Silent installers deploy themselves. Everything else needs a vendor conversation first. That is the first law of Win32 packaging.
Intune wraps Windows applications in the intunewin format, ships them through its management extension, and governs them with detection, requirements, dependencies, and supersedence. Every number that matters here is published: silent installs only, a 30 GB per-app ceiling, 50 KB installer scripts, hourly assignment checks, and a reboot grace window starting at 24 hours.
- Silent onlyNo dialogs, prompts, or UI input allowed
- 30 GBPer-app ceiling on package size
- HourlyAssignment polling by the extension agent
- 24 hoursDefault reboot grace, extendable to two weeks
Seven mechanics behind every clean Win32 rollout.
The silent-install rule has no exceptions
Interactive installations are unsupported, full stop: no dialogs, no prompts, no UI input during install. Microsoft goes further and names the workaround category too, calling out serviceui.exe-style tools that force interaction with the signed-in session as unsupported and prone to erratic results. Deployability starts and ends with a working silent switch.
Everything ships as intunewin
The Microsoft Win32 Content Prep Tool transforms raw installer files into the intunewin package Intune requires. Multi-file installers survive the trip intact because of this step, and Microsoft recommends leaning on the Win32 app type alone, rather than blending it with the line-of-business type, whenever an installer spans multiple files.
Four relationship mechanisms replace tribal knowledge
Detection rules tell Intune an app is already present. Requirement rules filter by architecture and OS. Dependencies chain installs in the right order automatically. Supersedence retires old versions gracefully. The relationship viewer maps dependent and superseded child apps for both Win32 and Windows catalog Win32 types, so the web of connections stays visible.
Scripts can stand in for the install command
A PowerShell script may be uploaded in place of a command line; Intune bundles it with the content and executes it in the installer's own context. Microsoft's stated use cases: prerequisite checks, mid-install configuration, post-install validation, and device-state conditionals. The ceiling is 50 KB, silence is required, and return codes report the outcome.
What a deadline actually does
Set a deadline and the content downloads right away while installation waits for the appointed time. The Company Portal hides that nuance and displays installing the whole while. When several assignments target one device, specific deadlines outrank earliest time possible, and among specific deadlines the earliest one governs.
Content spreads peer-to-peer out of the box
Delivery optimization ships enabled by default, letting devices share Win32 content with each other, tunable per assignment between background and foreground modes. Organizations keeping Configuration Manager infrastructure can add a Microsoft Connected Cache server on distribution points to cache the same content locally.
Two lifecycle facts to plan around from day one
First: unenrolling a device leaves every Intune-installed Win32 app behind, which is why Microsoft advises limiting assignments to corporate managed devices. Second: an app delivered through the Available for enrolled devices assignment stays gone once a user removes it; Intune will not put it back on its own.
Win32 plus line-of-business apps can collide during Autopilot enrollment. The device preparation path is exempt.
Microsoft documents the root cause and the carve-out together, and telling the two Autopilot paths apart is what most troubleshooting threads get wrong.
- The cause, as published: during Windows Autopilot enrollment, a Win32 app and a line-of-business app may both reach for the Trusted Installer service simultaneously, and that contention can fail the app installation.
- The carve-out, as published: the same mix is supported during Windows Autopilot device preparation. Which path your provisioning uses determines whether this risk applies to you at all.
- Microsoft's broader recommendation is to lean on the Win32 app type by itself, especially for multi-file installers. Committing to that convention dissolves the conflict instead of scheduling around it.
- The stakes are reputational as much as technical: when this bug fires, it fires during a new employee's first hour on a brand-new laptop, and reproducing it later in a lab rarely succeeds.
Four habits that keep packages boring, in the best way.
Silent-install triage happens first, always
Interactive installers are dead on arrival per Microsoft, and so are the session-injection tools sometimes used to sneak them through. We test the silent switch before any packaging effort begins, because a one-hour triage finding beats the same finding after a full package, test cycle, and rollback.
Detection gets adversarial testing
The hourly evaluation cycle turns a never-matching detection rule into an infinite reinstall loop, while an over-broad rule marks absent software as present. We run every rule against a pristine machine and against one carrying the previous version, because each device type exposes a different failure.
Reboot settings are decisions, not inheritances
Out of the box: a 1,440 minute grace period, a 15-minute countdown, a 240-minute snooze capped by the grace window, with a two-week maximum available. We put those numbers in front of the app owner and record what they choose, because a surprise reboot during a client presentation is a governance failure, not a technical one.
