create dynamic groups that query installed applications

Matthias Veelaert 16

In intune I want to create a dynamic group that checks wether or not some app is installed on this user's device. Is there any way to query to see if an app is installed on a device or on a user's device.

Thanks!

Jim de Goede 25 Reputation points

2023-01-17T18:55:49.2333333+00:00

I think its very common to create Configuration Manager collections based on information in the ARP. Would love to be able to do the same for managing applications in Intune.

7 answers

Jason Sandys 31,306 Reputation points Microsoft Employee

2023-01-17T19:01:38.8133333+00:00

Yes, it is common to do this in ConfigMgr although it's debatable whether this is the best way to do it; it all depends on admin intent and where the processing is best performed at.

With both ConfigMgr and Intune, the use of requirement rules can and should often take the place of service-side targeting rules. This moves the processing to the client removing the burden from the server while accomplishing exactly the same task (once again, depending on exact admin intent).

In this case, the requirement rule is a simple script to detect whether the app is installed. You can then deploy the app to all in scope managed Windows endpoints.
Please sign in to rate this answer.
Ben Imrie 0 Reputation points

2023-02-13T09:57:51.04+00:00

We have a requirement for this as well. We deploy updates to third party apps using Intune. Each application update has a script that detects whether it's installed, and if so then updates it to the latest patch for that product. There's hundreds of products and we have to deploy each of these to every device, to make sure any applications installed are up-to-date. It would be better if we could target a dynamic group for each application that only contains computers with that application.

Marc Lewis 0 Reputation points

2023-03-02T22:51:51.4666667+00:00

We we setup deployments such as updates to a particular application, having a dynamic group helps us know what the scope (# of devices) of the deployment will be. I know we can get that information from reporting, but having it in a gorup, simplifies life and scheduling. If Microsoft really wants us to migrate to Intune from SCCM, they need to have similar functionality.

Jason Sandys 31,306 Reputation points Microsoft Employee

2023-03-02T23:14:51.1833333+00:00

I don't agree. Our intent and agenda is not in any way to build a tool with the same knobs and switches and that shouldn't be your desire necessarily either. You should be defining your requirements and then using capabilities within the toolset to meet those requirements. Anything else is really just asking for failure. Doing something differently should never be thought of as wrong and should not be a factor for your consideration -- all that should matter is whether your business-based requirement is met.

Using requirements in Intune (and ConfigMgr) is generally better as it eliminates the latency involved with gathering the data, updating the service side construct (collections or groups), and then waiting for that assignment to get picked up by the client. This can take many cycles in ConfigMgr and Intune -- it's basically a reactive process instead of a proactive one. Using requirements removes these multiple "cycles" that must be orchestrated and coordinated and allows the update (in this case) to happen as soon as the assignment is assigned without any delay or intervention necessary by the service. Keep in mind that requirements for apps does and has existed in ConfigMgr since 2012 and has always been the recommended way to perform this sort of task even though many folks continued to use collections instead.

Johan Raeymaeckers 5 Reputation points

2023-04-18T09:35:22.4366667+00:00

Is there a way to use requirements for the following scenario? We have app A version 1.0 available for all users (end-user can decide whether he wants to install app A - some will install it others won't) Some time later we create app A version 2.0 and we want to:

Upgrade all devices that have 1.0 (these devices need to be upgraded - we need a required assignment for these)

app A 2.0 needs an available assignment (end-user should still be able to install the app) For the upgrade scenario we could add a requirement to app A v2.0 (requires app A v1.0) and deploy to all devices. This way all devices that have app A v1.0 will be upgraded to v2.0. But adding the requirement to app A 2.0 no longer allows us to achieve the "available assignment". Users that have never installed app A v1.0 should still be able to self-install app A 2.0. We could create a second app A v2.0 (no requirement) without the requirement and make this one available but that's an ugly solution. Is there a better way to implement this scenario?

PB 1 Reputation point

2023-06-30T06:02:05.1466667+00:00

I have the same question as Johan. What would the recommended way to update application which are assigned available? We would like to give the colleagues the choice to install an app or not. But if it's installed, it has to be up-to-date

In ConfigMgr we either were able use supersedence (with auto-update option for available deployment) or a required deployment to a collection based on installed software. Both options are gone now and I'm looking for a reliable alternative in Intune.

