Company Portal app deployment experience explained

What is Company Portal and what does it actually do?

Company Portal is a self-service catalog, not the deployment engine. The actual decision about whether an app applies to a user or device is made by Intune in the cloud, based on your Required or Available assignment. Company Portal simply reflects that decision and gives the user a place to act on it.

It is available as a Windows app (from the Microsoft Store), a web portal, and mobile apps, but the underlying behavior is consistent: it shows the apps a signed-in, enrolled user is entitled to, lets them start installs for Available apps, and reports install and update status. Importantly, the installation itself runs with elevated privileges through Intune, so users do not need local administrator rights to install apps published to them.

• Available apps appear in the catalog for user-initiated install.
• Required apps install automatically and show as already installed or installing.
• Uninstall assignments remove an app and are not something the user chooses in the catalog.
• If an app is missing, the cause is almost always assignment, targeting, licensing, or enrollment, not the package itself.

How do Available and Required app experiences differ?

The assignment intent you choose in the admin center decides the entire user experience. The two intents that matter for what a person sees are Available and Required.

With an Available for enrolled devices assignment, the app appears in the Company Portal catalog and waits. Nothing installs until the user opens the app’s detail page and selects Install. Because this intent needs a signed-in user to act on it, it must be targeted at user groups and is not supported for device-only targeting. With a Required assignment, Intune installs the app automatically as soon as the device receives and evaluates the policy. The user does not have to open Company Portal at all, although the install activity and final state are still visible there.

What does the Available install experience look like?

When a user opens an Available app and selects Install, Company Portal hands the request to the device-side installer and reports progress back. The user moves through a predictable sequence of states without needing admin rights.

The app detail page is where users see the publisher, description, and current status. The mockup below shows the kind of information presented before a user clicks Install.

What does the Required app experience look like?

Required apps install in the background once the device evaluates the policy as applicable. The user typically does nothing. Depending on the app and device state, Windows may surface a toast notification indicating that work apps are being installed, and Company Portal will reflect the app as Installing and then Installed. Because the install is driven by Intune rather than the user, Required is the right choice for baseline software that every targeted device must have.

The context the app installs in also shapes what the user perceives. Most Win32 apps install in System context as the local SYSTEM account, which is silent and device-wide, so the user only sees the result. Apps configured for User context require the user to be signed in and run as that user. To understand the underlying delivery mechanics, see how Intune deploys Windows applications.

Which Intune component installs the app, and why does timing vary?

For Win32 apps and PowerShell scripts, the installation is performed by the Intune Management Extension (IME) — the “Microsoft Intune Management Extension” service on the device. IME is installed automatically the first time a device is targeted with a Win32 app or a PowerShell script. It is the component that downloads the encrypted Win32 app package, runs the install command, and evaluates the detection rule.

Timing confuses many admins because two different cycles are involved. IME checks for new Win32 app and script policy roughly every hour, and also after a device restart or when the service restarts. The general Windows MDM check-in runs on a separate, variable schedule (commonly around every eight hours, and more frequently right after enrollment). That is why an Available app may take a little time to appear, or a Required app a little time to start, even after the assignment is in place. A manual sync forces an immediate check-in.

Settings > Accounts > Access work or school > Info > Sync

You can also trigger a sync from within Company Portal itself. For a deeper look at check-in behavior and how to speed up testing, see how Intune device sync works.

Why is Company Portal useful for pilot validation and optional apps?

Company Portal is more than an end-user convenience; it is a deliberate rollout tool. For a new app, a common pattern is to start with a small Available or Required test group, validate the install and detection behavior, then broaden the assignment. Available assignments are especially good for pilots because they put control in the tester’s hands: the tester can install on demand, observe each state transition, and report exactly where it succeeds or fails.

• Staged rollout: publish to a pilot group as Available, confirm the experience, then expand or switch to Required.
• Optional software: apps that not everyone needs are ideal as Available, keeping devices lean and letting users self-serve.
• Self-service repair: if an app is removed or breaks, a user can reinstall it from Company Portal without a ticket.
• Visibility: the catalog gives users a clear, branded place to see what is approved for them.

Why does an app sometimes not appear in Company Portal?

When an Available app is missing from the catalog, resist the urge to rebuild the package. The cause is usually that the user or device is not yet eligible to see it. Work through the eligibility factors before touching the app configuration.

• The assignment is Available for enrolled devices, not Required (Required apps install silently and do not present an Install button).
• The signed-in user is a member of the targeted group, and group membership has propagated.
• The device is enrolled and correctly associated with the user.
• Any required license is assigned to the user.
• The device has synced since the assignment was made.

When Company Portal status looks stale or disagrees with the admin center, compare it against the device-side logs. IME records its activity here:

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs