5.3 App Stores and Update Lifecycle

The Intune app lifecycle

Microsoft describes the Intune app lifecycle as add, deploy, configure, protect, and retire. That lifecycle is a useful mental model for MD-102. First you add the app to Intune from a package, store, catalog, or service. Then you assign it to users or devices. After deployment you configure app settings, protect work data, monitor results, update versions, and eventually remove the app.

Microsoft Store app (new)

For Windows, Intune can browse and search Microsoft Store apps inside the admin center using the modern Store integration (built on winget). Supported Microsoft Store apps can be assigned as Required, Available for enrolled devices, or Uninstall. Store apps deployed through Intune are automatically kept up to date when a new version is published, but the details vary by underlying app type.

For Universal Windows Platform (UWP) apps, the Microsoft Store auto-update behavior still applies. For Microsoft Store Win32-type apps surfaced through the new Store experience, the app must have an active Intune assignment for Intune to keep it updated, and you should be deliberate about system versus user install context. A Microsoft Entra registered device generally needs system context where the Store app behavior requires it. The exam-friendly takeaway: choose Microsoft Store app (new) when a store-sourced Windows app must stay current automatically with minimal packaging.

Managed Google Play

For Android Enterprise, Managed Google Play is the enterprise app store source. Intune can deploy public store apps, private line-of-business apps, and web links through Managed Google Play. Apps are approved in the Managed Google Play store, synchronized into Intune, and then assigned like other apps. Android Enterprise enrollment always binds the tenant to a Managed Google Play account, so this is the default Android app source.

Android update behavior is frequently scenario-tested. Managed Google Play apps normally update when the device is on Wi-Fi, charging, not actively in use, and the app is not running in the foreground. Assignment update modes let you override that default:

Permissions matter. If the app developer adds new permissions, automatic updates can be held until an admin approves those new permissions in the Managed Google Play settings. That behavior is different from Windows Store app updating and is a common source of "updates are not installing" Android tickets.

Apple and other platform stores

For iOS/iPadOS and macOS, Intune commonly uses store apps and Apple volume-purchased apps (VPP) acquired through Apple Business Manager or Apple School Manager. The exam usually tests the management idea, not Apple purchasing mechanics: choose store-based app deployment when the app comes from the platform store, use assignment to control availability or required installation, and use app protection or app configuration policies when the goal is data protection or app settings rather than binary deployment. VPP supports device-based and user-based licensing, which can matter for shared iPads.

Enterprise App Catalog and update lifecycle

Microsoft Intune Enterprise App Management adds the Enterprise App Catalog, a collection of Microsoft-hosted, prepared Win32 apps, and it is an Intune Suite add-on. Catalog apps reduce packaging work because install commands, uninstall commands, return codes, detection rules, and requirement rules can be prefilled.

Do not assume catalog updates install automatically. Enterprise App Catalog updates are surfaced in Intune, and the controlled update workflow creates a new app version with a supersedence relationship. Some catalog apps self-update through the vendor's own process; in those cases Intune verifies that at least a minimum detected version is present and reports the detected version, rather than driving the update itself.

Choosing the lifecycle answer

When a question says updates should be automatic and the app is store-sourced, prefer the platform store deployment path. When the organization controls a custom installer or a replacement version, expect a Win32 update or supersedence answer. When users need optional software, use Available. When a testing phase ends, use Uninstall. When only corporate data must be removed from a mobile app, think selective wipe or app protection rather than uninstalling the whole app.

Who controls the update for each source

A clean way to answer update-lifecycle questions is to ask who actually drives the update for each app source. For Microsoft Store (new) apps, Intune and the Store keep supported apps current automatically once assigned. For Managed Google Play, Google's update modes (Default, High Priority, Postponed) plus new-permission approval govern timing. For Apple store / VPP apps, the app store and Apple manage updates, and Intune controls availability and required installation. For Win32 and line-of-business apps you uploaded, you own updates entirely through a new version and supersedence.

For Enterprise App Catalog apps, Microsoft prepares the package but you still trigger updates via supersedence, except for self-updating apps where the vendor updater runs and Intune verifies a minimum version. Memorizing this who-owns-the-update map turns most lifecycle questions into a quick lookup.

Retire and selective wipe at end of life

The retire phase has two flavors that the exam likes to contrast. Uninstall assignment removes an app that Intune installed, which is the right tool for ending a pilot or decommissioning software fleet-wide. Selective wipe (also called app selective wipe or a wipe of company data) removes only organizational data from a managed app while leaving the app and personal data in place; it is triggered through app protection / the app's company-data wipe action and is the answer when a BYOD user leaves and only work data must go.

Choosing a full device Wipe or Retire when the requirement is "remove only the corporate data from one app on a personal phone" is an over-reach and a wrong answer. Matching the cleanup mechanism to the exact data boundary is the final lifecycle skill MD-102 expects.