5.4MD-102Intermediate
Est: ~15 mins•Verified: 2026-08

Microsoft Store & Windows Package Manager (WinGet)

Deploy and manage modern desktop applications via the Microsoft Store app (new) repository integrated with Windows Package Manager (WinGet) in Microsoft Intune.

Tags:#Microsoft Store#WinGet#Package Manager#Applications#Intune#MD-102
01

Overview

The legacy Microsoft Store for Business (MSfB) and Store for Education have been officially retired and replaced by the Microsoft Store app (new) experience in Microsoft Intune.

This modern architecture is powered by the Windows Package Manager (WinGet) REST API:

  1. Direct Catalog Access: Administrators search and deploy hundreds of thousands of Store, Win32, and MSIX applications (such as PowerToys, Adobe Acrobat Reader, Visual Studio Code, or Slack) directly from the Intune console without downloading setup files or writing detection scripts.
  2. System & User Context: WinGet supports installation in both System context (device-wide for all users, ideal for Autopilot ESP) and User context.
  3. Automated Application Updates: Microsoft Store apps deployed via this mechanism are automatically updated by the Windows Store background service, ensuring endpoints run the latest security patches without administrative packaging overhead.

---

02

When to Use

Application TypeDeployment MechanismOperational Benefit
Popular Public Apps (VS Code, Zoom, Adobe Reader)Microsoft Store app (new)Zero packaging time; Intune references WinGet repository metadata directly.
Proprietary / In-House Line of Business (.exe / .msi)Win32 App (.intunewin)Custom install parameters, bespoke detection scripts, and dependency chains.
Microsoft 365 Apps (Word, Excel, PowerPoint)Microsoft 365 Apps for Windows 10/11Official Click-to-Run (C2R) XML deployment and update channel management.

---

03

Prerequisites

Client Requirements:

  • Windows 11 (all versions) or Windows 10 (version 2004 or later).
  • DesktopAppInstaller package (Windows Package Manager / WinGet) installed and updated.
  • Network access to:
  • storeedgefd.dsx.mp.microsoft.com
  • *.dl.delivery.mp.microsoft.com
  • cdn.winget.microsoft.com

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Apps
    └── Windows
        └── Add > App type: Microsoft Store app (new)
            └── Search the Microsoft Store app (new)
                └── Select application > Configure install behavior

---

05

Step-by-Step Implementation

Step 1: Add a Modern Store Application in Intune

  1. In Intune, navigate to Apps > Windows > Click Add.
  2. In the App type dropdown, select Microsoft Store app (new) > Click Select.
  3. Under App information, click Search the Microsoft Store app (new).
  4. In the search box, search for your target application (e.g., Microsoft PowerToys or Adobe Acrobat Reader).
  5. Select the application. Intune automatically populates:
  • Name: Microsoft PowerToys
  • Description: Vendor metadata
  • Publisher: Microsoft Corporation
  • App package identifier: XP89DCGQ3K6VLD (Store Package ID)

Step 2: Configure Install Behavior & Architecture

  1. Review Program settings:
  • Install behavior: Select System (installs for all users on the device) or User.
  • Note: If targeting Windows Autopilot ESP, always select System.
  1. Review Requirements: Intune automatically parses minimum supported architecture (x64 / ARM64).

Step 3: Configure Assignments & Update Rules

  1. Under Assignments:
  • Add target group under Required (silent mandatory install).
  • Or add under Available for enrolled devices (allows users to self-install on-demand via the Intune Company Portal).
  1. Save the application.

---

06

PowerShell Automation

Test WinGet Package Search & Install Directly via CLI:

PowerShell
# Run in elevated PowerShell to query Windows Package Manager
winget search "Microsoft.PowerToys" --source msstore

# Inspect installed WinGet packages on endpoint
winget list --source msstore

# Manually trigger silent background upgrade of all Store apps
winget upgrade --all --accept-package-agreements --accept-source-agreements

Inspect DesktopAppInstaller Package Version:

PowerShell
# Verify WinGet engine is installed and healthy
Get-AppxPackage -Name "Microsoft.DesktopAppInstaller" | 
    Select-Object Name, Version, Status, Architecture

---

07

Microsoft Graph Automation

Add Microsoft Store App (new) via Microsoft Graph API:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementApps.ReadWrite.All"

$AppBody = @{
    "@odata.type" = "#microsoft.graph.winGetApp"
    displayName = "Mozilla Firefox"
    description = "Fast, private, and independent web browser"
    publisher = "Mozilla"
    packageIdentifier = "Mozilla.Firefox"
    installExperience = @{
        runAsAccount = "system"
    }
}

New-MgDeviceAppManagementMobileApp -BodyParameter $AppBody

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
App appears in Intune Windows Apps inventory with type Microsoft Store app (new).
On the endpoint, application installs silently without displaying interactive setup dialogs.
Application appears under C:\Program Files (for System context) or user profile.
Company Portal shows the app under Installed Apps.
Windows Store background updates keep the application on the latest stable version.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
WinGet Engine Client Logs%LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDirPrimary log capturing package download URLs, hash verification, and exit codes.
Intune Management ExtensionC:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.logRecords Store policy assignment delivery and installation trigger events.
Store App Execution LogApplications and Services Logs > Microsoft > Windows > AppxPackagingOM > OperationalRecords UWP/MSIX installation and registration events.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Error 0x80070005 (Access Denied)Install behavior was set to User, but the installer required administrative privileges.Change app install behavior to System in Intune app properties.
"Search failed" in Intune ConsoleTemporary network timeout contacting Microsoft Store catalog API service.Retry search or verify firewall permits outbound access to *.manage.microsoft.com.
WinGet command not recognizedMicrosoft.DesktopAppInstaller is missing, outdated, or corrupted on the PC.Install the latest DesktopAppInstaller bundle from GitHub or Windows Store.

---

11

Production Best Practices

Production Best Practice

Use System Context for Autopilot Pre-Provisioning:

When adding Microsoft Store apps intended to deploy during Windows Autopilot Enrollment Status Page (ESP), always ensure Install behavior is set to System. User context apps will be skipped during device ESP and can cause provisioning mismatches.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. MSfB Deprecation: Microsoft Store for Business (MSfB) is completely retired; the correct modern exam answer is Microsoft Store app (new).
  2. WinGet Integration: The new Store experience is powered behind the scenes by Windows Package Manager (WinGet).
  3. Automatic Patching: Applications installed from the Microsoft Store update automatically via the Store service unless explicitly blocked by policy.

---

13

Official Documentation

PREVIOUS TOPIC5.3 Mobile Application Management (MAM): App ProtectionNEXT TOPIC6.1 Microsoft Graph PowerShell SDK Admin Automation