How to Deploy MSI Applications using Intune

In this step-by-step guide, I will show you how to deploy MSI applications using Intune. If your organization has an in-house or custom MSI app, you can use Intune to install this app to your devices or users using the steps covered in this guide.

Microsoft Intune supports the deployment of various app types. One such example of a supported app type is Line-of-business apps, also called as custom apps or in-house apps. These apps are usually created by your organization with a specific purpose. To include LOB apps in your managed environment, you upload the app installation file to Intune and assign the app to devices or groups from Intune.

The LOB app type requires you to upload a valid Windows app package file. The supported file extensions for Windows LOB apps include .msi, .appx, .appxbundle, .msix, and .msixbundle. Intune installs the LOB app on the user’s device using a process called sideloading, which allows an app to be installed that isn’t certified by the Microsoft Store using the Intune Management Extension.

Note: There are two ways to deploy the MSI applications in Intune. You can upload the MSI app as a Line of Business app type in Intune or convert it to a Win32 app first and deploy it to Windows devices. Converting an MSI installer to Win32 app and deploying it requires more time and effort. So always stick to using the line-of-business app method for distributing the MSI apps.

Prerequisites

The following are the prerequisites for deploying MSI applications with Intune:

1. MSI File: Ensure you have a valid .msi installer file to deploy. If it’s a custom MSI installer, I recommend testing the installation manually to confirm it’s working.
2. Intune Access: You must have administrative rights in the Microsoft Intune Admin center.
3. Azure AD-Joined Devices: Devices must be Azure AD Joined or Hybrid AD Joined. You must have enrolled the Windows devices in Intune.
4. Supported Editions: Windows 10/11 Pro, Enterprise, or Education (Intune does not support Windows Home editions).
5. Silent switches for MSI installer: If you wish to deploy an MSI app silently without requiring user inputs, check with vendor support for silent switches. A proper testing is mandatory before rolling out the app to business users or devices.

Steps to Deploy MSI Applications Using Intune

Deploying any MSI application with Intune involves a series of steps. To make the deployment easier for administrators who are new to installing MSI apps with Intune, I have broken down the procedure into individual steps. I hope you find these steps easy to follow.

The below image shows the 5 essential steps for MSI app deployment using Intune.

Step 1: Download MSI Installer File

To start with, you will need an MSI installer file for the deployment. As an example, I will download the 7-zip application, which is the new archive format, providing a high compression ratio. It is a popular software that is free and open source. In your case, the MSI installer file may be different, but the deployment procedure remains the same.

Open the browser and visit the 7-Zip website. Under the Download section, look for the latest version and click on the download link for the 64-bit MSI installer. The browser now downloads the .msi installer for 7-Zip application. This file will be uploaded to Intune in the next step.

Step 2: Prepare the MSI Package

Place the 7z-x64.msi file on a network share or local system. Check if additional command-line parameters are required for a silent installation. Usually, /qn is used to install MSI packages silently.

In addition to the MSI installer, I recommend you download the icon for the application. This icon will be visible to users along with the app in the company portal. Setting a logo makes it easier for users to recognize the application.

Step 3: Upload the MSI file to Intune

To add the MSI file to Intune, sign in to the Microsoft Intune admin center. Select Apps > All Apps. Click the + Add button. In the Select app type pane, under the Other app types, select Line-of-business app.

When you select Line-of-business app, you have the option to add your specific installation package file. In the Add app pane, click on the select app package file and upload the Windows installation file (.msi installer). The App package file now shows details that include installer name, platform, size of the installer, execution purpose, and MAM property. Click OK.

Step 4: Set MSI App Information

On the App information tab, you can configure the application details. You’ll notice that some of these details are populated in Intune automatically because they are supplied by the application vendor during the app creation. However, the following app details for MSI applications can be configured in Intune.

• Name: Enter the unique name of the app as it appears in the company portal.
• Description: Provide an app description which appears in the company portal for users. If it’s a custom MSI app, it is highly recommended that you provide the description.
• Publisher: Enter the name of the publisher of the app.
• App Install Context: This setting lets you decide how you want to install the app. Select the installation context to be associated with this app. For dual mode apps, select the desired context for this app. For all other apps, this option is pre-selected based on the package and can’t be modified.
• Ignore app version: Set this to “Yes” for apps that are automatically updated by the app developer (such as Google Chrome). If not, select No.
• Command-line arguments: This is a very useful option where you enter a command-line argument that you want to apply to the .msi file when it runs. For example, 7-zip supports /S parameter to do a silent installation. In case your .MSI file needs more than one command-line argument, consider using Win32 app management.

