This article shows you how to deploy an MSI app and assign it to users and groups. In this scenario, we will be deploying Chrome Enterprise with MSI, however, Microsoft Intune supports a variety of app types and deployment scenarios.

Why Chrome Enterprise?

The reason I’ve chosen Chrome for Enterprise is for future articles, where I will show how we can manage the Chrome Browser using ADMX. This will allow us to use policies such as restricting which extensions the users can install, setting bookmarks, set the default startup page and much more.

Prepare the app for Intune

For the purposes of this lab, we’ll use Chrome as our Win32 app.

Download the Chrome Enterprise package here and then extract the folder to a known location, such as C:\ChromeEnterprise

Locate the Enterprise MSI installation file under the Installers folder. It should be named something along with GoogleChromeStandaloneEnterprise64.

Before we can pull an application into Intune, we need to “package” the application for delivery using the IntuneWinAppUtil.exe command-line tool. Download the ZIP file, extract it, and launch the IntuneWinAppUtil program.

Now you need to specify the following three bits of information to use the tool:

  1. The source folder for your application
  2. The name of the setup executable file
  3. The output folder for the new file
Follow the prompts and wait for the file to finish

After the tool finishes running, you should have a .intunewin file in the Output folder, which you can now upload into Intune using the following steps.

You can find the .intunewin in the folder you specified.

Create an app in Intune

Log in to the Azure portal and select Intune.

Navigate to Intune > Clients apps > Apps, and then click the Add button to create a new app package.

Add app
Under App Type, select Windows app (Win32)

On the App package file blade, browse to the GoogleChromeStandaloneEnterprise64..intunewin file in your output folder, open it, then click OK:

Add app
browse to the .intunewin file in your output folder, open it, then click OK:

On the App Information Configure blade, provide a friendly name, description, and publisher, such as:

On the Program Configuration blade, supply the install and uninstall commands:

msiexec /i «GoogleChromeStandaloneEnterprise64.msi» /q

msiexec /x «{B0ADCD48-32BE-3E01-89F3-CA3224594A8B}» /q

Note: You do not have to write the install and uninstall commands yourself because the IntuneWinAppUtil.exe command-line tool automatically generated them when it converted the .msi file into a .intunewin file.

On the Requirements Configuration blade, specify the OS architecture and the Minimum OS version:

Next, configure the Detection rules. For our purposes, we will select the manual format:

Add app

Click Add to define the rule properties. For Rule type, select MSI, which will automatically import the right MSI product code into the rule:

Click OK twice to save, as you back out to the main Add app blade again for the final configuration.

Return codes: For our purposes, leave the return codes at their default values.

Add app

Click OK to exit.

You may skip configuring the final Scope (Tags) blade.

Click the Add button to finalize and save your app package.

Once the indicator message says the addition has completed.

You will be able to find your app in your app list:

Assign the app to users and groups

Now we need to assign the users we wish the app to be deployed too.

In the Intune > Client Apps > Apps pane, select the app package you already created to reveal its properties blade. Then click Assignments from the menu:

For our purposes, select Required from the Assignment type dropdown menu:

Required apps are installed automatically on enrolled devices.

Available for enrolled devices means users install the app from the Company Portal app or Company Portal website.

Select Included Groups and assign the groups you previously created that will use this app, for the purposes of this demo I will use my test group.

Note: Remember to always test the app on a few users and make the necessary precautions before deploying it to all users. 🙂

When done hit Review + Save.

At this point, you have completed steps to add a Win32 app to Intune.

Once the client(s) sync with Intune, the app will start to install itself. The end-user will see Windows Toast Notifications for the required app installation. This may take several minutes for it to update.

If you wish to manually sync for an update from Intune you can do so from Devices in Intune. Select the device you wish to update and hit sync:

Screenshot notifying the user that app changes are being made
Example of notification that will appear on the end-users client once the app begins installing

From the Overview of the app, you can see useful information such as the user or device install status.

For more information on adding apps to Intune, see Intune Standalone – Win32 app management