One app type, zero Trusted Installer collisions
Because Microsoft documents the enrollment-time clash between Win32 and line-of-business installs, and endorses the Win32 type for multi-file installers anyway, we converge estates on Win32 across the board. The intermittent provisioning failure simply has no preconditions left to fire under.
Four phases, front-loaded on discovery.
- 01Weeks 1-3
Discovery and triage
We catalog what is deployed, how each app installs today, and who owns it. Anything that demands clicks during installation gets routed straight to a vendor discussion, since Microsoft supports neither interactive installs nor the tooling that fakes a user session.
- Application catalog with a named business owner per entry
- Silent install capability confirmed per application
- Packages near the 30 GB ceiling flagged for special handling
- Enterprise App Catalog matches split off from the custom queue
- 02Weeks 4-8
Package and prove
Installers convert to intunewin via the Content Prep Tool. Detection logic gets exercised on fresh devices and on machines holding prior versions, requirement rules cover the architectures in play, and dependency and supersedence links replace the old install-order runbook.
- Packages built with detection proven on clean hardware
- Requirement rules spanning 32-bit, 64-bit, and ARM64 as needed
- Dependency and supersedence links visible in the relationship viewer
- Script installers reserved for apps with genuine conditional logic
- 03Weeks 9-12
Assignment design
Each app gets a deliberate Required, Available, or Uninstall posture per audience. Deadline timing accounts for the download-now-install-later behavior, and any app that reboots hardware gets its grace period, countdown, and snooze values chosen rather than inherited.
- Assignment type and audience settled per application
- Deadline strategy aligned with the multi-assignment precedence rules
- Reboot grace, countdown, and snooze configured per app
- Toast notification level decided app by app
- 04Ongoing
Provisioning proof and steady state
The Autopilot app set gets exercised on physical hardware with the Trusted Installer collision in mind. From there, updates flow through supersedence, delivery optimization settings match each site's bandwidth reality, and owners keep the catalog from silting up with orphaned versions.
- Provisioning sequence validated on a real device end to end
- Supersedence adopted as the standard update path
- Delivery optimization mode tuned per assignment
- Ownership and review cadence recorded per application
Six US scenarios where packaging discipline pays for itself.
Leaving Configuration Manager behind
Legacy packages need conversion to intunewin through the Content Prep Tool, and detection logic built for the old platform needs a fresh look. Worth knowing: Microsoft states that Intune-only customers get greater Win32 management capabilities than cloud-connected Configuration Manager setups retain.
Sealed-box laptops for remote hires
Autopilot only delivers the no-touch experience if every provisioning app installs cleanly, and the documented Trusted Installer clash between Win32 and line-of-business types is the classic way it breaks. Converging on Win32 and rehearsing the sequence on real hardware protects the first-day experience.
Heavy CAD and engineering software
Multi-gigabyte design suites test the 30 GB per-app ceiling and usually arrive trailing prerequisite frameworks and license components. This is the territory where a PowerShell installer script, validating prerequisites and sequencing components inside its 50 KB budget, beats any single command line.
Change control under Multi-Admin Approval
Firms that enabled Multi-Admin Approval for their SOC 2 or CMMC change-management story inherit one documented wrinkle: script uploads are blocked at app creation time. The working sequence is create, then attach. A packaging engineer who knows this skips an afternoon of confusion.
Hundreds of devices, one thin circuit
School districts and campuses deploying to a building full of machines lean on delivery optimization's default peer-to-peer sharing, tuned per assignment, plus a Microsoft Connected Cache on existing distribution points. The WAN link stays breathable while the rollout proceeds.
Clinical software on devices that leave
Unenrollment does not uninstall: whatever Intune placed on a device stays there when management ends. Microsoft's advice, restricting assignment to corporate managed devices, doubles as HIPAA hygiene for covered entities that cannot allow clinical apps and cached PHI to walk out on a personal laptop.
Where US organizations stand on Windows app deployment.
| Feature | Packaged and lifecycle managed | Partly packaged, partly manual | Manual or Configuration Manager only |
|---|---|---|---|
Apps install without a technician | Yes | Partly | No |
Detection prevents reinstall loops | Yes | Sometimes | Not applicable |
Dependencies expressed rather than sequenced | Yes | No | Manually |
Version updates use supersedence | Yes | No | Different mechanism |
Restart behavior controlled | Yes | Default | Varies |
Works during Autopilot provisioning | Yes | Sometimes fails | Not applicable |
Peer-to-peer content delivery | Yes | Default only | Distribution points |
Application ownership recorded | Yes | No | Sometimes |
New hire ready without manual work | Yes | Partly | No |
Effort per new application | Low | High for the hard ones | High |
Twelve rules, straight from the documentation.
