Assign apps to groups with Microsoft Intune
After you've added an app to Microsoft Intune, you can assign the app to users and devices. It is important to note that you can assign an app to a device whether or not the device is managed by Intune.
The following table lists the various options for assigning apps to users and devices:
|Devices enrolled with Intune||Devices not enrolled with Intune|
|Assign to users||Yes||Yes|
|Assign to devices||Yes||No|
|Assign wrapped apps or apps that incorporate the Intune SDK (for app protection policies)||Yes||Yes|
|Assign apps as Available||Yes||Yes|
|Assign apps as Required||Yes||No|
|Receive app updates from Intune||Yes||No|
|End users install available apps from the Company Portal app||Yes||No|
|End users install available apps from the web-based Company Portal||Yes||Yes|
Currently, you can assign iOS and Android apps (line-of-business and store-purchased apps) to devices that aren't enrolled with Intune.
To receive app updates on devices that aren't enrolled with Intune, device users must go to their organization's Company Portal and manually install app updates.
To assign an app
Sign in to the Azure portal.
Select All services > Intune. Intune is located in the Monitoring + Management section.
In the Intune menu, select Client apps.
In the Manage section of the menu, select Apps.
In the Apps pane, select the app you want to assign.
In the Manage section of the menu, select Assignments.
Select Add Group to open the Add group pane that is related to the app.
For the specific app, select an assignment type:
Available for enrolled devices: Users install the app from the Company Portal app or website.
Available with or without enrollment: Assign this app to groups of users whose devices are not enrolled with Intune. Apps from Managed Google Play don't support this option.
Required: The app is installed on devices in the selected groups.
Uninstall: The app is uninstalled from devices in the selected groups.
For iOS apps only: If you have created an iOS VPN profile that contains per-app VPN settings, you can select the VPN profile under VPN. When the app is run, the VPN connection is opened. For more information, see VPN settings for iOS devices.
To select the groups of users that are affected by this app assignment, select Included Groups.
After you have selected one or more groups to include, select Select.
In the Assign pane, select OK to complete the included groups selection.
If you want to exclude any groups of users from being affected by this app assignment, select Exclude Groups.
If you have chosen to exclude any groups, in Select groups, select Select.
In the Add group pane, select OK.
In the app Assignments pane, select Save.
The app is now assigned to the groups that you selected. For more information about including and excluding app assignments, see Include and exclude app assignments.
How conflicts between app intents are resolved
Sometimes, the same app is assigned to multiple groups but with different intents. The information in the following table can help you understand the resulting intent when this occurs:
|Group 1 intent||Group 2 intent||Resulting intent|
|User Required||User Available||Required and Available|
|User Required||User Not Available||Required|
|User Required||User Uninstall||Required|
|User Available||User Not Available||Not Available|
|User Available||User Uninstall||Uninstall|
|User Not Available||User Uninstall||Uninstall|
|User Required||Device Required||Both exist, Intune treats Required|
|User Required||Device Uninstall||Both exist, Intune resolves Required|
|User Available||Device Required||Both exist, Intune resolves Required (Required and Available)|
|User Available||Device Uninstall||Both exist, Intune resolves Available.
App shows up in the Company Portal.
If the app is already installed (as a required app with previous intent), the app is uninstalled.
If the user selects Install from the Company Portal, the app is installed, and the uninstall intent is not honored.
|User Not Available||Device Required||Required|
|User Not Available||Device Uninstall||Uninstall|
|User Uninstall||Device Required||Both exist, Intune resolves Required|
|User Uninstall||Device Uninstall||Both exist, Intune resolves Uninstall|
|Device Required||Device Uninstall||Required|
|User Required and Available||User Available||Required and Available|
|User Required and Available||User Uninstall||Required and Available|
|User Required and Available||User Not Available||Required and Available|
|User Required and Available||Device Required||Both exist, Required and Available|
|User Required and Available||Device Not Available||Required and Available|
|User Required and Available||Device Uninstall||Both exist, Intune resolves Required (Required and Available)|
|User Not Available||Device Not Available||Not Available|
|User Available||Device Not Available||Available|
|User Required||Device Not Available||Required|
|User Available without enrollment||User Required and Available||Required and Available|
|User Available without enrollment||User Required||Required|
|User Available without enrollment||User Not Available||Not Available|
|User Available without enrollment||User Available||Available|
|User Available without enrollment||Device Required||Required and Available without enrollment|
|User Available without enrollment||Device Not Available||Available without enrollment|
|User Available without enrollment||Device Uninstall||Uninstall and Available without enrollment.
If the user didn’t install the app from the Company Portal, the uninstall is honored.
If the user installs the app from the Company Portal, the install is prioritized over the uninstall.
For managed iOS store apps only, when you add these apps to Microsoft Intune and assign them as Required, the apps are automatically created with both Required and Available intents.
iOS Store apps (not iOS VPP apps) that are targeted with required intent will be enforced on the device at the time of the device check-in and will also show in the Company Portal app.
To learn more about monitoring app assignments, see How to monitor apps.