How to use the Winget tool to deploy apps in Microsoft Intune

What is WinGet?

The WinGet Windows Package Manager tool is free and open source, designed by Microsoft for Windows 10 and Windows 11 devices. This was announced in May 2020 at the Microsoft Build developer conference.

WinGet is not the first Windows package manager available, Chocolatey being probably the most popular, among others like Scoop, Ninite and Npackd. However, WinGet is the first and only tool that Microsoft has directly incorporated into the OS. So, it doesn't require any additional installations or downloads.

In terms of compatibility, WinGet supports EXE, MSIX, APPX and MSI packages, meaning that APP-V, ThinApp or other types of installers cannot be used. As mentioned, WinGet has multiple repositories from which we can search and install applications. It uses Smart Screen, static analysis, and SHA256 hash validation to prevent any malicious packages.

How to use WinGet

WinGet is very easy to use. Since it is installed with the system, all you have to do is open the CMD as an administrator and type winget:

This will show you all the available commands that you can use:

Install - Installs the given package
  show -  	Shows information about a package
  source -	Manage sources of packages
  search -	Find and show basic info of packages
  list   -	Display installed packages
  Upgrade - Shows and performs available upgrades
  uninstall - Uninstalls the given package
  hash   - Helper to hash installer files
  validate -  Validates a manifest file
  settings -  Open settings or set administrator settings
  features -  Shows the status of experimental features
  export -	Exports a list of the installed packages
  import -	Installs all the packages in a file

All you have to do is specify which app you want to install, and WinGet does all the work for you. It finds the latest version of the application and installs it on your machine.

Let's go through it as an example: Imagine I want to install Microsoft PowerToys, so I have to search for it using WinGet to see if it’s available:

winget search PowerToys

As you see, WinGet found PowerToys in two sources:

• Msstore - Microsoft Store
• Winget - WinGet repository

This is important because if you want to install the PowerToys application from the WinGet repository, you will need the ID. If we look closely, we have:

For our scenario, we will install the WinGet version with the Microsoft.PowerToys ID.

winget install Microsoft.PowerToys

Pretty easy, right? It's also very easy to uninstall applications using WinGet, all you have to do is run this command:

winget uninstall powertoys

Intune WinGet Deployment

If you want to use WinGet with Intune, you have multiple options:

• Windows App (Win32) Deployment
  
• PowerShell Script Deployment
• Proactive Remediation Script
  

The first option was already covered in a previous article, basically you just need to create a PowerShell script that installs your application via Winget, convert it to a .intunewin package, and upload it to Intune.

Another option would be to use the PowerShell script deployment to achieve this. In Intune, navigate to Devices > Scripts > Add > Windows 10 and later.

Next, input a name and a description:

The script settings are a bit tricky when deploying these types of apps. For Win32 Apps, the recommended method is to install it with admin privileges. However, for MSIX/APPX packages, you will need to install using the user context (no matter if you're an admin or not) so be sure to check the respective setting.

If you want to install the application using admin rights via system context, leave “Run this script using the logged-on credentials” as No. If you want to install in the user context, set “Run this script using the logged on credentials” as Yes.

If you select that the script should run using the logged on credentials, you will have to wait for the user to log on before the script is executed.

Next, assign the script to the desired users/groups and then click Add.

For Intune, you have multiple options to deploy the WinGet script, and you can also consider GPO targeting. This is the nice part when you don’t need sources and the installer utility is integrated into the OS.

Windows Package Manager Integration via Intune

With Windows 11 22H2, Microsoft released a glimpse of WPM integration with Intune, which makes it even easier to deploy applications via Intune. The new Microsoft Store repository integration will replace the current Microsoft Store for Business integration with Intune, and this lets you install Win32 apps.

The steps to install apps are:

1. Navigate to Apps > Add and select the Microsoft Store app (new):

2. There, click Search the Microsoft Store app (new) and input the application name. If we search for PowerToys, we can see that the Win32 type appears in the search.

The feature is currently in preview, but once it’s launched, all you have to do is select the proper assignments you desire and click Review + Create.

This makes it much easier to integrate apps with Intune than by using scripts with WinGet. Keep in mind that there will still be scenarios where the above WinGet method gets used, for instance, when discussing custom repositories that you can create in your environment.

Conclusion

Now you have an overview of what WinGet is and how it can be useful when deploying Store Apps in Intune. We hope you found this article useful.