If the installer shows a dialog box, it is not deployable. Microsoft does not support interactive installations, and the workarounds are not supported either.
Win32 apps are packaged into the intunewin format, delivered by the Intune management extension, and controlled with detection rules, requirements, dependencies and supersedence. The rules that trip people up are specific and documented: silent install only, 30 GB per app, 50 KB scripts, and a grace period that defaults to 24 hours.
- Silent onlyInteractive installations are not supported
- 30 GBMaximum Windows application size per app
- HourlyHow often the extension checks for assignments
- 24 hoursDefault restart grace period, up to two weeks
Seven things that decide whether a Win32 deployment succeeds or produces tickets.
Interactive installations are not supported, and neither are the workarounds
Microsoft states this in unusually firm language. Applications deployed through Intune must install silently and cannot require user interaction such as dialog boxes, prompts or interface input during installation. Techniques that force interaction with the signed-in user session, with serviceui.exe named as an example, are not supported and may produce inconsistent or unpredictable behaviour.
The intunewin format, produced by the content prep tool
Before adding a Win32 app you prepare it using the Microsoft Win32 Content Prep Tool, which converts the installation files into the intunewin format. That step is what allows multi-file installers to be handled properly, and Microsoft advises using the Win32 app type exclusively when you have a multiple-file installer rather than mixing it with the line of business app type.
Detection rules, requirements, dependencies and supersedence
Microsoft lists support for detection rules, dependencies and requirements alongside control for complex installations. The relationship viewer shows which applications are directly connected to a selected app as child apps, designated as dependent applications and superseded applications, for both Windows app Win32 and Windows catalog app Win32 types.
A PowerShell script can be the installer
Instead of specifying a command line, you can upload a script that Intune packages with the app content and runs in the same context as the app installer. Microsoft names the scenarios: prerequisite checks before installation, configuration changes during installation, post-install actions and validation, and complex conditional logic based on device state. Scripts are limited to 50 kilobytes.
Deadlines behave differently from what the Company Portal shows
Microsoft states that an app configured with an install deadline is downloaded but does not install until the deadline, and that the Company Portal does not provide this level of detail, showing installing as soon as the download completes. Where several assignments apply, a specific deadline is picked over the earliest time possible, and an earlier specific deadline over a later one.
Delivery optimization is on by default
Windows devices can download Win32 app content using the delivery optimization component, which provides peer-to-peer functionality turned on by default. It can be configured for background or foreground mode based on assignment, through Intune device configuration or group policy, and a Microsoft Connected Cache server can cache the content on Configuration Manager distribution points.
Two behaviours that surprise administrators later
Win32 apps installed by Intune are not automatically uninstalled if the device is unenrolled from management, which is why Microsoft advises restricting assignment to corporate managed devices. And apps installed through the available for enrolled devices assignment are not automatically reinstalled by Intune if they are uninstalled from the device by any means.
Mixing Win32 and line of business apps during Autopilot enrolment can fail. During device preparation it is supported.
Microsoft explains both the mechanism and the exception, and the distinction between the two Autopilot paths is the part people miss.
- Quoted: if you mix the installation of Win32 apps and line-of-business apps during Windows Autopilot enrollment, the app installation might fail, as they both may attempt to use the Trusted Installer service at the same time, which causes a failure due to this conflict.
- Quoted, and this is the important half: however, mixing of Win32 and line-of-business apps during Windows Autopilot device preparation is supported. So the answer depends on which Autopilot path the organisation is using.
- Microsoft general advice is to consider using the Win32 app type exclusively when deploying Windows applications, particularly where you have a multiple-file Win32 app installer. In practice standardising on Win32 removes the whole class of problem.
- This matters because the symptom is a provisioning failure on a new device in front of a new starter, which is the most visible possible place for a deployment problem to appear and the hardest to reproduce afterwards.
Four things that separate a working package from one that produces tickets.
We triage for silent install before we package anything
Microsoft does not support interactive installations and explicitly does not support the tools people use to work around that. An application that cannot install silently needs a vendor conversation, a different version, or a different application. Discovering that at the triage stage costs an hour. Discovering it after packaging costs a week.
We get detection rules right, because both failure modes are bad
A detection rule that never matches produces an application that reinstalls on every evaluation cycle, which the extension runs hourly. A rule that matches too broadly produces an application that reports installed and is not. Testing detection on a clean device, and on a device where an older version exists, is what catches both.
We set restart behaviour deliberately rather than by default
The restart grace period defaults to 1,440 minutes, which is 24 hours, with a maximum of two weeks, a 15 minute countdown dialog and a 240 minute snooze that cannot exceed the grace period. Those are reasonable defaults and they are still defaults. For an application that restarts a machine, the values should be a decision.