Jason Sandys 31,306 Reputation points Microsoft Employee

2023-07-06T17:52:39.3966667+00:00

Using requirements rules as I've suggested previously in this thread handles this without any additional complexity or overhead.

PB 1 Reputation point

2023-07-07T05:54:21.4866667+00:00

could you give me an example which requirement I would need for this case, please . It's similar to the one Johan asked for. It seems I'm missing something.

Software A is assigned available to all users, it's a nice to have software. Some users like it, some don't need it. 40 users have it installed, 60 not.

Software A gets a new version. We have to update the existing 40 installations, but also make sure the remaining 60 and any new users would still be able to install software A in case they need it.

Here is what I don't understand:

Which requirement would be necessary to have the new version installed automatically on devices with software A installed? And same time is available for users without the old version.

If software A is a requirement, other users wouldn't see the new version in the Company Portal as available software because requirement is not met.

We would like to avoid to have them to install an old version first to have it updated later.

We also try to clean up the apps in the Intune Admin Center. Old versions are removed after X days/versions and any supersedence would be gone.

What am I missing?

Jason Sandys 31,306 Reputation points Microsoft Employee

2023-07-07T14:59:52.45+00:00

The "requirement" here is a custom requirement script that you create/provide that detects the scenario and conditions that you've called out. You than add this to your Win32 application so that it is only enforced when these conditions are detected.

PB 1 Reputation point

2023-07-12T07:43:20.5333333+00:00

Thank you for your comment, that's exactly the problem I have. As far as I know a requirement (if script or anything else) is always yes/no. Requirement fulfilled or not.

How can I differentiate requirements for required and available assignments? Do you have any example for this kind of script you mentioned for this specific scenario?

if requirement is fulfilled, it would always install as I have to assign required (to auto-update existing installations) --> also users who do not have the old version installed would get it automatically installed. For some software

if I add old version installed into the requirement, it wouldn't be fulfilled for new users --> they wouldn't be able to install the new version at all.

I would really like to adopt to the new way you want customers to use your product. At the moment I'm struggling finding a way to do (forced) software updates without creating duplicate bundles.

Jason Sandys 31,306 Reputation points Microsoft Employee

2023-07-12T13:35:20.2+00:00

if requirement is fulfilled, it would always install as I have to assign required

Correct. Why is this an issue if your requirement rules detects whether the app and possibly even a specific version of that app is installed already?

also users who do not have the old version installed would get it automatically installed

Not at all. That's the point here. You write the requirement so that it is only fulfilled, as noted, on systems where the software is already installed and possibly even only specific version are installed.

if I add old version installed into the requirement, it wouldn't be fulfilled for new users

You wouldn't use the same app for new installs. You need two, one for new installs and one for upgrades.

PB 1 Reputation point

2023-07-17T06:45:38.46+00:00

Thank you for your answer. It wasn't clear to me, that I have to manage two apps.

Patrick Tippner 1 Reputation point

2023-08-29T07:20:04.53+00:00

IMHO, having to manage two apps for that scenario is a rather ugly solution. We usually edit & update existing apps in Intune once an updated version is available, and we'd prefer to continue doing so. Is it correct that requirement rules don't seem to work in this case? Did anyone come up with a good solution for that?
I've found these ones, but none of them kind of feels right ;D
https://www.inthecloud247.com/create-an-application-based-azure-ad-group-with-logic-apps/
https://msendpointmgr.com/2020/05/26/automated-3rdparty-patch-remediation-in-intune-with-azure-automation/
https://credibledev.com/dynamic-azure-intune-groups-based-on-installed-software/
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Mark Derouen 5 Reputation points

2023-06-23T16:46:26.29+00:00

This functionality really should be native in the dynamic group creation. Hopefully in a new release. Until then, I found this.

https://www.inthecloud247.com/create-an-application-based-azure-ad-group-with-logic-apps/
Please sign in to rate this answer.
Mark Derouen 5 Reputation points

2023-06-23T16:55:53.18+00:00

Side note, defender has the ability to create a device group based upon a registry key\group name. Seems like such a simple step to then add that group to AAD.

Saw this too

https://credibledev.com/dynamic-azure-intune-groups-based-on-installed-software/
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

create dynamic groups that query installed applications

7 answers

Your answer