Week 6, Day 4 — App Deployment & Linux Endpoint Management

Day 3 review & the app and Linux gap

• Ask: "WIN-CLIENT-01 is compliant, has KFM, has an Update ring, has the Security Baseline. What's still not covered? Who controls which apps are installed on it?" — prime app deployment via Intune
• Ask: "LINUX-01 is running Ubuntu 22.04. It's not domain-joined. It has no Intune agent yet. From an IT governance perspective, what is the risk of having a Linux machine on the network with no management plane?" — answer: no compliance enforcement, no inventory, no patch management visibility, no access control
• Frame: today crosses a platform boundary. The first half is Windows app deployment. The second half is Linux — enrolling Ubuntu 22.04 into the same Intune framework that manages the Windows devices. By the end of the day, all three platforms (Windows, Linux, and potentially macOS) are visible in the same Intune portal.

Win32 app packaging and the Intune Linux agent model

Two distinct topics — Windows app deployment and Linux MDM — covered back to back because both are best understood as "Intune extending its management reach beyond defaults."

Windows app deployment — four types

The Win32 packaging pipeline

• Detection rules — after installing an app, Intune checks whether the install succeeded using a detection rule. Three types: file/folder exists, registry key exists, MSI product code present. If the detection rule doesn't find the app, Intune retries the install. Getting the detection rule right is the most common Win32 packaging mistake.
• Required vs Available — Required: the app installs automatically on assigned devices whether the user wants it or not. Available: the app appears in the Company Portal for users to install themselves. Uninstall: the app is removed from assigned devices.
• The Intune Linux agent — Microsoft's agent-based approach to Linux MDM. The agent is installed manually (or via script) on the Linux machine. Once running, it checks in with Intune, registers the device, and applies compliance policies. Unlike Windows (which uses MDM built into the OS), Linux uses a daemon process. Supported distros: Ubuntu 20.04/22.04, RHEL 8.x/9.x, Debian 11, and others. The agent does not provide full configuration profile support on Linux — it primarily enforces compliance policies and provides device inventory.
• Linux compliance policies — Intune can evaluate Linux devices for: minimum OS version (e.g. Ubuntu 22.04), password requirements, device encryption (LUKS), and custom compliance scripts (same PowerShell-based approach as Windows, but runs bash scripts on Linux). Linux compliance feeds into the same CA framework — a non-compliant Linux machine can be blocked from M365 just like a non-compliant Windows machine.

Lab 6-D: Win32 app deployment and Linux Intune agent enrollment

Students package a Win32 application using IntuneWinAppUtil, upload and deploy it to WIN-CLIENT-01, deploy a Microsoft Store app, then install the Intune Linux agent on LINUX-01, enroll it, configure a Linux compliance policy, and verify both devices in the unified Intune portal.

Part 1 — Windows app deployment (~35 min)

• Step 1 — Download IntuneWinAppUtil and the source app (8 min)
  On WIN-CLIENT-01 (or DC-01), download IntuneWinAppUtil.exe from:
  https://github.com/microsoft/Microsoft-Win32-Content-Prep-Tool/releases
  Save to C:\IntuneTools\
  
  Download a suitable small application installer to package. Good choices:
  · 7-Zip: https://www.7-zip.org/download.html → download the .msi version
  · Notepad++: https://notepad-plus-plus.org/downloads/ → download the installer .exe
  Save the installer to C:\IntuneSource\
• Step 2 — Package the app with IntuneWinAppUtil (5 min)
  Open an elevated Command Prompt. Run:
  cd C:\IntuneTools
  IntuneWinAppUtil.exe -c C:\IntuneSource -s [installer filename] -o C:\IntuneOutput
  
  Replace [installer filename] with the actual filename (e.g. 7z2301-x64.msi or npp.8.6.Installer.exe).
  The tool creates an .intunewin file in C:\IntuneOutput\. This is the encrypted, packaged app ready for upload.
• Step 3 — Upload and configure the Win32 app in Intune (12 min)
  Navigate to intune.microsoft.com → Apps → Windows → + Add.
  App type: Windows app (Win32). Upload the .intunewin file.
  
  Configure app information:
  · Name: e.g. 7-Zip 23.01
  · Description: File archiver utility
  · Publisher: Igor Pavlov
  
  Configure program (install/uninstall commands):
  · For 7-Zip MSI: Install: msiexec /i 7z2301-x64.msi /qn · Uninstall: msiexec /x {7-Zip GUID} /qn
  · For Notepad++ EXE: Install: npp.8.6.Installer.exe /S · Uninstall: C:\Program Files\Notepad++\uninstall.exe /S
  
  Detection rule: MSI (if MSI) or File — path: C:\Program Files\7-Zip\, file: 7z.exe, detection method: File or folder exists.
  
