Upcoming improvements to Win32 app supersedence

Microsoft

Jan 11, 2023

Updated 04/05/2023: The Win32 app supersedence feature is now fully rolled out. Add Win32 app supersedence for more information about how to configure and use the feature.

The Win32 app supersedence feature enables admins to upgrade or replace existing Win32 apps with newer versions of the same or entirely different Win32 app in a controlled manner. Since its launch, we’ve received a great deal of positive feedback about how supersedence helps admins streamline app updates. We’ve also received feedback on how we could further improve the feature to serve you better, especially related to how supersedence interacts with both app dependencies and the enrollment status page (ESP). Major improvements to these areas, include:

Creating supersedence and dependency relationships in the same app subgraph. A subgraph is a set of apps connected to each other through supersedence and dependency relationships. Note: If there is a conflict between supersedence and dependency intent, the Intune Management Extension (IME) will enforce the supersedence intent, if possible. Some intent may be blocked due to conflicts.
Improving app tracking behavior during ESP.
Supporting supersedence relationships during ESP.

These new improvements complement the current supersedence behaviors available today. For more information about what’s currently being offered, see Add Win32 app supersedence.

Improvements to app processing

	Old Behavior	New Behavior
General dependency processing	Even if the parent app cannot be installed, dependency processing will install as many dependency apps as possible regardless of the targeting on dependencies.	If a parent app cannot be installed, dependency app processing will halt until the blocking condition is resolved. Examples include instances when: The parent app is not applicable. One of several dependencies is not applicable. A dependency is in a failure state A dependency has a detect-only dependency relationship and is not detected It’s possible for some customers using the dependency feature to achieve app sequencing to experience unexpected outcomes with this behavioral change.
Uninstalling dependency apps	Dependency apps can only be uninstalled if parent apps are no longer targeted.	Dependency apps can be uninstalled if all parent apps are also targeted with an uninstall intent.
Applicability & requirement checks	Applicability and requirement checks run only after determining that an enforcement action is needed based on the intent and detection status of the app.	Applicability and requirement checks run for all apps in every check-in. Apps are required to report this data to the service for analysis.
Detection checks	The IME runs detection checks for apps to determine two parts of enforcement. The first check determines whether enforcement is necessary. Once enforcement is completed, the second check determines the post-enforcement state of the app on the device. Detection checks for child dependency apps may be skipped under certain conditions.	The IME runs detection checks for all apps in every check in (as permitted by the re-evaluation schedule) as part of its analysis of which apps to enforce and to report to the service. Additional detection checks are performed before more time-consuming operations occur, such as download and install.

Improvements to app tracking behavior

Current Tracking Behavior	New Tracking Behavior
All targeted apps are tracked, including apps that are not applicable to the device. Untargeted dependency apps are not tracked. Apps that are not applicable are reported by the Intune management extension as “Completed” to the ESP.	All apps that need to be installed will be tracked. Apps that are not applicable to the device will not be tracked. Untargeted dependency apps will be tracked if their parents are installed. Apps that were previously tracked and no longer require installation will be reported by the Intune management extension as “Completed” to the ESP.

When will these new improvements be available?

The rollout is now complete. You can now create apps with both supersedence and dependency relationships in the Intune admin center or by checking the Intune management extension logs on an enrolled device. In the logs, look for the following text:

[Win32App] espSupportForSupersedenceEnabled : True, v2AppPrococesorDisabled : True

If v2AppPrococesorDisabled is set to true, then your devices are operating with the new improvements. The espSupportForSupersedenceEnabled value will only be true when the device is in ESP and is operating in the new mode.

If you have any questions or feedback, leave a comment below or reach out to us on Twitter @IntuneSuppTeam.

Post updates:

04/05/2023: Updated content to reflect that the feature is now fully rolled out and available.

Updated Dec 19, 2023

Version 7.0

WIN32

windows

Intune_Support_Team

Microsoft

Joined October 11, 2018

View Profile

Intune Customer Success

Follow this blog board to get notified when there's new activity

6 Comments

John Jones
Copper Contributor
May 12, 2023
Awesome. long awaited addition.
Can you also please add functionality to the Dependencies and Supercedence viewers, to allow the ability to not only see what the app depends on, but also what apps depend on it. The same would also be useful for Supercedence.
Also, while we're at it, could you also show the version of a dependency, whenever you query it, as is the case for Supercedence please?
Grant195
Copper Contributor
Apr 07, 2023
Any ideas when "Delivery optimistion" setting(foreground/background) will flow onto a dependency app. E.g. If I target as available via company portal (foreground), user triggers it but has a dependency for a runtime app for example, it falls back to background leaving the user to wait the default 1 hour for background for the app to install.
aschobba
Copper Contributor
Jan 31, 2023
For us, it feels like a major step back. We have for example a VoIP software in place that is required by some users who are getting it assigned via a dynamic group. If there is a new release of the voip software, we first place it as available in the Company Portal so that some users that maybe have trouble or want to test the new version can use it. But now this doesn't work anymore because later it gets downgraded to old version that is still assigned as required even if the new one is superseding the old app.

I think this is because of "Apps that are not applicable to the device will not be tracked." which was coming with the new release.
Greg_A
Iron Contributor
Jan 18, 2023
Is there any dependency on Windows versions/builds for this to be supported? Or is it just the Intune and/or IME version?
Matt_Dundas
Copper Contributor
Jan 13, 2023
Changes look great but I do agree with AaronHall we also have a number of applications that require a chain of several applications to be installed prior to successful install of appX.

