I cannot assign apps in intune to users for Windows 10

[Adam Berns]

I am a little stuck. And there is a lot to it.  I have on premise AD, and I have dirsync in play syncing everything. I also have AD Premier plan 2 and Intune. I see the user there and I have added them to a group. I have added that group to an app.  I have also done this with creating a cloud only user and cloud only group. I see the app assigned to the device, but when I go to look at the user(s) I do not see any apps listed. I do have SCCM on prem installed and this computer is in a collection. I am really new to intune. I have gone through https://docs.microsoft.com/en-us/intune/apps/troubleshoot-app-install with no answers. I have also looked at this article too: https://sccmentor.com/2018/05/14/deploy-microsoft-store-apps-via-intune/  I've also looked at this too: https://docs.microsoft.com/en-us/intune/apps/store-apps-windows. I am just simply stuck. Is there something easy I may be missing. I know this is a very wide open question. If you tell me what to share out for information I will. I am running the latest build of Windows 10 as well as SCCM.

[#2]

Here is the configuration of the package: 

For whatever reason, I can only choose Device Assignments.

[#3]

And lastly, if I look at a user in the Twitter Group, The application is listed. But it never shows up in the company portal intune app

[#4]

If you want to deploy apps/policies from Intune to your on-prem devices using SCCM you need to set-up Co Management.
The prequisite for Co Management is HYbrid Azure AD Joined computers (this means that your computers register itself to AzureAD. Check out this link: https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains

For more details on Co Management, check this out: https://docs.microsoft.com/en-us/configmgr/comanage/tutorial-co-manage-clients

[#5]

@Thijs Lecomte I do not want to do co management. I want just Azure for some machines and sccm for others. But if I understand what you are saying, if I remove the PC from the on-prem and join it to the azure ad instead, that would fix it? I would find that hard to believe that is how this issue would be fixed.

[#6]

What are you trying to achieve exactly?

You want to manage a machine that is AD joined, to be managed by Intune, but not by SCCM?

Or do you want a machine that is only AAD Joined and full cloud native?

[#7]

@Thijs Lecomte 

I want to be able to deploy apps to my windows 10 desktop via intune.

I have checked the hybrid stuff both domain joined and sccm, and everything is showing up correctly.

The only problem is that I am not seeing apps in the company portal app.

[#8]

Just to confirm, I only show enrollment for devices, not users. No matter how I assign the group, a device group, a user group, on-prem AD group or cloud group, or cloud user or on prem user, the app never shows up in the company portal on the client. And I am at loss of tyring to find logs to look at. Nothing in DeviceManagement-Enterprise-Diagnostic-Provider, but nothing related to apps. The only error in that log is this, which I think has nothing to do with this problem: MDM ConfigurationManager: Command failure status. Configuration Source ID: (C65624AF-D59E-40A3-8B59-66777E8415D7), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Receiver/Properties/Policy/FakePolicy/Version), Result: (The system cannot find the file specified.). (BTW, I have no idea what FakePolicy is)

[#9]

It should be put available to users, as putting it available to devices doesn't work.

What device is this specifically?
If this is a hybrid joined devices, it's possible you need to change the workload in SCCM

[#10]

@Thijs Lecomte that kind of makes sense. Okay, I did some tinkering with workloads. I was using Pilot Mode, but had the sliders set to Intune (not Pilot). Even after changing the sliders to pilot in workloads and rebooting a few times, no change.

[#11]

@Thijs Lecomte 

There is no option to available to users in intune. Only for devices.

[#12]

Could you please state your goal.
Which kind of join should these devices have?
- Full Azure AD
- Hybrid without SCCM
- Hybrid with SCCM?

[#13]

@Thijs Lecomte 

Hybrid with SCCM.

[#14]

Okay, so I have made some headway, but I think I made too many changes at once.

But... I changed my SCCM Hierarcy searches to not include my test machines.

I changed the workloads to match Pilot (as well as enablement and policies)

I then created a Windows 10 (office 365) to deploy a few office apps and selected both device and user groups and available to all users (I am sure I don't need all of those), and that got the software pushed down.

But if I create a windows 10 app from the app store using the same groups, it never shows up.

[#15]

@Thijs Lecomte So I did some digging around, looking at audit logs. What I found I think explains the problem. So here is the log from the IE77 beta release: It shows as MobileApp (even though in Intune it shows Windows 10, I did not even know there was a Windows Mobile 10 still in use).

Activity

Date: Tue, 31 Dec 2019 02:54:10 GMT

Name: Create application.

CorrelationID: ac190cac-289a-4e9e-aec8-e3a332d05720

Category: Application

Component: MobileApp

So I did the same thing for Twitter, created a new one, same groups and tags as for the Office 365 app, and I get it as a MobileApp Again

Date: Tue, 31 Dec 2019 05:07:55 GMT

Name: Create application.

CorrelationID: ded90af6-7539-4e44-8d75-217c370fb4df

Category: Application

Component: MobileApp

But everything shows as a MobileApp, even Office 365 apps that do work on Windows 10.

So what can you deploy to a Windows 10 Desktop via Azure, because the only thing that seems to work at all is Office 365 apps.

[#16]

I know it just to be all Windows 10 Mobile.

IF you go to devicemanagement.microsoft.com, then devices and search your devices there.
Then go to the managed apps section, do you see your apps there?

[#17]

So looking at the properties of the device is see this

Intune managed workloads
Resource Access Profiles; Device Configuration; Compliance Policy; Windows Update for Business; Endpoint Protection; Office Click-to-Run

So how do I move app workload to intune

But to answer your question yes I do see the apps listed for both device and user.

[#18]

Jake Stoker has some blog posts about it: https://triplesixseven.com/co-management-in-sccm-1806/

You need to check which workload to move

[#19]

@Thijs Lecomte Thanks for the link.

This is more of what I was looking for as well

https://docs.microsoft.com/en-us/configmgr/comanage/workloads

https://docs.microsoft.com/en-us/configmgr/core/servers/manage/pre-release-features

I am upgrading to 1906 which I believe is what I needed (which was available December 20 2019)

[#20]

Allright good luck! Let me know if there is anything else