在 Microsoft Intune 中包括和排除应用分配Include and exclude app assignments in Microsoft Intune

在 Intune 中,可以通过分配要包括的组和要排除的组来决定哪些用户有权访问应用。In Intune, you can determine who has access to an app by assigning groups of users to include and exclude. 在将组分配到应用之前,必须设置应用的分配类型。Before you assign groups to the app, you must set the assignment type for an app. 分配类型使应用可用、成为所需应用,或者卸载应用。The assignment type makes the app available, required, or uninstalls the app.

要设置应用的可用性,可以通过结合使用包括组分配和排除组分配,针对一组用户或设备包括和排除应用分配。To set the availability of an app, you include and exclude app assignments to a group of users or devices by using a combination of include and exclude group assignments. 在包括一个较大的组来提供应用,然后排除一个较小的组来缩小选定用户时,此功能非常有用。This capability can be useful when you make the app available by including a large group, and then narrow the selected users by also excluding a smaller group. 较小的组可能是测试组或管理组。The smaller group might be a test group or an executive group.

最佳做法是为你的用户组创建和分配应用,并分别为你的设备组创建和分配应用。As a best practice, create and assign apps specifically for your user groups, and separately for your device groups. 有关组的详细信息,请参阅添加用于组织用户和设备的组For more information on groups, see Add groups to organize users and devices.

包括或排除应用分配时,存在以下重要场景:Important scenarios exist when including or excluding app assignments:

  • 在以下相同的组类型方案中,排除优先于包含:Exclusion takes precedence over inclusion in the following same group type scenarios:

    • 分配应用时包括用户组和排除用户组Including user groups and excluding user groups when assigning apps

    • 分配应用时包括设备组和排除设备组Including device groups and excluding device group when assigning apps

      例如,如果将设备组分配给“所有企业用户”用户组,但排除“高级管理人员”用户组中的成员,则“高级管理人员”除外的“所有公司用户”都将获取分配,因为这两个组是用户组。For example, if you assign a device group to the All corporate users user group, but exclude members in the Senior Management Staff user group, All corporate users except the Senior Management staff get the assignment, because both groups are user groups.

  • Intune 不会评估用户到设备组的关系。Intune doesn't evaluate user-to-device group relationships. 如果将应用分配到混合组,则结果可能不是你所预期的。If you assign apps to mixed groups, the results may not be what you want or expect.

    例如,如果将设备组分配到“所有用户” 用户组,但排除“所有个人设备” 设备组。For example, if you assign a device group to the All Users user group, but exclude an All personal devices device group. 在此混合组应用分配中,“所有用户” 获取应用。In this mixed group app assignment, All users get the app. 排除不适用。The exclusion does not apply.

因此,建议不要将应用分配到混合组。As a result, it's not recommended to assign apps to mixed groups.


为应用设置组分配时,已弃用“不适用”类型,代之以排除组功能 。When you set a group assignment for an app, the Not Applicable type is deprecated and replaced with exclude group functionality.

Intune 在控制台中提供了预先创建的“所有用户”和“所有设备”组 。Intune provides pre-created All Users and All Devices groups in the console. 为了方便起见,这些组已内置优化。The groups have built-in optimizations for your convenience. 强烈建议针对所有用户和所有设备使用这些组,而不要使用可能是你自己创建的任何“所有用户”或“所有设备”组。It's highly recommended that you use these groups to target all users and all devices instead of any "all users" or "all devices" groups that you might create yourself.

Android 企业支持包括和排除组。Android enterprise supports including and excluding groups. 可利用内置的“所有用户”和“所有设备”组进行 Android 企业应用分配 。You can leverage the built-in All Users and All Devices groups for Android enterprise app assignment.

分配应用时包括和排除组Include and exclude groups when assigning apps

若要使用包括和排除分配将应用分配给组,请执行以下操作:To assign an app to groups by using the include and exclude assignment:

  1. 登录到 Microsoft 终结点管理器管理中心Sign in to the Microsoft Endpoint Manager admin center.

  2. 选择“应用” > “所有应用” 。Select Apps > All apps. 随即显示已添加应用的列表。The list of added apps is shown.

  3. 选择要分配的应用。Select the app that you want to assign. 仪表板显示有关应用的信息。A dashboard displays information about the app.

  4. 在菜单的“管理”部分中选择“分配” 。In the Manage section of the menu, select Assignments.


  5. 选择“添加组”,添加分配有该应用的那些用户组 。Select Add group to add the groups of users who are assigned the app.

  6. 在“添加组”窗格中,从可用的分配类型中选择某个“分配类型” 。In the Add group pane, select an Assignment type from the available assignment types.

  7. 对于分配类型,请选择“不论是否注册均可使用” 。For the assignment type, select Available with or without enrollment.

    Intune 应用分配 - 添加组

  8. 选择“包含的组”,然后选择你想要其使用此应用的用户组 。Select Included Groups to select the group of users that you want to make this app available to.


    添加组时,如果给定的分配类型中已包括任何其他组,则在其他包括分配类型中,会预先选定该组且无法修改。When you add a group, if any other group has already been included for a specific assignment type, the app is preselected and can't be modified for other include assignment types. 已被使用的组无法用作包括组。The group that has been used can't be used as an included group.

  9. 选择“是”,使此应用可供所有用户使用 。Select Yes to make this app available to all users.

    Intune 应用分配 - 包括组

  10. 选择“确定”,设置要包括的组 。Select OK to set the group to include.

  11. 选择“排除的组”,然后选择你想要其无法使用此应用的用户组 。Select Excluded Groups to select the groups of users that you want to make this app unavailable to.

  12. 选择要排除的组。Select the groups to exclude. 这使该应用对这些组不可用。This makes this app unavailable to those groups.

    Intune 应用分配 - 排除组

  13. 选择“选择”,完成组选择操作 。Select Select to complete your group selection.

  14. 在“添加组” 窗格中,选择“确定” 。In the Add group pane, select OK. 应用“分配”列表随即显示 。The app Assignments list appears.

  15. 单击“保存”,使应用的组分配处于活动状态 。Click Save to make your group assignments active for the app.

在进行组分配时,已分配的组不可修改。When you make group assignments, groups that have already been assigned aren't available to be modified. 若想选择当前不可用的组,先从应用的已分配列表中删除应用。If you want to select a group that currently isn't available, first remove the app from the app's assigned list.

要编辑分配,请在应用的“分配”列表中,选择包含想要更改的特定分配的行即可编辑分配 。To edit assignments, in the app Assignments list, select the row that contains the specific assignment that you want to change. 还可以选择行尾的省略号 (…) 并选择“删除”即可删除分配 。You can also remove an assignment by selecting the ellipse () at the end of a row, and then selecting Remove.


删除组分配不会删除相关应用。Removing a group assignment does not remove the related app. 已安装的应用将保留在设备上。The installed app will remain on the device.

要更改“分配”列表的视图,请按“分配类型”或按“包括/排除”分组 。To change the view of the Assignments list, group by Assignment type or by Included/Excluded.

Intune 应用分配 - 完成

后续步骤Next steps