Constraint or behavior
Interactive installation
- What Microsoft states
- Not supported. Apps must install silently, and forcing user session interaction is unsupported
Constraint or behavior
Maximum application size
- What Microsoft states
- Application size must not be greater than 30 GB per app
Constraint or behavior
PowerShell installer script size
- What Microsoft states
- Limited to 50 KB
Constraint or behavior
Assignment check frequency
- What Microsoft states
- The management extension agent checks every hour, or on service or device restart
Constraint or behavior
Device requirements
- What Microsoft states
- Enrolled in Intune and Microsoft Entra registered, joined, or hybrid joined
Constraint or behavior
Windows edition
- What Microsoft states
- A supported Windows version in Enterprise, Professional, or Education edition
Constraint or behavior
Architecture support
- What Microsoft states
- 32-bit, 64-bit, and ARM64, plus Windows S mode devices
Constraint or behavior
Behavior on unenrollment
- What Microsoft states
- Apps installed by Intune are not automatically uninstalled when a device unenrolls
Constraint or behavior
Available assignment reinstall
- What Microsoft states
- Apps installed through Available for enrolled devices are not automatically reinstalled if removed
Constraint or behavior
Restart grace period defaults
- What Microsoft states
- 1,440 minutes default with a two-week maximum, 15-minute countdown dialog, 240-minute snooze
Constraint or behavior
Multi-Admin Approval and scripts
- What Microsoft states
- Scripts cannot be uploaded during app creation. Create the app first, then add or modify scripts
Constraint or behavior
Deadline behavior
- What Microsoft states
- The app downloads but does not install until the deadline, and the Company Portal does not show the difference
Five steps, with the deep effort in rule validation.
- 1
Catalog and qualify every application
Owner, current install method, and silent-install capability for each app, since interactivity disqualifies an installer outright. The 30 GB ceiling gets checked, and apps already served by the Enterprise App Catalog exit the custom pipeline early.
- 2
Convert, and write rules that tell the truth
The Content Prep Tool produces the intunewin packages. Detection rules face both a clean machine and an upgraded one, requirement rules encode architecture and OS floors, and dependency plus supersedence relationships get expressed where Intune can enforce them.
- 3
Reserve scripts for real conditional logic
Prerequisite validation, mid-install configuration, post-install checks, device-state branching: these justify a PowerShell installer script. Everything else keeps a plain command line. Scripts stay under 50 KB, run silent, and map return codes to honest outcomes.
- 4
Shape what users experience
Assignment types per audience, deadlines placed with the download-early-install-later behavior in mind, reboot grace and snooze values signed off by app owners, and notification levels tuned per app so users hear about restarts without drowning in toasts.
- 5
Rehearse provisioning, then govern the catalog
A physical device runs the full Autopilot sequence to expose any Trusted Installer contention before a new hire does. Handover establishes supersedence as the update path and a named owner per app, keeping the catalog current instead of cumulative.
What US organizations ask about Win32 app deployment.
Fifteen questions per application.
Can it be deployed at all
- Does it install silently?The non-negotiable entry requirement.
- Is it under 30 GB?The per-app ceiling.
- Which architectures does it need?32-bit, 64-bit, and ARM64 are covered.
- Is it in the Enterprise App Catalog?Skip custom packaging if so.
- Who owns it in the business?Changes need an approver.
Packaging
- How will detection work?Bad rules loop or lie.
- Are there dependencies?Chain them in the product.
- Does it supersede an older package?Version transitions have a mechanism.
- Does it need a script installer?50 KB ceiling, silent execution.
- Is Multi-Admin Approval on?Scripts attach only after creation.
Deployment experience
- Required, Available, or Uninstall?Available means no auto-reinstall.
- Is there an install deadline?Download is immediate, install is not.
- Does it force a restart?Choose the grace values consciously.
- What should users see?All toasts, restarts only, or nothing.
- Is it in the provisioning set?Mind the Autopilot collision.
The pages around this one.
Enterprise app management
The prebuilt catalog route: apps Microsoft maintains so your team never packages them.
Windows Autopilot
Zero-touch provisioning, where every packaging decision gets its public exam.
Microsoft Intune
The wider platform: configuration, compliance, and security policy around the app layer.
Your hand-installed applications are the project scope. Write them down.
Most companies find a short list of stubborn installers behind every manually built laptop. A one-day silent-install triage across that list reveals precisely which apps can automate and which need their vendors pushed. Engagements are scoped per application estate.
Related Services
Explore more solutions that work great with this service