Manage and secure applications
App types and packaging
Intune supports Win32 (.intunewin), MSI line-of-business, Microsoft Store, Microsoft 365 Apps, Edge, web links, and mobile store or VPP apps. Win32 apps need an install command, detection rules (file, registry, or MSI product code), requirement rules, and optionally dependencies and supersedence. Dependencies install before the app; supersedence replaces an older app.
Assignments
Required installs automatically, Available appears in Company Portal, and Uninstall removes. Target groups, not individuals.
Protecting data
App protection policies (MAM) protect corporate data on iOS, Android, and Windows without full enrollment, enforcing PIN, encryption, conditional launch, and selective wipe. App configuration policies deliver settings to apps. Unenrolled devices can still receive MAM-WE, but users need the right license and the app must support it.
Traps
Detection rules that never match cause endless reinstall attempts; requirement rules are mistaken for detection rules; and candidates assume uninstall removes all app data. Remember Win32 content must be repackaged with IntuneWinAppUtil after changes.
Rule of thumb
If the app must be forced on corporate devices, use Required. If BYOD users choose, use Available, and combine with an app protection policy so data stays protected either way.