Intune Enterprise App Catalog

What is "Intune Enterprise App Catalog" ?

Microsoft Intune Enterprise App Catalog apps are prepackaged Windows Win32 applications that can be discovered, added, deployed, and maintained directly from the Microsoft Intune admin center. The Enterprise App Catalog is part of Intune Enterprise App Management (EAM) and contains Microsoft and non-Microsoft applications that are prepared and hosted by Microsoft, including default installation commands, requirements, and detection rules to simplify app deployment.

Using Enterprise App Catalog apps helps reduce packaging effort, standardize application deployment, and keep applications current by making newer app versions available in the catalog. Once an app has been added to Intune, it can be assigned to users or devices like other Intune apps. Enterprise App Catalog apps are also supported with Windows Autopilot, where they can be selected as blocking apps in Enrollment Status Page and Device Preparation Page profiles.

Administrators should generally use the Microsoft-provided default settings for installation, uninstall, requirements, and detection. Changing these settings can cause installation failures or introduce unintended behavior. Organizations remain responsible for validating that catalog applications meet their internal security, compliance, and licensing requirements before deployment.

What do you need ?

EAM is not part of base Intune. It requires a subscription in addition to Intune Plan 1/Plan 2, and you get it one of three ways: 

·        As part of the Microsoft Intune Suite

·        As the standalone Enterprise App Management add-on SKU

·        Bundled into Microsoft 365 E5 – the change that makes this genuinely worth revisiting, because many already own E5

How to add an Enterprise App Catalog App

Open Intune portal and go to Apps > Windows

Click “+ Create”.
As App type, choose “Enterprise App Catalog app” and hit Select.

Now, find your application by clicking “Search the Enterprise App Catalog”

Start typing the app name in the search box

Select app

Select your app and hit Next

Configuration

Select your configuration and hit Next

Updates

You can choose between "Automatically update" or "Update with supersedence".

As you can read here, not much to change.

Here, you can do custom settings (but it is probably not needed).
You get more choices for assignments.

Automatically update

We will go with Automatically here.
We select "Automatically update" and then hit the "Select" button.

This brings us to the "App information" blade.

App information
Fields are pre-filled for the chosen application.
Hit Next.

Program

Fields are pre-filled, so Hit Next.

Requirements and Detection rules, nothing to do here.
This is because we have chosen “Automatically update”.

Supersedence

If you have no supersedence, hit Next.

Assignments

In this case, the app will be “Required”. This is again because of “Automatically update”.
Add your User- or device group and hit next.

Review + create

You get all the information about the app. If you are satisfied, hit the “Add app” button.

Now you have created an app, that will update itself when updates are available.

In the Windows apps view, you will see these applications listed as "Windows Auto Update Catalog App".

Update with supersedence.

If you had chosen “Update with supersedence”

App information
Fields are pre-filled for the chosen application.
Hit Next.

Program
Fields are pre-filled for the chosen application, but you can do changes.
Hit Next.

Requirements
Fields are pre-filled for the chosen application, but you can do changes.
Hit Next.

Detection rule
Fields are pre-filled, but you can do changes..

Supersedence

As this is an app where you will have to manage updates/new versions, you might have an old version that you can supersede.

Assignments

You will have more options as assignments:

Choose your preferred assignment type. Add user- or device group.

Review + create

Hit “Add App”, and you now have a new app.

Intune will let you know, that this is the latest version of the app.
But, as the Update Method is Supersedence, you will have to monitor for app updates and create new packages.

In your Windows apps view, these kind of application/updates will be listed as Windows catalog app (Win32).

Read more about Microsoft Intune Enterprise Application Management here:

Microsoft Intune Enterprise Application Management - Microsoft Intune | Microsoft Learn

Here you will also find a list of all available applications.

