Microsoft MD-102: Application Management and Deployment — Study Guide

By Laurynas Brazys · 5 August 2026 · #microsoft #md-102 #certification #exam-prep #study-guide

Part of the Microsoft Endpoint Administrator Associate MD-102 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Application management in Microsoft Intune centers on selecting the correct app type, preparing packages correctly, targeting assignments with the right intent, and layering app-specific configuration and protection. Win32 apps provide the richest deployment controls, including detection, supersedence, and dependencies. Microsoft 365 Apps has a first-class deployment experience with Office Configuration XML support. App configuration policies and app protection policies (MAM) extend manageability across enrolled and unenrolled devices, enabling secure BYOD via MAM without enrollment.

App Types and Assignment Intents

Intune supports multiple app types, each optimized for specific platforms and distribution models:

Win32 apps: Custom Windows installers (EXE, MSI, and multi-file setups) packaged as .intunewin. These support detection rules, requirements, return codes, dependencies, and supersedence. Choose Win32 when you need installation control, custom install logic, or to sequence apps.
Microsoft Store apps: The Microsoft Store app (new) type integrates with the Windows Package Manager (winget) and replaces legacy Store for Business. These apps are discovered from the Store catalog, update via the Store client, and do not require custom packaging or detection rules. Use for store-delivered UWP/Packaged MSIX content and modern Store maintenance.
Line-of-business (LOB) apps: Native platform packages not sourced from a public store:
- Windows: MSI (for basic MSI deployments without advanced Win32 features)
- iOS/iPadOS: .ipa
- macOS: .pkg
- Android: Typically managed through Managed Google Play; classic .apk is supported for legacy device administrator scenarios
Web apps: URL shortcuts distributed via Intune. On Windows, a shortcut is added; on iOS/iPadOS an app-like web clip is created; on Android an approved web app is added via Managed Google Play. Authentication behavior is governed by the target web app and Conditional Access; modern authentication enforcement typically uses a Conditional Access policy with the Client apps condition.
Built-in apps: Curated first-party apps surfaced directly in Intune (for example, Company Portal, Microsoft Edge, Microsoft Defender, OneDrive, Teams). On iOS/iPadOS, the Built-in app picker can also add Apple App Store apps without manually entering metadata.

App assignment intents define delivery behavior:

Required: Intune installs the app automatically on targeted devices/users. For Win32, you can set availability and deadline times and configure restart grace periods.
Available: Publishes to Company Portal for user-initiated install. Typically targeted to user groups to expose apps in the portal.
Uninstall: Ensures removal when assignments or group membership change. For Win32, the uninstall command must be provided and tested.

Use assignment filters and include/exclude groups to precisely scope delivery across mixed device populations (for example, OS version, device manufacturer, enrollment type, processor architecture).

Win32 Packaging, Detection, Supersedence, and Dependencies

Win32 packaging converts your installer source into a single .intunewin file using the IntuneWinAppUtil:

Prepare content: Place setup files, transforms, and scripts into a source folder. Run IntuneWinAppUtil, supply the setup file, source folder, and output path to generate the .intunewin.
App metadata and commands: In Intune, upload the .intunewin, specify install and uninstall commands (for example, msiexec commands or silent EXE switches), set install behavior (system or user), and optionally enable “Run as 32-bit” on 64-bit clients if required by the app.
Requirements: Define prerequisites such as OS version/build, architecture, memory, disk, and custom script-based checks to prevent mis-targeting and failed installs.
Return codes: Map installer exit codes to success, soft reboot, hard reboot, and retry. Correct mapping ensures Intune interprets outcomes accurately and sequences dependent apps appropriately.

Detection rules confirm whether the app is installed and prevent reinstallation:

MSI: Use the MSI product code for reliable detection; Intune can auto-populate this when uploading an MSI-based Win32.
File: Check the existence, version, or date of a file or folder. Be mindful of system vs user context and 32-bit redirection on 64-bit OS.
Registry: Match a key/value and optionally a value comparison. Ensure hive selection (HKLM/HKCU) aligns with the chosen install context.
Custom script: Return exit code 0 when detected; non-zero when not detected.

