluate; use Supersedence (Properties → Supersedence) when the new version must uninstall the old one first.

Frequently asked questions

Should I deploy an MSI as a line-of-business app or as a Win32 app?

Win32, almost always. The LOB (MSI) app type is simpler but cannot have dependencies, requirements, custom detection, or install in a specific order during the Enrollment Status Page, and mixing LOB and Win32 apps on the same device during ESP causes ordering problems. Wrap the MSI as .intunewin and use msiexec in the install command.

Why does Intune say the app installed but the detection failed?

The installer ran and exited 0 but the detection rule did not find what it looks for — usually a wrong registry path (32-bit apps land under WOW6432Node), a version comparison that does not match the installed value, or a file path that includes a version number that changed. Run the detection check by hand on a device where the app is present, then fix the rule.

How do I update an app I already deployed with Intune?

Upload the new .intunewin to the same app (Properties → App information → App package file) and update the detection rule to the new version. Devices where the old version is detected will reinstall on next evaluation because detection now fails. For frequent updaters like browsers, use the Enterprise App Catalog in the Intune Suite or a winget-based approach instead of hand-packaging every release.