Skip to main content

146: Store Apps

Implementation Effort: Low to Medium — onboarding Store apps is relatively easy, but app approval and lifecycle governance still matter.

User Impact: Low — users usually receive apps transparently or through Company Portal with minimal disruption.

Overview​

Microsoft Intune can deploy applications from the modern Microsoft Store app experience so administrators do not need to package every supported app manually. This is useful for Zero Trust operations because it reduces unmanaged software installation paths, keeps publisher metadata visible, and makes it easier to standardize deployment and retirement of approved applications. Administrators should avoid building new workflows around the retired Microsoft Store for Business and Education model.

Implementation Guidance​

  • Use the current Microsoft Store app integration in Intune for supported apps when it meets your needs, and reserve manual Win32 packaging for apps that need custom install logic or unsupported Store scenarios.
  • Validate publisher, package identity, install context, update behavior, and architecture support before approving the app for broad deployment.
  • Assign apps as required or available based on user role and supportability, and decide whether users may self-install the app from Company Portal or receive it automatically.
  • Test how Store-sourced applications update over time and whether those updates align with your change-management and security expectations.
  • For sensitive or higher-risk apps, pair deployment with device compliance, application allow-listing, Microsoft Defender protections, and extension or add-in governance where applicable.
  • Retire or replace any internal documentation that still refers users or admins to Microsoft Store for Business or Microsoft Store for Education.

Reference​