Supersedence and dependencies orchestrate installation order and upgrades:

Dependencies: Configure “App2 depends on App1” so Intune automatically installs App1 first. Use this to enforce prerequisites like runtimes or frameworks. Dependencies can be a mix of required/available assignments, but actual installation only occurs for required dependencies of required apps.
Supersedence: Define replacement relationships to upgrade or replace older Win32 apps. You can choose to uninstall the previous app before or after installing the new one. Use supersedence to move from App v1 to App v2 without creating complex detection logic or separate removal tasks. Only Win32 apps support supersedence in Intune.

Common design practices:

Always test install/uninstall and detection on clean and dirty systems.
Use system context for machine-wide installs and HKLM-based detection. Reserve user context for per-user apps with HKCU detection.
Prefer MSI detection for MSI payloads; use file/registry for EXE-based installers.
Sequence pre-reqs with dependencies; use supersedence for upgrades and deprecations.

Deploying Microsoft 365 Apps with Intune

Intune provides a specialized Microsoft 365 Apps app type that abstracts most complexity and supports both GUI and XML-driven configuration:

Configuration basics: Choose the suite (Microsoft 365 Apps for enterprise), architecture, update channel (Current, Monthly Enterprise, Semi-Annual Enterprise), included/excluded apps (Word, Excel, PowerPoint, Outlook, OneDrive, Teams, Access, Visio Viewer), and languages.
Update and licensing: Configure automatic updates, channel alignment, and Shared Computer Activation for multi-user scenarios (for example, VDI or shared kiosks).
Coexistence and removal: Enable “Uninstall any MSI versions of Office” to remove legacy MSI-based Office before installing Microsoft 365 Apps Click-to-Run. This prevents side-by-side conflicts.
Office Customization Tool (OCT): Use the integrated wizard for common settings (app selections, update channel, installation options). For advanced control, supply or import an Office Configuration XML.
XML control: XML enables granular settings like app languages, excluded apps, SCL (SharedComputerLicensing), AutoActivate, Device-based licensing (education), and app update controls. Intune stores and deploys the XML to drive Office installation behavior.
macOS: Use the Microsoft 365 Apps for macOS app type for streamlined deployment with automatic updates and simplified selections.

Assignment follows the same intents (Required, Available, Uninstall). For Windows deployments, target device groups for broad rollout; leverage availability windows and deadlines to coordinate bandwidth and user impact.

App Configuration and Protection (MAM and MAM-WE)

App configuration policies deliver key/value pairs and app-specific settings:

Managed devices (MDM channel): Settings are delivered to enrolled devices and applied by the target app. This is common for Android Enterprise and iOS/iPadOS apps that support app configuration (for example, Microsoft Edge home page/URL blocking, Outlook account setup, OneDrive known folder move configuration on mobile). Device-based app configuration requires the device to be enrolled and compliant with platform prerequisites.
Managed apps (MAM channel): Configuration is delivered to apps that integrate the Intune SDK or App Wrapping Tool, irrespective of device enrollment. This targets the user identity and is ideal for BYOD. For example, preconfigure Outlook’s focused inbox or restrict third-party add-ins on personal devices with no MDM.

Use separate app configuration policies per platform and per channel (MDM vs MAM) to avoid conflicts and ensure appropriate delivery. Not all apps support both channels; consult Microsoft’s app configuration documentation for supported keys.

App protection policies (MAM) enforce data protection at the app layer:

Data protection: Encrypt corporate data at rest within the managed app container, restrict cut/copy/paste and save-as to policy-managed apps, block backups to non-approved storage, and control data transfer between accounts.
Access requirements: Require a PIN or biometric to open protected apps, set PIN complexity and timeout, and require modern authentication. These controls stop casual data leakage and unauthorized access if a device is shared or lost.
Conditional launch: Block on jailbroken/rooted status, enforce minimum app/OS versions, integrate device threat level with Microsoft Defender for Endpoint or Mobile Threat Defense partners, and define offline grace periods. Violations can warn, wipe corporate data in the app, or block access.

