DOCSEARCHbyAlgolia
Submit Docs

IntuneWin32App PowerShell Module

repository·master·Indexed 19 days ago

https://github.com/msendpointmgr/intunewin32app

A PowerShell module that automates the packaging, creation, and publishing of Win32 applications in Microsoft Intune. It provides functionality to create .intunewin packages, extract MSI metadata, configure detection and requirement rules, and manage app assignments via Microsoft Graph API. Key functions include New-IntuneWin32AppPackage, Add-IntuneWin32App, and Set-IntuneWin32App.

Tokens
8.1K
Snippets
18
Records
32
Agent score
17%

What's inside IntuneWin32App

  1. Use specialized detection rule functions instead of New-IntuneWin32AppDetectionRule (v1.2.0)

    master

    In version 1.2.0, the generic New-IntuneWin32AppDetectionRule function was deprecated. You should now use specific functions for the type of detection rule you are creating:

    • New-IntuneWin32AppDetectionRuleMSI
    • New-IntuneWin32AppDetectionRuleRegistry
    • New-IntuneWin32AppDetectionRuleFile
    • New-IntuneWin32AppDetectionRuleScript

  2. Standardized Output Behavior for GET Operations

    master

    As of version 1.5.0, the module follows a standardized output pattern to ensure pipeline compatibility:

    • Collection-Returning Functions: Functions like Get-IntuneWin32App, Get-IntuneWin32AppAssignment, Get-IntuneWin32AppDependency, Get-IntuneWin32AppSupersedence, and Get-IntuneWin32AppCategory now return an empty array @() instead of $null when no results are found.
    • Single Object Functions: Functions returning a single object (e.g., Get-IntuneWin32App with an ID or Get-IntuneWin32AppMetaData) return $null with a verbose message if the object is not found.
    • Boolean Functions: Functions like Get-IntuneWin32AppRelationship, Test-AccessToken, and Test-AuthenticationState explicitly return $true or $false in all code paths.

  3. Configure Win32 App Requirements and OS Versions

    master

    When creating requirement rules, the MinimumSupportedOperatingSystem parameter has been replaced by MinimumSupportedWindowsRelease in the New-IntuneWin32AppRequirementRule function.

    To specify the operating system, use the new prefix-based values to distinguish between Windows 10 and Windows 11:

    • Use W10_ prefix for Windows 10 versions.
    • Use W11_ prefix for Windows 11 versions.

  4. Use specialized assignment functions instead of Add-IntuneWin32AppAssignment (v1.2.0)

    master

    In version 1.2.0, the Add-IntuneWin32AppAssignment function was deprecated. Instead, use the following specific functions based on your target type:

    • Add-IntuneWin32AppAssignmentAllDevices
    • Add-IntuneWin32AppAssignmentAllUsers
    • Add-IntuneWin32AppAssignmentGroup

    These new functions also support restart settings, including available and deadline configurations.

  5. Authenticate with Connect-MSIntuneGraph

    master

    Version 1.5.0 introduced several authentication flows using native OAuth 2.0. You can now use the following methods to connect:

    • Interactive (Authorization Code flow with PKCE): The default interactive flow.
    • Device Code flow: Use the -DeviceCode parameter for environments without a browser.
    • Client Credentials flow: For service principal authentication (modern automation).
    • Client Certificate authentication: For certificate-based authentication.
    • Silent Refresh: Use the -Refresh parameter to renew tokens using a stored refresh token.

    You can also customize requested permissions using the Scopes parameter. The default scopes include:

    • DeviceManagementApps.ReadWrite.All
    • DeviceManagementConfiguration.ReadWrite.All
    • DeviceManagementRBAC.Read.All
    • Group.Read.All
    • offline_access
    # Example: Connecting via Device Code flow
Connect-MSIntuneGraph -ClientID "YOUR_CLIENT_ID" -TenantID "YOUR_TENANT_ID" -DeviceCode

# Example: Connecting and refreshing a token
Connect-MSIntuneGraph -ClientID "YOUR_CLIENT_ID" -TenantID "YOUR_TENANT_ID" -Refresh

  6. Create a new EXE or Script-based Win32 app in Intune

    master

    When deploying EXE or script-based applications, you must provide -InstallCommandLine and -UninstallCommandLine. Detection rules for scripts are created using New-IntuneWin32AppDetectionRuleScript.

    # 1. Get metadata
$IntuneWinFile = "C:\Win32Apps\Output\Enable-BitLockerEncryption.intunewin"
$IntuneWinMetaData = Get-IntuneWin32AppMetaData -FilePath $IntuneWinFile

# 2. Setup variables
$DisplayName = "Enable BitLocker Encryption 1.0"
$RequirementRule = New-IntuneWin32AppRequirementRule -Architecture "x64x86" -MinimumSupportedWindowsRelease "20H2"

# 3. Create PowerShell script detection rule
$DetectionScriptFile = "C:\Win32Apps\Output\Get-BitLockerEncryptionDetection.ps1"
$DetectionRule = New-IntuneWin32AppDetectionRuleScript -ScriptFile $DetectionScriptFile -EnforceSignatureCheck $false -RunAs32Bit $false

# 4. Define command lines
$InstallCommandLine = "powershell.exe -ExecutionPolicy Bypass -File .\Enable-BitLockerEncryption.ps1"
$UninstallCommandLine = "cmd.exe /c"

# 5. Add the app to Intune
Add-IntuneWin32App -FilePath $IntuneWinFile -DisplayName $DisplayName -Description "Start BitLocker silent encryption" -Publisher "MSEndpointMgr" -InstallExperience "system" -RestartBehavior "suppress" -DetectionRule $DetectionRule -RequirementRule $RequirementRule -InstallCommandLine $InstallCommandLine -UninstallCommandLine $UninstallCommandLine -Verbose

  7. Remove specific Win32 app assignments

    master

    Starting in v1.5.0, you can selectively remove assignments for a Win32 app without affecting other assignment types. Use Remove-IntuneWin32AppAssignmentAllUsers to remove 'All Users' assignments and Remove-IntuneWin32AppAssignmentAllDevices to remove 'All Devices' assignments. Group-based assignments remain untouched when using these commands.