One of the main challenges we have is no ability to detect Microsoft 365 Apps as having office installed is a pre req for many apps to install. I understand you can package office as a Win32 App but it increases complexity and puts the package update onus on the customer when there is a perfectly good deployment method provided by Microsoft.

Otherwise some great changes!
AaronHall
Brass Contributor
Jan 12, 2023
Sounds like good improvements to be sure. That said, my biggest desire right now is for improvements to Dependencies-- specifically let me configure and/or in cases where a dependency would require ANY of the listed requirements and not ALL. For example:

I have App1 that requires either App2 or App3 to be installed. While App2 and App3 might be installed, it's not required. However, I can't currently configure that scenario without creating separate deployments for App2 and App3.

\n \n	\n Old Behavior \n	\n New Behavior \n
\n General dependency processing \n	\n Even if the parent app cannot be installed, dependency processing will install as many dependency apps as possible regardless of the targeting on dependencies. \n \n \n	\n If a parent app cannot be installed, dependency app processing will halt until the blocking condition is resolved. \n \n Examples include instances when: \n \n The parent app is not applicable. \n One of several dependencies is not applicable. \n A dependency is in a failure state \n A dependency has a detect-only dependency relationship and is not detected \n \n It’s possible for some customers using the dependency feature to achieve app sequencing to experience unexpected outcomes with this behavioral change. \n
\n Uninstalling dependency apps \n	\n Dependency apps can only be uninstalled if parent apps are no longer targeted. \n	\n Dependency apps can be uninstalled if all parent apps are also targeted with an uninstall intent. \n
\n Applicability & requirement checks \n	\n Applicability and requirement checks run only after determining that an enforcement action is needed based on the intent and detection status of the app. \n	\n Applicability and requirement checks run for all apps in every check-in. Apps are required to report this data to the service for analysis. \n
\n Detection checks \n	\n The IME runs detection checks for apps to determine two parts of enforcement. The first check determines whether enforcement is necessary. Once enforcement is completed, the second check determines the post-enforcement state of the app on the device. \n \n Detection checks for child dependency apps may be skipped under certain conditions. \n	\n The IME runs detection checks for all apps in every check in (as permitted by the re-evaluation schedule) as part of its analysis of which apps to enforce and to report to the service. \n \n Additional detection checks are performed before more time-consuming operations occur, such as download and install. \n

\n Current Tracking Behavior \n	\n New Tracking Behavior \n
\n \n All targeted apps are tracked, including apps that are not applicable to the device. \n Untargeted dependency apps are not tracked. \n Apps that are not applicable are reported by the Intune management extension as “Completed” to the ESP. \n \n	\n \n All apps that need to be installed will be tracked. \n Apps that are not applicable to the device will not be tracked. \n Untargeted dependency apps will be tracked if their parents are installed. \n Apps that were previously tracked and no longer require installation will be reported by the Intune management extension as “Completed” to the ESP. \n \n

\n \n	\n Old Behavior \n	\n New Behavior \n
\n General dependency processing \n	\n Even if the parent app cannot be installed, dependency processing will install as many dependency apps as possible regardless of the targeting on dependencies. \n \n \n	\n If a parent app cannot be installed, dependency app processing will halt until the blocking condition is resolved. \n \n Examples include instances when: \n \n The parent app is not applicable. \n One of several dependencies is not applicable. \n A dependency is in a failure state \n A dependency has a detect-only dependency relationship and is not detected \n \n It’s possible for some customers using the dependency feature to achieve app sequencing to experience unexpected outcomes with this behavioral change. \n
\n Uninstalling dependency apps \n	\n Dependency apps can only be uninstalled if parent apps are no longer targeted. \n	\n Dependency apps can be uninstalled if all parent apps are also targeted with an uninstall intent. \n
\n Applicability & requirement checks \n	\n Applicability and requirement checks run only after determining that an enforcement action is needed based on the intent and detection status of the app. \n	\n Applicability and requirement checks run for all apps in every check-in. Apps are required to report this data to the service for analysis. \n
\n Detection checks \n	\n The IME runs detection checks for apps to determine two parts of enforcement. The first check determines whether enforcement is necessary. Once enforcement is completed, the second check determines the post-enforcement state of the app on the device. \n \n Detection checks for child dependency apps may be skipped under certain conditions. \n	\n The IME runs detection checks for all apps in every check in (as permitted by the re-evaluation schedule) as part of its analysis of which apps to enforce and to report to the service. \n \n Additional detection checks are performed before more time-consuming operations occur, such as download and install. \n

\n Current Tracking Behavior \n	\n New Tracking Behavior \n
\n \n All targeted apps are tracked, including apps that are not applicable to the device. \n Untargeted dependency apps are not tracked. \n Apps that are not applicable are reported by the Intune management extension as “Completed” to the ESP. \n \n	\n \n All apps that need to be installed will be tracked. \n Apps that are not applicable to the device will not be tracked. \n Untargeted dependency apps will be tracked if their parents are installed. \n Apps that were previously tracked and no longer require installation will be reported by the Intune management extension as “Completed” to the ESP. \n \n

Blog Post

Upcoming improvements to Win32 app supersedence

Improvements to app processing

Improvements to app tracking behavior

When will these new improvements be available?

6 Comments

Share

Improvements to app processing

Improvements to app tracking behavior

When will these new improvements be available?

Improvements to app processing

Improvements to app tracking behavior

When will these new improvements be available?