Mobile Application Management without enrollment (MAM-WE) enables secure BYOD:

Scope: iOS/iPadOS and Android only. No device enrollment needed. Users sign in with their corporate identity in supported apps (for example, Outlook, Teams, OneDrive, Edge).
Enforcement: Combine Conditional Access with the “Require app protection policy” grant control so corporate cloud access is permitted only from approved apps with MAM policy applied. Optionally add “Require approved client app” to further tighten the entry points.
Selective wipe: When a user is deprovisioned, loses access, or an admin triggers a wipe, corporate data, keys, and access tokens are removed from the managed app container while personal data remains intact.
Company Portal: Not required for MAM-WE enforcement, though it can assist with app discovery. The core enforcement relies on Intune SDK capabilities in the app and Conditional Access in Entra ID.

Design guidance:

Use MDM device-based app config and required app installs for corporate-owned and compliant devices.
Use MAM app config and app protection for personal/BYOD devices, backed by Conditional Access to enforce modern auth and policy presence.
Keep app configurations minimal and targeted; pair MAM policies with exclusions for break-glass accounts and service principals where appropriate.

Practical Problem Scenario

Contoso Ltd., a global manufacturer, is standardizing Windows 11 for 5,000 devices while enabling secure mobile access for 2,000 BYOD users on iOS and Android. They must deploy three Windows applications (a .NET runtime prerequisite, an ERP client, and a browser plug-in), roll out Microsoft 365 Apps with a specific update channel, preconfigure Outlook on mobile, and prevent data leakage on personal devices without enrolling them.

Package and sequence Windows applications

Action: Package the ERP client and browser plug-in as Win32 apps with IntuneWinAppUtil. Use the vendor MSI for .NET runtime as a Win32 app as well. Configure the ERP client to depend on the .NET runtime, and the browser plug-in to depend on the ERP client. Set Required assignments to device groups with availability and deadlines.
Why: Win32 provides install/uninstall commands, file/registry detection, return code mapping, and dependency ordering to ensure the .NET runtime and ERP client install before the plug-in consistently on every device.

Implement ERP client upgrades

Action: When a new ERP version is released, create a new Win32 app and configure supersedence to replace the old ERP app and uninstall the previous version.
Why: Supersedence cleanly upgrades at scale without manual removal tasks or complex detection changes.

Deploy Microsoft 365 Apps with update governance

Action: Add the Microsoft 365 Apps for enterprise app in Intune, select the Monthly Enterprise channel, exclude Access, enable “Uninstall any MSI versions of Office,” and import a tailored Office Configuration XML enabling Shared Computer Activation for shared PCs.
Why: The Office Suite app type and XML give deterministic control over components, licensing, and update cadence with minimal packaging effort.

Deliver managed device app configuration

Action: For corporate Windows and Android Enterprise devices, create app configuration policies targeting Microsoft Edge (homepage, allowed/blocked sites) and Outlook (account setup hints) via the managed device channel. Assign to device/user groups aligned to ownership.
Why: Device-channel app configuration applies settings at the OS-managed layer, ensuring consistent experience on enrolled, corporate-owned devices.

Enable secure BYOD with MAM-WE

Action: Create app protection policies for iOS/iPadOS and Android that require a PIN/biometric, encrypt data at rest, restrict copy/paste to policy-managed apps, and allow save-as only to OneDrive for Business. Publish MAM app configuration for Outlook (focused inbox and managed account defaults).
Why: MAM-WE protects corporate data inside apps without device enrollment, satisfying privacy expectations for personal devices.

Enforce access with Conditional Access

Action: In Entra ID Conditional Access, create policies that target Microsoft 365 services and require both modern authentication and “Require app protection policy” for mobile platforms. Add a separate rule to restrict legacy clients via the Client apps condition.
Why: CA ensures only approved, policy-compliant apps access corporate resources, blocking legacy authentication paths and guaranteeing MAM policy enforcement.

Operationalize selective wipe and remediation

Action: Train the helpdesk to trigger a user-level selective wipe from Intune when a device is lost or a user departs. Monitor app install compliance and failures via Intune reports and remediate with revised detection or return code mappings.
Why: Selective wipe removes only corporate data from personal devices, while Intune reporting and controlled return codes maintain high deployment success for Windows applications.

← Device Configuration Profiles and Policies · All domains · Endpoint Security and Microsoft Defender →

Practice these questions → · Timed practice on ExamRoll.io →