We standardise on the Win32 type to avoid the provisioning conflict
Microsoft advises considering the Win32 app type exclusively, particularly with multiple-file installers, and documents that mixing Win32 and line of business apps during Autopilot enrolment can fail because both may attempt to use the Trusted Installer service simultaneously. Standardising removes an intermittent provisioning failure that is very hard to diagnose in the moment.
Four phases, and the application inventory always takes longer than anybody expects.
- 01Weeks 1 to 3
Inventory and triage
Every application currently deployed, how it is installed today, who owns it, and whether it can install silently. Applications that require user interaction during installation are separated immediately, because Microsoft does not support them and the supported answer is a vendor conversation rather than a workaround.
- Application inventory with an owner against each entry
- Silent install capability confirmed per application
- Applications over the 30 GB per app limit identified
- Candidates for the Enterprise App Catalog separated from custom packaging
- 02Weeks 4 to 8
Package, detect and test
Content prepared into intunewin format with the Win32 Content Prep Tool. Detection rules written so an already-installed application is recognised rather than reinstalled. Requirement rules for architecture and operating system. Dependencies and supersedence expressed rather than sequenced by hand.
- Packages built and detection rules verified on a clean device
- Requirement rules covering 32-bit, 64-bit and ARM64 where relevant
- Dependencies and supersedence mapped in the relationship viewer
- PowerShell installer scripts where conditional logic is genuinely needed
- 03Weeks 9 to 12
Assignment, deadlines and restart behaviour
Required, available or uninstall assignments decided per application and per population. Availability and deadline times set deliberately, understanding that an app with a deadline downloads immediately and installs later. Restart grace period configured where the application forces a restart, since the default is 24 hours.
- Assignment type and group decided per application
- Deadlines set with the multi-assignment selection rules understood
- Restart grace period, countdown and snooze values chosen
- End user notification level agreed per application
- 04Ongoing
Provisioning and lifecycle
The Autopilot application set reviewed against the Trusted Installer conflict, standardising on the Win32 type where possible. Then the lifecycle: supersedence for updates rather than parallel packages, and an owner for each application so the catalogue does not accumulate versions nobody removes.
- Provisioning application set validated end to end on a real device
- Supersedence used for version updates rather than new packages
- Delivery optimization mode set per assignment
- A named owner per application, with a review cadence
Six UAE situations where packaging quality is the constraint.
An organisation migrating from Configuration Manager
Applications packaged for Configuration Manager need re-preparing into the intunewin format with the Win32 Content Prep Tool, and their detection logic revisited. Microsoft notes that although cloud-connected customers can use Configuration Manager for Windows app management, Intune-only customers have greater management capabilities for their Win32 apps.
A business provisioning new devices without a build technician
Applications delivered during Autopilot are the whole promise of zero touch provisioning, and the Trusted Installer conflict between Win32 and line of business apps during enrolment is exactly what breaks it. Standardising on the Win32 type, and validating the provisioning set on a real device, is what makes the promise true.
An operator with large engineering or design applications
The 30 gigabyte per application limit is generous and it is a limit. Large computer-aided design and engineering suites are the applications most likely to approach it, and also the ones most likely to have complex prerequisites, which is where a PowerShell script installer with prerequisite checks earns its place over a plain command line.
A regulated firm that needs approval on application changes
Where Multi-Admin Approval is enabled, Microsoft notes you cannot upload PowerShell scripts during application creation and must create the app first then add or modify scripts afterwards. Knowing that before the packaging engineer hits an unexplained error saves a support case and a certain amount of frustration.
An institution deploying to devices on constrained links
Delivery optimization provides peer-to-peer functionality turned on by default and can be configured for background or foreground mode based on assignment. Where a site has many devices behind a modest link, that plus a Microsoft Connected Cache server on a Configuration Manager distribution point is the difference between a manageable rollout and a saturated line.
An organisation worried about applications on leaving devices
Microsoft states that Win32 apps installed by Intune are not automatically uninstalled when a device is unenrolled from management, and advises restricting application assignment and installation to corporate managed devices to reduce the risk of applications and data becoming unmanaged. That is an assignment design decision rather than a technical limitation.
How UAE organisations deploy Windows applications.
| Feature | Packaged and lifecycle managed | Partly packaged, partly manual | Manual or Configuration Manager only |
|---|---|---|---|
Applications install without a technician | Yes | Partly | No |
Detection prevents reinstall loops | Yes | Sometimes | Not applicable |
Dependencies expressed rather than sequenced | Yes | No | Manually |
Version updates use supersedence | Yes | No | Different mechanism |
Restart behaviour controlled | Yes | Default | Varies |
Works during Autopilot provisioning | Yes | Sometimes fails | Not applicable |
Peer-to-peer content delivery | Yes | Default only | Distribution points |
Application ownership recorded | Yes | No | Sometimes |
New starter ready without manual work | Yes | Partly | No |
Effort per new application | Low | High for the hard ones | High |
Ten constraints worth knowing before you package anything.