    # Get Win32 app
$Win32App = Get-IntuneWin32App -DisplayName "7-Zip" -Verbose

# Remove all 'All Users' assignments (available, required, uninstall)
Remove-IntuneWin32AppAssignmentAllUsers -ID $Win32App.id -Verbose

# Remove all 'All Devices' assignments
Remove-IntuneWin32AppAssignmentAllDevices -ID $Win32App.id -Verbose

  8. Update existing Win32 apps post-deployment

    master

    Use Set-IntuneWin32App to modify properties of an existing Win32 application in Intune. You can update detection rules, app icons, installation/uninstallation command lines, and requirement rules. To perform updates, first retrieve the app object using Get-IntuneWin32App to obtain its id.

    # Get existing Win32 app
$Win32App = Get-IntuneWin32App -DisplayName "7-Zip" -Verbose

# Update detection rule
$NewDetectionRule = New-IntuneWin32AppDetectionRuleFile -Path "C:\Program Files\7-Zip" -FileOrFolderName "7z.exe" -FileDetectionType "exists"
Set-IntuneWin32App -ID $Win32App.id -DetectionRule $NewDetectionRule -Verbose

# Update app icon
$IconFile = "C:\Win32Apps\Icons\new-icon.png"
$NewIcon = New-IntuneWin32AppIcon -FilePath $IconFile
Set-IntuneWin32App -ID $Win32App.id -Icon $NewIcon -Verbose

# Update install and uninstall commands
Set-IntuneWin32App -ID $Win32App.id -InstallCommandLine "msiexec /i setup.msi /quiet" -UninstallCommandLine "msiexec /x {GUID} /quiet" -Verbose

# Update requirement rule for ARM64 support
$NewRequirementRule = New-IntuneWin32AppRequirementRule -Architecture "AllWithARM64" -MinimumSupportedWindowsRelease "W10_21H2"
Set-IntuneWin32App -ID $Win32App.id -RequirementRule $NewRequirementRule -Verbose

  9. Configure Win32 app requirement rules (v1.1.0)

    master

    To add customized requirement rules to a Win32 app, use the New-IntuneWin32AppRequirementRule function to create a requirement rule object, then pass it to the -RequirementRule parameter of Add-IntuneWin32App.

    Note: As of v1.1.0, New-IntuneWin32AppRequirementRule does not support 'Additional requirement rules'.

    If the -RequirementRule parameter is omitted in Add-IntuneWin32App, the following defaults are applied:

    • applicableArchitectures: x64,x86
    • minimumSupportedOperatingSystem: v10_1607
    # Example workflow for v1.1.0+
$rule = New-IntuneWin32AppRequirementRule -[parameters]
Add-IntuneWin32App -[other-params] -RequirementRule $rule

  10. Assign Win32 apps to Users, Devices, or Groups

    master

    You can create assignments for existing or newly created Win32 apps. Assignments default to 'As soon as possible' for both installation deadline and availability. Supported targeting includes:

    • Groups: Use Add-IntuneWin32AppAssignmentGroup with the -Include flag and a -GroupID.
    • All Users: Use Add-IntuneWin32AppAssignmentAllUsers.
    • All Devices: Use Add-IntuneWin32AppAssignmentAllDevices.

    Common parameters for these functions include -Intent (e.g., 'available', 'required') and -Notification (e.g., 'showAll').

    # Get a specific Win32 app by it's display name
$Win32App = Get-IntuneWin32App -DisplayName "7-zip" -Verbose

# Add an include assignment for a specific Entra ID group
$GroupID = "<Entra ID group ID>"
Add-IntuneWin32AppAssignmentGroup -Include -ID $Win32App.id -GroupID $GroupID -Intent "available" -Notification "showAll" -Verbose

# Add assignment for all users
Add-IntuneWin32AppAssignmentAllUsers -ID $Win32App.id -Intent "available" -Notification "showAll" -Verbose

# Add assignment for all devices
Add-IntuneWin32AppAssignmentAllDevices -ID $Win32App.id -Intent "available" -Notification "showAll" -Verbose

  11. Use AzCopy for Large Application Uploads

    master

    When using Add-IntuneWin32App, you can use the -UseAzCopy switch to transfer files to the storage account using AzCopy.exe instead of the native method. This is particularly useful for large applications.

    Note: The function includes logic to automatically fallback to the native file transfer method if the content size is less than 100MB.

    Add-IntuneWin32App -Path "C:\Apps\MyApp" -UseAzCopy

  12. Handle Token Expiration and Refresh

    master

    To prevent failures in long-running scripts (such as large application uploads), use the Test-AccessToken function to check if the current token is nearing expiration.

    By default, Test-AccessToken returns $false if the token is within 10 minutes of expiring. You can adjust this threshold using the RenewalThresholdMinutes parameter. It is recommended to use this check before performing operations that require an access token.

    if (Test-AccessToken -RenewalThresholdMinutes 15) {
    # Logic to refresh token or re-authenticate
}