5.3 App Stores and Update Lifecycle

The Intune app lifecycle

Microsoft describes the Intune app lifecycle as add, deploy, configure, protect, and retire. That lifecycle is a useful mental model for MD-102. First you add the app to Intune from a package, store, catalog, or service. Then you assign it to users or devices. After deployment, you configure app settings, protect work data, monitor results, update versions, and eventually remove the app.

Microsoft Store app (new)

For Windows, Intune can browse and search Microsoft Store apps inside the admin center. Supported Microsoft Store apps can be assigned as Required, Available for enrolled devices, or Uninstall. Store apps deployed through Intune are automatically kept up to date when a new version is available, but the details vary by app type.

For Universal Windows Platform apps, Store auto-update settings still matter. For Microsoft Store Win32 apps, the app must have an active Intune assignment for Intune to keep it updated. Be careful with system versus user install context. A Microsoft Entra registered device should use system context when required by the Store app behavior.

Managed Google Play

For Android Enterprise, Managed Google Play is the enterprise app store source. Intune can deploy public store apps, private line-of-business apps, and web links through Managed Google Play. Apps are approved, synchronized into Intune, and then assigned like other apps.

Android update behavior is often scenario tested. Managed Google Play apps normally update when the device is on Wi-Fi, charging, not actively used, and the app is not running in the foreground. Assignment update modes let you choose Default, High Priority, or Postponed. High Priority updates as soon as possible and can be disruptive. Postponed starts a 90-day window before the app updates.

Permissions matter. If the app developer adds new permissions, updates might not install until an admin approves those permissions. That is different from Windows Store app update behavior and is a common source of Android deployment issues.

Apple and other platform stores

For iOS/iPadOS and macOS, Intune commonly uses store apps and Apple volume-purchased apps. The exam usually tests the management idea, not Apple purchasing mechanics: choose store-based app deployment when the app comes from the platform store, use app assignment to control availability or required installation, and use app protection/configuration policies when the goal is data protection or app settings rather than binary deployment.

Enterprise App Catalog and update lifecycle

Microsoft Intune Enterprise App Management adds the Enterprise App Catalog, a collection of Microsoft-hosted, prepared Win32 apps. It is an Intune Suite add-on. Catalog apps reduce packaging work because install commands, uninstall commands, return codes, detection rules, and requirements can be prefilled.

Do not assume catalog updates install automatically. Enterprise App Catalog updates are surfaced in Intune, and the update workflow creates a new app version with a supersedence relationship. Some catalog apps self-update through the vendor process; in those cases Intune ensures at least a minimum detected version and reports the detected version.

Choosing the lifecycle answer

When a question says app updates should be automatic and the app is store-sourced, prefer the platform store deployment path. When the question says the organization controls a custom installer or replacement version, expect a Win32 update or supersedence answer. When the question says users need optional software, use Available. When a testing phase ends, use Uninstall. When only corporate data must be removed from a mobile app, think selective wipe or app protection rather than uninstalling the whole app.