How Can I Allow Standard Users to Install Programs in Intune?

Jarrod Hale 21

We have users joining Intune via BYOD. We need to allow them to install software on their devices without the intervention of elevated admin privileges. Can you please instruct me how I can allow users to install programs without elevated privileges? Thank you!

Pradeep Kandel 1 Reputation point

2022-05-09T09:21:31.293+00:00

Hi folks,

In response to what @Jon Alfred Smith mentioned-

"As standard users they will not be able to make major changes to the system, such as installing software, the principle of least privileges. One of the many benefits of having these devices in Intune is to deploy apps. You can make them available or required. So in this scenario, these users won't have any need to install any apps. This is automatically handled by Intune. Do I miss something?"

My requirement is that for certain time period (until we are ready), we want to provide permission to installing software applications to standard non admin intune users so admin do not have to intervene all the time. I believe there is a way to give this permission to a particular user.

Please could someone confirm?

Many thanks.
Jason Sandys 31,171 Reputation points Microsoft Employee

2022-05-09T17:22:54.967+00:00

Sorry, but why? What's the process being used here where this is required? If you've packaged your software for distribution using Intune, users never need local admin rights. You should in general never allow ad hoc software installation by end-users.
Pradeep Kandel 1 Reputation point

2022-05-10T07:04:10.967+00:00

Hi @Jason Sandys - thank you for suggestions. This is for scenarios where we have 100 developers who would need to be installing apps, browser extensions on demand and at random.
Jason Sandys 31,171 Reputation points Microsoft Employee

2022-05-10T15:45:33.42+00:00

This is a niche scenario and can be handled in multiple different ways. We added a CSP in Windows a couple of years ago to control this and surfaced this as first-class UI in Intune in January of this year: https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207.

In general, I think devs far overstate how often they are doing these types of activities, however, because of the risk involved, they should be doing this in a controlled dev environment or on isolated VMs where granting them local admin is acceptable and not on their corporate systems.
Steven Hardware 6 Reputation points

2022-10-20T13:11:31.503+00:00

Was this ever solved? I have a similar problem. There are apps available via company portal for users to download and install for themselves as "approved apps" if they need it. As these are available for install on the portal, these should be installed without needing admin permissions whereas any software from outside of the portal, would require admin rights.

I've been searching for the answer for a while and it seems a shame that nobody here was able to answer this correctly.
Jason Sandys 31,171 Reputation points Microsoft Employee

2022-10-20T16:59:19.02+00:00

There's nothing to solve really. When you create apps in Intune you have a choice of enforcing them using either the local System account or the current user account. If your users aren't local admins (which is generally expected and recommended) you should choose to use the local System account for the installation if the installer requires elevated permissions.
Arslan Haider 0 Reputation points

2023-11-14T21:46:38.24+00:00

Im looking for the same problem. Where i want to gives access to to Intune users just to install the softwares on the machines, but couldnt find any solutions.
Jon Mason 0 Reputation points

2024-03-25T20:43:39.5466667+00:00

I have the same issue. I need to install a little firmware application for an HDMI splitter that we buy off of Amazon to allow the use of multiple monitors. I highly doubt it's in Microsoft's app directory, and without admin privileges, I have no way of getting it installed.

4 answers

Jon Alfred Smith 541 Reputation points

2020-08-14T21:07:29.817+00:00

Not quite sure if I get what you mean. You have users who bring their own devices and register them with Intune. These users are typical admins on their own devices. They will often use the Company Portal to register, which requires admin rights. The devices themself will show up as Personal in Intune, as opposed to Corporate under Ownership.

As standard users they will not be able to make major changes to the system, such as installing software, the principle of least privileges. One of the many benefits of having these devices in Intune is to deploy apps. You can make them available or required. So in this scenario, these users won't have any need to install any apps. This is automatically handled by Intune. Do I miss something?
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2020-08-17T04:31:08.767+00:00

Hi,

Based on my test, when the standard user login into enrolled device and try to install the app in company portal, it will be failed. If we want to deploy app to standard users, we can add the group to the Required field under Assignment. One article for the reference:
https://learn.microsoft.com/en-us/answers/questions/67360/how-can-i-allow-standard-users-to-install-programs.html

Hope it can help.
Please sign in to rate this answer.
Jason Sandys 31,171 Reputation points Microsoft Employee

2020-08-17T14:42:17.86+00:00

This is not correct and would completely defeat the purpose of using Intune to deploy software.

If the app installation requires local admin permissions, then configuring the app in Intune to run as the local system (Device context for LOB apps and System for the Install behavior on Win32 apps) will initiate the installation with elevated privileges. The assignment is irrelevant for this.

This is more or less what @Jon Alfred Smith is eluding to above.

Ryan Hébert 1 Reputation point

2021-04-09T14:17:21.92+00:00

Hi Jason. Can you provide some documentation on how to "configuring the app in Intune to run as the local system"?

Thanks!

Jason Sandys 31,171 Reputation points Microsoft Employee

2021-04-09T15:27:13.23+00:00

Documentation for creating an LOB app is at https://learn.microsoft.com/en-us/mem/intune/apps/lob-apps-windows and for Win32 apps is at https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management.

As noted, you configure them to run as the local system on the Device context for LOB apps and System for the Install behavior on Win32 apps.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment
Pavel yannara Mirochnitchenko 11,716 Reputation points MVP

2020-08-18T18:08:59.303+00:00

Using Company Portal and "Packaging" apps to Win32 model.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Dy-Liacco, Roberto (CA) 1 Reputation point

2021-09-15T20:05:48.487+00:00

I have the following scenario:

1) Packaged an *.exe into a Win32 app
2) Imported it in Intune, and set to install under SYSTEM context
3) Made the app available in Company Portal
4) Fails to install

If I run the *.exe as a user, it prompts for UAC, which might be the reason why the app is failing to install via Company Portal.

Shouldn't my app install under SYSTEM context, thereby UAC is not applicable?
Please sign in to rate this answer.
Jason Sandys 31,171 Reputation points Microsoft Employee

2021-09-15T20:19:24.613+00:00

For future reference, please create a new thread for new issues.

If I run the *.exe as a user, it prompts for UAC, which might be the reason why the app is failing to install via Company Portal.

No, the local System account is not subject to UAC and this is not the cause of your issue.

Fails to install

What does this mean in technical terms? Simply saying it doesn't work has no value for troubleshooting.

You need to troubleshoot the failure. Is there an error show in the MEM console? Have you examined the IME log on the device where the failure occurred? Does the installer create its own log? If so, have you examined it?
Sign in to comment