Configure app availability, targeting, and install behavior
When you assign an app in Microsoft Intune, you're determining how the app will be delivered and installed on devices. Intune supports three distinct assignment types, each with different behaviors and use cases.
Required assignments auto-install the app on all targeted devices or users. Intune treats the app as mandatory for that audience and attempts to install it with minimal user intervention. This type is ideal for apps everyone needs, such as antivirus software, productivity tools or security patches.
Available assignments make the app visible in the Company Portal app store. Users can choose to install the app themselves when they need it. This approach works well for optional or role-specific applications where you want to make them accessible without forcing installation.
Uninstall assignments remove apps from devices that currently have them. You use this assignment type when retiring deprecated applications or cleaning up devices that no longer require specific software.
Understanding these three types is essential because each triggers different install behaviors. A required assignment initiates installation immediately; an available assignment waits for user action; and an uninstall assignment removes the software entirely.
Targeting apps to users and devices
Intune gives you multiple ways to define who receives an app assignment. The targeting mechanism you choose determines how precisely you can control app delivery.
User-based targeting assigns apps to Entra ID user groups. When you target a user, the app follows that user across devices they enroll. If an employee uses both a laptop and a tablet, a user-targeted assignment delivers the app to both devices.
Device-based targeting assigns apps to Entra ID device groups. You use device targeting when an app should install on specific devices regardless of who's using them. For example, you might assign a kiosk application only to devices marked as public terminals.
You can create Entra ID groups manually for precise control or use dynamic groups that automatically include or exclude members based on device attributes like operating system, manufacturer or device owner type. Dynamic groups are powerful because they adapt as your device inventory changes, reducing manual group management.
Beyond group selection, assignment filters add another layer of targeting precision. Filters let you include or exclude devices based on specific criteria, such as device ownership (corporate or personal), OS version, manufacturer or device model. You can combine multiple filters to create nuanced targeting rules without creating dozens of separate groups.
The targeting approach you choose affects not only who gets the app, but also how Intune determines when and how the app should be installed on each device.
Managing install behavior
Install behavior determines how Intune actually installs apps on devices and what happens if installation fails or circumstances change.
Device context vs. user context affects where apps install and who can use them. Device-context apps install once per device and are available to all users on that device. User-context apps install per user.
When you create a required assignment, Intune automatically attempts installation after the user enrolls their device. If installation fails initially, Intune uses a retry mechanism that periodically reattempts installation. Understanding retry behavior helps you troubleshoot why an app hasn't installed yet on a specific device.
When targeting changes, such as removing a user from an assignment group, keep in mind that the app doesn't uninstall automatically just because the app is no longer assigned to the user. When you remove a user from the available assignment, the app doesn't show in the Company Portal anymore, but the app remains installed. Move the user into the uninstall assignment to make sure the app is removed.
Note
When moving a user into another assignment group, make sure they're not in the old assignment group to prevent misbehavior or unexpected results.
Intune also respects device availability. If a device is offline when installation is due, Intune waits for the device to reconnect before attempting install. Once the device comes back online and checks in with Intune, the installation process begins.
Verifying assignment outcomes
After you create an assignment, monitoring installation status helps you ensure apps are reaching the intended devices and users.
Intune provides near real-time assignment status reports showing how many devices or users in the assignment scope have "installed," "pending," "failed," or "not applicable" status. These reports tell you whether your targeting is correct and whether installation is proceeding as expected.
A "not applicable" status typically means the device doesn't meet app requirements—such as the app requiring a minimum OS version that the device doesn't have. A "failed" status indicates installation encountered an error, often from missing dependencies or insufficient device storage.
When you see failures or delays, check whether the affected devices are currently online and whether they've had time to check in with Intune's management service since the assignment was created. You can also drill down into specific device reports to see installation logs and error messages, which guide troubleshooting efforts.
Using assignment reports as a verification step ensures your app distribution strategy is working as intended and helps you identify devices needing attention.