Assignment intent is one of the most consequential decisions in application deployment and one of the least deliberate. Required, Available, and Uninstall aren’t interchangeable options for achieving the same outcome – they’re fundamentally different contracts between Intune and the device, and choosing wrong produces outcomes that range from user friction to security gaps to application instability.
The decision starts with a simple question: who should control whether this application is on the device – IT or the user? Required means IT controls it. Available means the user controls it. Uninstall means IT is actively removing it. That framing resolves most assignment intent decisions before you ever open the portal.
Required assignment installs the application automatically without user interaction. The device receives the assignment, the application installs, and Intune’s detection loop confirms it’s present. If the user uninstalls the application, Intune will reinstall it the next time the detection rule is evaluated – because the assignment intent says the application should be present, and Intune enforces that intent continuously. Required is the right choice for security tools, productivity applications that every user in scope needs, and anything where the absence of the application represents a gap rather than a preference.
The misuse of Required is assigning it to applications that users legitimately need to control – optional tools, department-specific software, applications with license constraints. Required for an optional application forces the installation on every device in scope regardless of whether the user needs it. That consumes disk space, generates unnecessary installation activity during enrollment, and extends Autopilot deployment time if the application is added to ESP tracking. Required should be reserved for applications that genuinely must be present on every device in the assigned group.
Required tells Intune the application must be present. Intune will enforce that continuously. If the user removes it, Intune will put it back. Make sure that’s actually the behavior you want before you assign it.
Available assignment makes the application visible in Company Portal for user-initiated installation. Intune doesn’t push it. The user chooses to install it when they need it. Available is appropriate for optional tools, applications not needed by every user in a group, licensed software where you need user-driven deployment, and anything where IT wants to make software accessible without mandating it.
The misuse of Available is assigning security-critical software as Available rather than Required – antivirus tools, security agents, endpoint protection components that should be on every managed device. Making these Available means they’re only present if the user installs them, which means they may not be present at all. Available for security tooling is a gap, not a feature.
Available also requires Company Portal to be installed and accessible. On devices where Company Portal isn’t deployed or isn’t functioning correctly, Available assignments are invisible to users. Validate Company Portal availability before relying on Available assignments for software distribution.
Uninstall removes the application from devices in the assigned group. This is useful for retiring software, removing applications when a user leaves a role or group, or cleaning up legacy deployments. Uninstall intent requires the application to have reliable uninstall behavior – not all applications do. Test uninstall behavior explicitly before deploying it broadly, particularly for older MSI packages that may leave behind registry entries, services, or files that interfere with future reinstallation if needed.
Assignment intent interacts with group membership. When a device moves between groups, the intent that applies changes. A device that was Required for an application and moves to a group with Uninstall will have the application removed. Design group membership and assignment intent together, not separately.
Conflicts between assignment intents – when a device receives both Required and Uninstall for the same application from different groups – are resolved in favor of Required. Understanding conflict resolution behavior before you design complex assignment structures prevents unexpected outcomes when group membership changes.
Assignment filters add precision to intent without multiplying groups. Instead of creating separate groups for every targeting variation, filters allow you to scope assignments to devices meeting specific criteria – OS version, enrollment type, device model, ownership type – at assignment time. A single Required assignment with a filter targeting corporate-owned devices is cleaner than two groups and two assignments. Use filters to express targeting precision. Reserve separate assignments for genuinely different intent.
Intune Deployment Guide · Phase 7: Applications
‹ Previous: [7.3] Detection Logic: The Part Everyone Gets Wrong
Next: [7.5] Enterprise App Management: What It Is and Where It Fits ›
