Cannot install software apps from Company Portal

[daved3]

Hello - I am new to Intune.  I am setting up new company computers with InTune and MDM so i can manage them, expecially applications.

I have Azure AD Joined the computers (set as Corporate owned) in Intune and they sync well in endpoint manager.

If I set the primary user to my Admin account, when I log in, I can install applications thru the Company Portal.

Then when I assign one of my users as the primary user, and they try to install apps thru the Company Portal, they cannot.  They can see the apps, they try to install but it gets stuck at Download Pending, then - "it's taking too long - please retry".

Has anyone seen this ?  Any hints what I can try to fix this ?  I looked the certificates, when logged in with a User's account, and they don't seem to have any Intune certificates (?) however, the computer is able to sync with End point manager...

Any help is greatly appreciated (been struggling with this for days now...)
Dave

[#2]

Also, all users have E5 license, so i don't think it is a licensing issue

[#3]

Hi @daved3 , Please try to change the intent or any one app as "Required" and then assign it to the group and check the status. Also, check the intune extension logs. 

Br/
Somesh

[#4]

When you say apps which type do you mean? LOB, or Win32, or Built-in apps (like O365 or PowerBI).

Make sure apps are configured to run as System instead of logged on User. Knowing what types apps your deploying will help narrow down the issue.

[#5]

@daved3 

Hi... the certificates are stored in the computer certificate store... not in the user his certificate store

Are you experiencing this with all apps or only one? Lob or win32app apps?

If win32 app, could you check out at which step it stops working? does the download file even gets created? 

Troubleshooting failed Intune Win32 Apps installation | IME (call4cloud.nl)

The same goes for lob apps... :) 

Getting back your MSI | LOB apps from Intune (call4cloud.nl)

[#6]

Thanks for your response. I am trying to install "MS 365 Apps for Windows 10".
I have also added Adobe Photoshop express from the Microsoft Store to the Company Portal and tried to install it. Same result, just stuck on Downloading.
Both are configured under Assignments for All Users under Available for enrolled devices.

[#7]

Thanks for the response. I am looking up how to configure apps to run as System instead of logged on User.

[#8]

When I installed MS 365 Apps i used "Windows 10 and later" type as per
https://www.codetwo.com/admins-blog/app-deployment-with-intune/

So - how does this relate to win32 app or LOB type ?

Thanks
Dave

[#9]

Hello Somesh - I looked for logs in “C:\ProgramData\Microsoft\IntuneManagementExtension\Logs”
However this directory does not exist on the User computer that is trying to install the app. There is no C:\ProgramData folder

[#10]

Did you happen to also have read this blog about using a win32 app for office365 apps https://call4cloud.nl/2021/02/office-csp-vs-win32app-dawn-of-justice/

[#11]

Programdata is a hidden folder so just put it in the explorer or change the explorer options to show hidden folders etc

[#12]

Oops - thanks - Found the “C:\ProgramData\Microsoft\" folder, however there is no IntuneManagementExtension folder.

I also checked in Registry for
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\
but this does not exist either .

[#13]

The ime extension ie only installed if you push a win32 app or powershell script… its somewhere mentioned in the ms docs.. but the blog i showed you, will show you how could track down the office 365 build in option in intune

[#14]

Thanks - I am following the link that you posted - https://call4cloud.nl/2021/02/office-csp-vs-win32app-dawn-of-justice/
to install as win32. I will delete the previous entry in Apps that I added in Endpoint manager to install as M365 apps.

[#15]

Hi Rudy

Following this link
https://call4cloud.nl/2021/02/office-csp-vs-win32app-dawn-of-justice/
I am stuck on the section on
"Detection Rules are always important, to make sure you have the right registry path, open the register and choose your option!"
there are 2 options provided. However, I have never installed Office on these machines, so there is no key for Office 365
No HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\O365ProPlusRetail
and no
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration.
so for the rules used to detect the presence of the app, i am not sure how to set up the detection rule...

I am guessing I should use the ClickToRun, although, it does not exist in the registry yet, i assume it will be added when Microsoft 365 apps are installed ?

[#16]

So I completed setting up the new App as a Win32 app, and set the assignment to "Required" and group = All Devices
I now am getting log files IntuneManagementExtension.log files

The error i am seeing in the log file is

Failed to get AAD Token len=347
AAD User check is failed, exception is Intune Management Extension Error.
Exception: Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.TokenAquireException: Attempt to get token, but failed.

However, if I look at the Device in End Point Manager, I can see that the device is Sync'ing OK.

Does anyone have any idea how to resolve this error

Thanks
Dave

[#17]

It is now successfully getting the token.

New error is now

Didn't find cert in both store, retry 30 IntuneManagementExtension 2022-08-08 3:25:51 PM 11 (0x000B)

Then
Failed to get device id, abort powershell check in.

ugh

[#18]

Looks like the intune mdm cert is missing... i also replied on the other topic you opened

[#19]

Sorry for double post. This thread is getting too long and i seem to have several issues happening. I will stop posting her and break down all the issues into individual posts. Here is link to the mdm cert missing post.
https://techcommunity.microsoft.com/t5/microsoft-intune/didn-t-find-cert-in-both-store-in-intunemana...

Thanks
Dave