  Assignments: Required → SG — All Windows Devices. Save.
• Step 4 — Verify app installation on WIN-CLIENT-01 (5 min)
  Trigger a sync on WIN-CLIENT-01. Navigate to Intune → WIN-CLIENT-01 → Managed apps tab. The app should appear with Install status = Installed.
  On WIN-CLIENT-01, confirm the app is actually installed: check Start menu or Programs list.
  Also navigate to Intune → Apps → the app → Device install status — WIN-CLIENT-01 should show Installed.
• Step 5 — Deploy a Microsoft Store app (5 min)
  Navigate to Intune → Apps → Windows → + Add → Microsoft Store app (new).
  Search for Microsoft Whiteboard (or any other appropriate Store app). Select it.
  Assign: Available (not Required) → SG — All Windows Devices. This makes the app available in Company Portal for users to install themselves — not forced.
  Save and record the difference in user experience between Required and Available deployment.

Part 2 — Linux Intune agent enrollment (~35 min)

• Step 6 — Prepare LINUX-01 (Ubuntu 22.04) (5 min)
  On LINUX-01, open a terminal. Verify internet access:
  curl -I https://microsoft.com
  Verify the OS version:
  lsb_release -a
  Update package lists:
  sudo apt update && sudo apt upgrade -y
• Step 7 — Install the Microsoft Intune agent on LINUX-01 (15 min)
  On LINUX-01, run the following commands in sequence:
  
  Add the Microsoft package repository:
  curl -sSL https://packages.microsoft.com/keys/microsoft.asc | sudo gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/ubuntu/22.04/prod jammy main" | sudo tee /etc/apt/sources.list.d/microsoft-ubuntu-jammy-prod.list
  
  Update and install the agent:
  sudo apt update
  sudo apt install intune-portal -y
  
  Launch the Intune Portal app (GUI) or start enrollment via CLI:
  sudo intune-portal
  
  Sign in with the M365 Global Admin account. Accept the terms. The agent will register the device with Intune.
• Step 8 — Verify LINUX-01 in Intune (5 min)
  Navigate to intune.microsoft.com → Devices → All devices.
  LINUX-01 should now appear alongside WIN-CLIENT-01 and WIN-CLIENT-02.
  Record: OS type shown, Join type, MDM agent version, compliance state (will be Not evaluated until a Linux compliance policy is assigned).
• Step 9 — Create and assign a Linux compliance policy (10 min)
  Navigate to Intune → Devices → Compliance → + Create policy.
  Platform: Linux. Name: LL — Linux Baseline Compliance.
  
  Configure:
  · Allowed distros: Ubuntu 22.04
  · Minimum OS version: 22.04
  · Password required: Yes
  · Minimum password length: 8
  
  Assign to a new group: create a dynamic device group SG — All Linux Devices with membership rule:
  (device.deviceOSType -eq "Linux")
  
  Assign the policy to this group. Save.

⭐ Bonus: Linux custom compliance script & app inventory

Reflection & Week 6 preview

• Ask: "You deployed 7-Zip as Required. A user on WIN-CLIENT-01 uninstalls it manually. What does Intune do?" — answer: detects the missing app via the detection rule at next check-in and re-installs it silently. Required = enforced presence.
• Ask: "LINUX-01 is now enrolled. Its compliance state is Compliant. You add the CA condition 'Require compliant device'. Can the user on LINUX-01 now sign into M365?" — answer: yes, if the device is compliant. The same CA gate applies cross-platform.
• Ask: "What can Intune NOT do on a Linux machine that it CAN do on a Windows machine?" — surface the Linux limitations: no configuration profiles (settings catalog doesn't work), no Win32 app types, no BitLocker enforcement, no Autopilot. Compliance and inventory only — plus DEB app deployment.
• Exit ticket: explain the Win32 packaging pipeline in your own words — what does IntuneWinAppUtil do, what does the detection rule do, and why is the detection rule the most likely point of failure?
• Preview Day 5: Week 6 assessment — a non-compliant device scenario. A device is reporting non-compliant for multiple reasons (outdated OS, Defender off, no BitLocker). Students diagnose, remediate, verify, and then write a full explanation of the CA chain from device state to M365 access.