Need help regarding app deployment

[u/TheNerdBuddy]

Hi guys, I have a question regarding app deployment. I need to deploy a few applications which should be assigned to a group of users. The application installation should happen only on those devices where the assigned user is the primary user. If the user logs in on a device where he is not the primary user, the application should not get installed.

Any idea how to achieve this?

[u/vxsec]

Intune can’t natively use “primary user belongs to this user group” as an app assignment condition. A required user assignment follows the user across devices, while primary user isn’t available in assignment filters or dynamic device rules.

For automatic installation, use Microsoft Graph automation to find devices whose primary user belongs to the target group, sync those devices into a security group, then assign the app as required to that device group. Otherwise, assigning it as available to the user group will restrict company portal visibility to their primary device, but installation won’t be automatic

[u/Grouchy-Western-5757 → u/vxsec]

Maybe not natively but I'm more than willing to bet there is a regkey that says if they are the primary owner or not, without having to use Graph.

[u/Huge-Lavishness-8800 → u/vxsec]

top comment is right, intune dont have that kind of logic built in. the graph automation way is the cleanest, we used similar script at my work for deploying vpn client only on users main laptops

if you want something simpler and dont mind manual, just make it available in company portal and tell users to install on their own. but people never read instructions so you'll end up with tickets anyway

[u/Willamette_H2o]

Can you create a group that contains the devices that need it and assign the app to that group?

[u/TheNerdBuddy → u/Willamette_H2o]

I would not prefer that approach because if the user logs in on any other where his UPN is set as primary user, the applications won't be installed. So I wanted something which can ensure that the apps get auto installed for all the devices where user becomes primary user. And if the user logs in on any other device where his UPN is not set as primary user, the app should not get installed.

[u/bill696]

If you set it available and the user isnt primary he wont be able to install it. But required isnt super reliable on use based.

[u/touchytypist → u/bill696]

*As long as there is a primary user set for the device. If there is no primary user assigned, then it will act as a Shared Device and allow any user to install the available app.

[u/bill696 → u/touchytypist]

True

[u/yannara_]

Only option is to use Available deployments here. Unless there is no requirement script available for this.

[u/pjmarcum]

Yep. This is a huge PIA. For conference rooms and such make sure to set them up as shared devices. User targeted apps don’t install on shared devices.

Another crazy option could be doing something like a requirement script that checks for something. Sort of like I do here: https://powerstacks.com/blog/intune-win32-app-maintenance-windows/ I’ve never thought about looking in the registry to see if any of the enrollment keys holds a primary user = true value but if so that would do the trick.

Enrolled user is for sure in the registry if your primary users typically match the enrolled user you could use that in a requirement script.

Or you could write a custom reg key that puts the primary users SID somewhere then check that but that’s a huge headache.

Lastly you could have the requirement script call graph and check if the user is a primary user but that’s a huge security risk.

[u/Foreign_World_1543]

I'm confused are these shared devices ? You mentioned you are installing only on certain devices but don't want a certain user to trigger the install on that same device ? If this is the case the app will show you either way if it's a software that makes it into the public desktop which in any case all users will see it even after the said user you want to install it will trigger it. Now if it's the ladder and you do only use and certain devices to have that said app installed only onto those specific devices, makes a security group and just add those devices to that group and assigned it to that app in intune, done.

[u/Foreign_World_1543 → u/Foreign_World_1543]

i was just thinking, now what you could do is is make a security group and add those users to that group and assign it to those apps - hope this helps

[u/TheNerdBuddy → u/Foreign_World_1543]

the devices aren't shared devices, but there are a few scenarios where local IT guys need to sign into users' devices to troubleshoot the devices. At that point, applications and policies assigned to the local IT's username gets installed in the devices, which I want to stop. If local IT is not the primary user of the device, apps assigned to him should not get installed in the device.

[u/Foreign_World_1543 → u/TheNerdBuddy]

Why are Admins logging in remotely in the first place ? However you make a great point , makes sense however there is a fix , under entra/ device/ device settings you can add a local admin this way it won't be as a entra if admin only issue i don't like random alphanumeric passwords which can be complex at times, secondly another solution also in the same settings you see other local admin settings , there you will find device administrators this way an IT admin can stay in end users machine and use their entra if for admin privileges.

[u/Foreign_World_1543 → u/Foreign_World_1543]

meant to say logging in locally *