Comming soon - Cloud Rebuild

 

• Cloud rebuild is now introduced to Windows Insiders.
• Cloud rebuild is a new recovery option that restores a Windows 11 PC to a clean, known-good state by performing a full OS reinstall, even when Windows won’t boot. Unlike Reset this PC, Cloud rebuild downloads both the target Windows image and the device’s drivers from Windows Update, so the device comes back fully functional without USB media, without a custom image, and without depending on the health of the currently installed OS.

The new Cloud rebuild option in Windows Recovery Environment (WinRE), enabling a full Windows reinstall using files downloaded from Windows Update.
More about it here:

Cloud rebuild (Preview) | Microsoft Learn

App inventory for Windows devices in Microsoft Intune

 

“Discovered Apps” is now being replaced by “All apps”, and this is great news.

Discovered apps did not show real-time inventory. It only gave a count of what was installed across enrolled devices. It refreshed slowly and it only collected a basic set of data.

With the April update...

Microsoft changed both the upload model and the underlying data platform. The new app inventory is built on the same modern data platform that device inventory introduced. That platform was designed for continuous, high-frequency data collection, which gives it more capacity and lower latency than what Discovered apps ran on. The result is that data arrives in the portal faster and the infrastructure can handle the volume of a constantly updating fleet without degrading.

The agent only uploads what changed since the last sync (not sending a full snapshot). This is why multiple updates per day per device is possible without generating proportionally more traffic.

Windows devices get inventory updates multiple times per day. The agent does not wait for the regular MDM check-in, App inventory uploads run on their own schedule through the inventory channel.

For each app, the agent now collects the following (if registered at install time):

• Install path
• Install date
• Uninstall command
• Estimated size on disk
• Architecture (x86, x64, ARM64)
• Per-user install scope
• Store-specific identifiers
• Supported languages

How it works...

You create a Properties Catalog profile in the Intune admin center and assign it to devices. Intune then hands it off to "MMP-C" (Microsoft Management Platform – Cloud). MMP-C wraps the profile as a "Declared Configuration document" (WinDC) and queues it for delivery on the next device sync.

The Declared Configuration model works on desired state. The device gets a document that says what state it should be in and works toward that state. This is the same channel that delivers hardware inventory policies and the same one that Endpoint Privilege Management uses.

When the document lands on the device, it installs the "Microsoft Device Inventory Agent" if it is not there yet. The agent lives at C:\Program Files\Microsoft Device Inventory Agent and runs as a Windows service called "InventoryService".

The agent uses WMI queries to collect application data and writes everything into a local SQLite databases at C:\Program Files\Microsoft Device Inventory Agent\InventoryService\ .

The first harvest runs after a random delay. That is by design. After that first harvest, everything is incremental. Once the data reaches the Intune backend, it shows up in the "All Apps" tab per device.

How to set up...

You need a "Properties Catalog device configuration policy" assigned to corporate-owned Windows 11 devices enrolled in Microsoft Entra ID. Devices must be either Microsoft Entra joined or Hybrid joined.

Go to Devices > Windows > Configuration, click + Create > New Policy, select Windows 10 and later as the platform, and pick Properties Catalog as the profile type. 

Click Next, and give it a name. Then click Next to get to Configuration properties.

Click on + Add properties

Here we have the extended properties available for applications. Add all the properties available (Nothing is enabled by default). Enable the app-related entities from the catalog.

Add scope tags and assignments like any other configuration policy.

Once the policy reaches a device and the agent finishes its first harvest, data starts showing up in the All Apps tab on the next check-in. There is no policy status report for Properties Catalog. You will not see a green success indicator like you would for a settings catalog policy. You have to look at the device directly in All Apps or Resource Explorer to confirm that data is coming in.

If you delete the Properties Catalog policy later, the last collected data stays visible in Device Inventory for up to 28 days before it clears.

The new App Discovery experience

When going to a device in Intune (new device view experience), click on Tools and reports

Select "All Apps"

The new inventory view

You find the official documentation here:
App inventory for Windows devices - Microsoft Intune | Microsoft Learn