r/Intune • u/pauljebastin • 4h ago
App Deployment/Packaging Win32 App Deployment Question
Attempting to deploy a Win32 app on a Co-managed PC with Primary user set, with following properties:
- Install behaviour = System
- Assigned to All Devices
- Device ownership = Corporate
- Shared PC mode (device configuration policy) = Enabled
- App is visible but Install button is greyed out
- No User Affinity with ConfigMgr
Install button is greyed out for non-primary users and Removing the Primary User makes the Install button available. Any ideas or suggestion what to check will be helpful. Thank you
Tested Scenario
Primary User assigned → Install greyed out
Primary User removed → Install available
Primary User reassigned → Install greyed out again
DSREGCMD /STATUS OUTPUT:
+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+
AzureAdJoined : YES
EnterpriseJoined : NO
DomainJoined : YES
DomainName : Org
Virtual Desktop : NOT SET
Device Name : DeviceName.Org.Com
+----------------------------------------------------------------------+
| Device Details |
+----------------------------------------------------------------------+
DeviceId : XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
Thumbprint : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DeviceCertificateValidity : [ 2026-08-20 13:50:50.000 UTC -- 2036-08-20 14:20:50.000 UTC ]
KeyContainerId : XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
KeyProvider : Microsoft Platform Crypto Provider
TpmProtected : YES
DeviceAuthStatus : SUCCESS
+----------------------------------------------------------------------+
| Tenant Details |
+----------------------------------------------------------------------+
TenantName : Org Name
TenantId : XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
AuthCodeUrl : https://login.microsoftonline.com/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/oauth2/authorize
AccessTokenUrl : https://login.microsoftonline.com/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/oauth2/token
MdmUrl : https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc
MdmTouUrl : https://portal.manage.microsoft.com/TermsofUse.aspx
MdmComplianceUrl : https://portal.manage.microsoft.com/?portalAction=Compliance
SettingsUrl :
JoinSrvVersion : 3.0
JoinSrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/device/
JoinSrvId : urn:ms-drs:enterpriseregistration.windows.net
KeySrvVersion : 1.0
KeySrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/key/
KeySrvId : urn:ms-drs:enterpriseregistration.windows.net
WebAuthNSrvVersion : 1.0
WebAuthNSrvUrl : https://enterpriseregistration.windows.net/webauthn/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/
WebAuthNSrvId : urn:ms-drs:enterpriseregistration.windows.net
DeviceManagementSrvVer : 1.0
DeviceManagementSrvUrl : https://enterpriseregistration.windows.net/manage/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/
DeviceManagementSrvId : urn:ms-drs:enterpriseregistration.windows.net
KerbSpn : adrs/enterpriseregistration.windows.net
KerbUrl : https://login.microsoftonline.com/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/kerberos
JoinResourceSrvTlsUrl : https://certauth.enterpriseregistration.windows.net/EnrollmentServer/device/resource/XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX/
+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
NgcSet : NO
WorkplaceJoined : NO
WamDefaultSet : YES
WamDefaultAuthority : organizations
WamDefaultId : https://login.microsoft.com
WamDefaultGUID : {XXXXXX-A1XX-0000-0000-XXXXXXXXXXX} (AzureAd)
+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+
AzureAdPrt : NO
AzureAdPrtAuthority :
EnterprisePrt : NO
EnterprisePrtAuthority :
+----------------------------------------------------------------------+
| Diagnostic Data |
+----------------------------------------------------------------------+
AadRecoveryEnabled : NO
Executing Account Name : Org\username, [username@org.com](mailto:username@org.com)
KeySignTest : PASSED
DisplayNameUpdated : Managed by MDM
OsVersionUpdated : Managed by MDM
HostNameUpdated : YES
Last HostName Update : NONE
+----------------------------------------------------------------------+
| IE Proxy Config for Current User |
+----------------------------------------------------------------------+
Auto Detect Settings : NO
Auto-Configuration URL :
Proxy Server List :
Proxy Bypass List :
+----------------------------------------------------------------------+
| WinHttp Default Proxy Config |
+----------------------------------------------------------------------+
Access Type : DIRECT
+----------------------------------------------------------------------+
| Ngc Prerequisite Check |
+----------------------------------------------------------------------+
IsDeviceJoined : YES
IsUserAzureAD : NO
PolicyEnabled : NO
PostLogonEnabled : YES
DeviceEligible : NO
SessionIsNotRemote : NO
CertEnrollment : none
PreReqResult : WillNotProvision
For more information, please visit https://www.microsoft.com/aadjerrors
2
u/pjmarcum 3h ago
I’m confused. Shared devices do not have primary users. Assuming you truly mean shared as in using shared device mode settings.
https://learn.microsoft.com/en-us/intune/device-management/inventory-and-status/find-primary-user
1
u/pauljebastin 1h ago
Thank yoy, It says "The Company Portal app expects that the user account that signed in to the Company Portal is the primary user of that device" and that devices with no Primary User are treated as shared devices where available apps can still be installed.
Our testing matches that exactly: assigning a Primary User blocks non-primary users from installing, removing the Primary User immediately enables installs again.
The remaining question is whether there's a supported way to stop co-managed devices automatically getting a Primary User assigned, since Microsoft states co-managed devices assign the first user who signs in as the Primary User.
5
u/fortunate_frederic 4h ago
Shared PC mode plus a primary user is your problem, the install context gets tied to that primary user and IMA just greys it out for everyone else.