| Constraint or behaviour | What Microsoft states | |
|---|---|---|
| Interactive installation | Not supported. Applications must install silently, and forcing user session interaction is unsupported | |
| Maximum application size | Windows application size must not be greater than 30 GB per app | |
| PowerShell installer script size | Limited to 50 KB | |
| Assignment check frequency | The Intune management extension agent checks every hour, or on service or device restart | |
| Device requirements | Enrolled in Intune and Microsoft Entra registered, joined or hybrid joined | |
| Windows edition | A supported Windows version in Enterprise, Professional or Education editions | |
| Architecture support | 32-bit Windows, 64-bit Windows and ARM64, plus Windows S mode devices | |
| Behaviour on unenrolment | Apps installed by Intune are not automatically uninstalled when a device is unenrolled | |
| Available assignment reinstall | Apps installed through Available for enrolled devices are not automatically reinstalled if removed | |
| Restart grace period defaults | 1,440 minutes default with a two week maximum, 15 minute countdown dialog, 240 minute snooze | |
| Multi-Admin Approval and scripts | Scripts cannot be uploaded during app creation. Create the app first, then add or modify scripts | |
| Deadline behaviour | The app downloads but does not install until the deadline, and the Company Portal does not show that distinction |
Five steps, and detection testing is where we spend the time.
- 1
Inventory applications and confirm they can be deployed
Every application, its owner, how it installs today, and whether it can install silently, since Microsoft does not support interactive installations or the tools used to work around them. Anything over 30 gigabytes is flagged, and anything available in the Enterprise App Catalog is separated from the custom packaging list.
- 2
Package into intunewin and write the rules
Content prepared with the Microsoft Win32 Content Prep Tool. Detection rules written and tested both on a clean device and on one with an older version present. Requirement rules for architecture and operating system version. Dependencies and supersedence expressed in the product rather than managed by hand in a runbook.
- 3
Use script installers only where they earn it
Where an application needs prerequisite validation, configuration changes during installation, post-install actions or conditional logic based on device state, a PowerShell script installer replaces the command line. Kept under the 50 kilobyte limit, running silently, with return codes mapped so success and failure report correctly.
- 4
Design the assignment and the user experience
Required, available or uninstall per population. Availability and deadline times, remembering that a deadline means the content downloads immediately and installs later while the Company Portal shows installing throughout. Restart grace period, countdown and snooze values chosen. Notification level set per application rather than globally.
- 5
Validate provisioning and hand over the lifecycle
The full provisioning application set tested end to end on a real device, checking the Autopilot behaviour rather than assuming it. Then supersedence established as the update mechanism, delivery optimization mode set, and a named owner per application so the catalogue stays current rather than accumulating.
What organisations ask about Win32 app deployment.
Fifteen questions per application.
Can it be deployed at all
- Does it install silently?Interactive installs are not supported.
- Is it under 30 GB?That is the published per-app limit.
- Which architectures does it need?32-bit, 64-bit and ARM64 are supported.
- Is it in the Enterprise App Catalog?Then custom packaging may be unnecessary.
- Who owns it in the business?Someone has to approve changes.
Packaging
- How will detection work?A wrong rule reinstalls forever or never installs.
- Are there dependencies?Express them rather than sequencing manually.
- Does it supersede an older package?Supersedence handles version transitions.
- Does it need a script installer?Under 50 KB, and silent.
- Is Multi-Admin Approval enabled?Then scripts are added after app creation.
Deployment experience
- Required, available, or uninstall?Available apps are not auto-reinstalled.
- Is there an install deadline?It downloads first and installs at the deadline.
- Does it force a restart?Then set the grace period deliberately.
- What notifications should users see?Three published options.
- Is it in the provisioning set?Check the Autopilot mixing behaviour.
The pages around this one.
Enterprise app management
The Enterprise App Catalog, and the applications you may not need to package at all.
Windows Autopilot
The provisioning path where application deployment is most visible and most fragile.
Microsoft Intune
The product overview and how application management fits the wider platform.
List the applications your team still installs by hand. That list is the project.
In most organisations it is between five and fifteen applications, and it is the reason a technician still touches every new device. Triaging it for silent install capability takes a day and tells you exactly how far automation can go.
Related Services
Explore more solutions that work great with this service
Enterprise App Management
Hundreds of prepared Win32 apps, and the limits of auto-update
Windows Autopilot Dubai
Zero-touch laptop deployment, supplier registration onward
Microsoft Intune
Device management and endpoint security
Intune Configuration Profiles
Settings catalog, templates and conflict management
SCCM to Intune
Co-management, where you get value without moving any workload
Zero-Touch Deployment UAE
Sealed box to working device without IT touching it
MDM Solutions Dubai
Device management across Windows, Apple and Android
Windows Autopatch
Security updates without a restart, and Business Premium has it