Skip to main content

Configuring Universal Application Requirement Rules in Intune

This document outlines the process to configure and apply universal requirement rules for applications in Microsoft Intune. It addresses challenges with required apps potentially installing on devices users do not own or on shared devices, while still allowing required apps assigned directly to shared devices to install.

Purpose​

The purpose of this SOP is to ensure applications deploy accurately across shared devices, kiosk devices, and personal devices while maintaining ownership and user-based restrictions. Key goals:

  • Required apps assigned directly to shared devices install correctly.
  • User-assigned required apps do not auto-install on shared devices unless explicitly intended.
  • Ownership and user-based restrictions are respected on non-shared devices.
  • Leverages a custom script and filters deployed universally via PatchMyPC.

Scope​

This SOP applies to all applications managed by Intune, including those distributed through PatchMyPC, to ensure consistent deployment behavior across all devices in the environment.

Intent​

  1. Automatically install required apps on shared and kiosk devices.
  2. Prevent user-assigned required apps from auto-installing on shared devices.
  3. Enforce primary user validation for non-shared devices.
  4. Provide universal application requirement coverage to ensure compliance and proper app targeting.
  5. Introduce a filter to exclude non-user enrolled devices (e.g., kiosks):
    • Filter Name: Shared Device - Filter
    • Filter Query: (device.enrollmentProfileName -ne "_TAMU User Driven with Pre Provision")
    • Ensures only non-user-enrolled devices, such as kiosks, are included in the filter for direct assignment or excluded for user-based targeting.
  6. Leverage Policy Scope Groups (PSGs) for application assignment:
    • PSGs organize assignments by infrastructure or specific unit needs.
    • Nested Experience Scope Groups (ESGs) define user and device-level assignments, containing User Scope Groups (USGs) and Device Scope Groups (DSGs).
    • Apply the filter to PSGs as needed to include or exclude non-user devices appropriately.
    • Support multiple PSGs for unit-specific and infrastructure-wide deployments.

Essential Core Knowledge​

  • Requirement Rules: Define conditions that must be met before an application installs.
  • Shared Device Mode: Configuration for multi-user environments, often used in labs or classrooms.
  • Kiosk Mode: Restricts a device to specific apps or single-purpose use cases.
  • Primary User: The user assigned to the device during enrollment or explicitly set in Intune.
  • Exit Codes:
    • Exit 0: Indicates the app can install.
    • Exit 1: Blocks the app installation.

Procedure and Guidelines​

1. Prepare the Requirement Script​

The following PowerShell script determines whether an app should install based on device type and user ownership:

# Step 1: Detect if the device is a shared device or kiosk
$SharedDevice = $false
try {
    # Check if the device is in Shared PC mode
    $SharedDevice = (Get-WmiObject -Namespace root\cimv2\mdm\dmmap -Class MDM_SharedPC).IsShared -eq $true
} catch {
    $SharedDevice = $false
}

# Step 2: Detect if the device is in Kiosk mode
$KioskMode = $false
try {
    $KioskMode = Test-Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\AssignedAccessConfiguration"
} catch {
    $KioskMode = $false
}

# Step 3: Get the primary user and current user
$PrimaryUser = (Get-WmiObject -Namespace root\cimv2\mdm\dmmap -Class MDM_DevDetail_Ext01).PrimaryUser
$CurrentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

# Step 4: Apply installation rules
If ($SharedDevice -or $KioskMode) {
    Write-Output "Device is either a Shared PC or in Kiosk mode. Allowing installation."
    Exit 0
} ElseIf ([string]::IsNullOrEmpty($PrimaryUser)) {
    Write-Output "Device has no primary user. Allowing installation."
    Exit 0
} ElseIf ($CurrentUser -eq $PrimaryUser) {
    Write-Output "Current user is the primary user. Allowing installation."
    Exit 0
} Else {
    Write-Output "Current user is not the primary user. Blocking installation."
    Exit 1
}

2. Configure the Requirement Rule in Intune​

  1. Navigate to Intune Admin Center > Apps > All Apps.
  2. Select the application to which you want to apply the requirement rule.
  3. Go to Properties > Requirements and click Edit.
  4. Add a new requirement rule:
    • Rule Type: Custom Script
    • Output Data Type: Integer
    • Operator: Equals
    • Value: 0
  5. Upload the prepared PowerShell script.
  6. Save the configuration.

3. Assign the Application​

  1. Assign the application to both user groups and device groups as needed.
  2. Ensure the assignments align with deployment requirements:
    • Shared Devices: Assigned to device groups for required installation.
    • Non-Shared Devices: Assigned to user groups with the requirement rule in place.

4. Validate Application Deployment​

  1. Test the deployment on:
    • Shared devices.
    • Kiosk devices.
    • Non-shared devices with and without a primary user.
  2. Monitor app deployment status in Intune:
    • Apps > App Install Status.
    • Review logs on target devices (IntuneManagementExtension.log).

5. Monitor and Adjust​

  • Continuously monitor deployments and adjust the script if new edge cases arise.
  • Use PatchMyPC to apply the requirement rule universally across applications, ensuring consistent logic and coverage.

Additional Notes and References​

Responsibilities​

  • IT Administrators: Configure and test requirement rules for assigned applications.
  • PatchMyPC Administrators: Ensure that the universal requirement rule is applied to all managed applications.
  • End-User Support: Monitor user feedback and resolve installation issues.