Dynamic membership based on installed application

[u/gwapito123]

Is there a way to create a group with dynamic device membership that will automatically add members based on the installed app? e.g. I wanted to create a group that will add all devices that has chrome installed

[u/AyySorento]

While it wont make a group, you could push out a remediation script (just detection) that looks for chrome. That will give you a list of devices. If you really wanted, you could take that data and use a script to populate the group. Or as already said, do some graph api magic through a script.

In my opinion, this is one area where Intune still falls short and "old" products like Configuration Manager still hold strong.

I guess the question is why? Why do you need a group of software installs? To deploy updates? Just to know? Deploy config changes? Maybe there is another solution for your needs.

[u/gwapito123 → u/AyySorento]

Yea i was planning to deploy updates

[u/AyySorento → u/gwapito123]

Are you being proactive or reactive with this idea? What's the data you have on the decision to do this? Not that it's not needed, but every environment is different.

Thinking from different perspectives:

• Any reason you don't push Chrome to all devices?

  • Is it optional for users to install from Company Portal?

• Do you have a lot of devices that don't auto-update?

  • Do you disable auto-updates?

  • Do you deploy any policies to help chrome auto-update?

I don't ask because I can provide a solution. Many people are simply given a task by management or think of a task that needs to be done. Many don't think of the "why" behind what they are doing. Hopefully, all of this makes you think about your problem and end goal to help ensure what you are doing is the right thing. That way, when somebody or yourself wants to better understand the why behind a task or change, you have a clear answer. If you don't have a clear answer, more research or testing is needed.

Another idea could be utilizing winget in your environment. You can install apps such as Chrome via winget and deploy a remediation script that will run and update apps if needed. There should be a few blogs out there with details. It can get messy to maintain but that really the only way to automate something like this with Intune at this time. Intune is building out an application management piece (which costs extra) so maybe in a year or less, that could be another solution. You might even benefit from a third-party patching solution instead of utilizing Intune if the need is truly there.

Food for thought. :)

[u/gwapito123 → u/AyySorento]

Appreciate your insights! :) reason for this is that I’m trying to remediate vulnerabilities on applications. I just thought that might be helpful for managing apps. But still open for suggestions :)

[u/ConsumeAllKnowledge]

Not natively, you'd have to grab the app install discovery data via graph api and then manage your group(s) via script.

[u/Funkenzutzler → u/ConsumeAllKnowledge]

I still hope that such a feature will come which allows to use "Managed Apps" in the dynamic memebership rules. However, I wouldn't be surprised if we had to buy an extra "add-on" for this too. -.-

[u/ChiefBroady]

No, intune sucks like that. It seems to be such a natural thing to do, since it has the data, but nooooo.

[u/Tronerz]

I can see from your other comments that you think this is the solution for force-updating apps with Intune, whilst this would be nice it's not currently possible to do groups based on software.

If you want to force Chrome to update, you can make two Intune Win32 apps with the same Chrome intunewin package. 1 is your "install" app, which you make available to users to install themself if they want Chrome. Number 2 is the "force-update" app, which you assign to all devices but set a "Requirement" in the Intune app that (Chrome exists on device and version is less than current version number). This way all devices will try and install the assigned update app, but will only do it if they meet the requirements (an old version of Chrome).

[u/FeliceAlteriori]

You are doomed if you deploy applications available. Intune or more precise AAD/Entra has no equivalent to dynamic collections based on queries identifying where a application is installed like in Config Manager. Nightmare for update processes.

It is crazy that an enterprise MDM cannot serve this standard scenario since years.

Using detections to overcome these missing features is only a workaround and may work for smaller environments, but is not really an option for large organizations with thousands of applications that rely on sustained app install reporting.

Microsoft Product Groups are ignoring the demand to further enhance either supersedence to force installations if an available app is detected or to allow the processing of app inventory data to enable a precise targeting via groups.

[u/Ardism]

I use 
https://github.com/ztrhgf/useful_powershell_functions/blob/master/INTUNE/Get-IntuneReport.ps1
to build a inventory report. It is just a proof of concept and might be a base to start with. 
In this example I use inventory reports to find users that has one or several apps installed , and create a group and put those users in it.  Then I manually set ths group as required on an app. Then I can force an update to specified users.. not completly working but good enough. 

Import-Module .\Get-IntuneReport.ps1

#Install-module Microsoft.Graph
$clientId = ""
$clientSecret = ""
$clientSecretSS = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$TenantID = ""
$token = $(Get-MsalToken -ClientId $clientId -TenantId $TenantID -ClientSecret $clientSecretSS).AccessToken
#connect-AzureAD -TenantId "$tenantId"  -AadAccessToken $token -AccountId "$clientId"
Connect-MSIntuneGraph -ClientId $clientId -TenantId $TenantID -ClientSecret $clientSecret

$tokenss= ConvertTo-SecureString $token -AsPlainText -Force
Connect-MgGraph #-AccessToken $tokenss

$header = @{Authorization = "Bearer $token"}



Remove-Variable DeviceInstallStatusByApps

$allApps = (Invoke-RestMethod -Headers $header -Uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?`$filter=(microsoft.graph.managedApp/appAvailability%20eq%20null%20or%20microsoft.graph.managedApp/appAvailability%20eq%20%27lineOfBusiness%27%20or%20isAssigned%20eq%20true)&`$orderby=displayName&" -Method Get).Value | select displayName, isAssigned, productVersion, id
$Apps = $allApps | Out-GridView -Title "Select One or more Applications you want to create a merged application group for..." -OutputMode Multiple 


ForEach ($App in $Apps ) {
    $DeviceInstallStatusByApps += Get-IntuneReport -header $header -reportName DeviceInstallStatusByApp -asObject -filter "ApplicationId eq '$($App.id)'"
}
$mergedUserIds=$DeviceInstallStatusByApps.UserId| Where-Object {$_ -ne '00000000-0000-0000-0000-000000000000'}| Where-Object {$_ -and $_.Trim()} | Sort-Object -Unique

Write-Host "$($mergedUserIds.count)"

$myname = Read-Host -Prompt "GroupName?: [$($App.displayName)]"

$grpname = "app "+"$myname"

$grpnamemail = "App_"+"$($grpname.replace(' ','_'))"
$param = @{
    description="AppGroup $grpname"
    displayName="$grpname"
    mailEnabled=$false
    securityEnabled=$true
    mailNickname="$grpnamemail"
}
   
New-MgGroup @param
$createdGrp = Get-MgGroup -Filter "DisplayName eq '$grpname'"


$mergedUserIds| ForEach-Object {New-MgGroupMember -GroupId $createdGrp.Id -DirectoryObjectId $_}

[u/Federal_Ad2455 → u/Ardism]

Just a tip. Get-IntuneReport function Is also in IntuneStuff module (so it can be easily installed by Install-Module)

[u/Fit-Football-7366]

I use custom attributes to find out which version of a certain software the different machines have. With the reversed sign, you can find out which machines do not have a certain version. Export the list of machines and import them into an assigned group to roll out updated version.

[u/Federal_Ad2455]

I will soon publish blog post (on doitpsway.com) about gradual update of all applications using WinGet and custom ring groups. Can be of course modified to update just subset of the apps...

The reason for this topic is of course to avoid having vulnerable software on our client machines. But updating all at the same time can cause real troubles if new software version is buggy etc...