• Category: Select one or more of the built-in app categories, or select a category that you created.
• Show this as a featured app in the Company Portal: Display the app on the main page of the company portal when users browse for apps. Featured apps are prominently placed in the Company Portal so that users can quickly get to them.
• Information URL: This is an optional field where you can enter the website URL that contains information about this app.
• Privacy URL: An optional field to enter the URL of a website that contains privacy information for this app.
• Developer: Enter the name of the app developer. You can enter your organization name if it’s in-house built app.
• Owner: Optionally, enter a name for the owner of this app.
• Notes: Optional field to enter any notes that you want to associate with this app.
• Logo: Upload an icon that is associated with the app. This icon is displayed with the app when users browse through the company portal.

Once you’ve configured the above app details, click Next.

Step 5: Assign and Create the .MSI Application in Intune

On the Assignments page, you can select the Required, Available for enrolled devices, or Uninstall group assignments for the app. The options are explained below.

• Required: The MSI app is installed on devices in the selected groups.
• Available for enrolled devices: Users install the MSI app from the company portal app.
• Uninstall: The MSI app is uninstalled from devices in the selected groups.

In the below screenshot, you can see that I have deployed the 7-zip app as required to my users groups. By setting this option, the app will be installed on the end devices silently. Click Next.

On the Review+Create tab, review the values and settings you entered for the app. Select Create to add a new msi app to Intune.

Sync the Intune Policies

It takes 8 hours for Windows devices to receive an Intune policy, profile, or app after they are assigned. If you are testing the app deployment on pilot devices in your tenant, you can override this default sync interval time and manually sync the Intune policies. You may also use Microsoft Graph and PowerShell to force Intune policy sync on Windows devices.

Monitor Intune MSI App Deployment

When you create a Win32 app or MSI app in Intune, depending upon the size of the installer, it takes time to upload the file to Intune. You must wait until the app is uploaded to Intune. In the below screenshot, you see the app is not ready yet. If app content is uploading, wait for it to finish.

Keep an eye on the notifications as these are essential in determining whether the app upload was successful or not. Look for the final notification which says, “Application upload finished.” This confirms that the MSI app is successfully created in Intune.

To monitor msi app installation status, sign in to the Intune admin center. Now go to Apps > All apps. Enter the app name in the search box and select it. The app Overview blade shows the users or devices that have successfully installed the 7-Zip app.

In the below screenshot, we see the Intune MSI app deployment is successful on our devices. The count of devices that have installed the app will be updated as the installation progresses.

End User Experience: Verify Installation of MSI App

In Intune, if you have assigned the app as Available and featured it, the app should be available in the Company Portal for installation. If the MSI app is deployed as required, the user need not do anything because the app will be installed silently.

End users can verify the installation of the 7-Zip app by clicking on the Start button and typing ‘7zip‘ in the search box. The app appears in the search results if it is installed. To launch the app, click Open. On Windows 11, the 7-zip app also appears in the Apps > Apps & Features > Apps list.

Troubleshoot MSI Application Installation Errors

Intune provides detailed reports and logs, allowing you to troubleshoot any deployment issues and ensure successful app installation. MSI app installation is less prone to errors, but some devices may fail to install the app and report an error. In the event of errors, you can collect and review log Intune logs on Windows devices for troubleshooting MSI app deployment.

The Agent logs on the client machine are located in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. This location mainly contains the following log files that track the following information:

• AgentExecutor.log: This log file tracks PowerShell script executions (deployed by Intune).
• ClientHealth.log: This log file tracks the sidecar agent-client health activities.
• IntuneManagementExtension.log: The IME log that can be used to troubleshoot MSI App deployments
• AppWorkload.log: A new log for troubleshooting Win32 Apps. Read how to use AppWorkload.log.

Read Next

Check out some useful app deployment guides using Microsoft Intune

• Deploy Trusted Root Certificate using Intune
• Fix Error 0x87D13BA2 deploying a macOS LOB app in Intune
• Deploy DMG Apps for macOS using Intune
• Automate Intune Application Deployment using Chocolatey