Why installing by hand goes wrong
If you install software laptop by laptop, after a few years every machine is different. Nobody knows exactly which version is where, new employees wait for their programs and old, insecure versions stay around for years. On top of that, installing software requires admin rights. In many businesses employees have simply been given those rights, with all the risks that brings. Our article on local admin rights explains why that is dangerous.
Intune turns this around. You decide centrally which software is allowed and which must be present, and Intune installs it in the background with system rights. The employee does not need to be an admin.
Which software can you deploy?
Intune can deploy the Microsoft 365 apps such as Word, Excel, Outlook and Teams directly, with a fixed update channel. Many well-known programs are in the Microsoft Store and can be added in a few clicks; they are then updated automatically. For other Windows software, such as an accounting connector, a PDF editor or a printer driver, you package the installer as a Win32 app. You specify how the program is installed silently, how Intune checks whether it is already present and how it is removed again.
Start with a short list: which software does everyone use, which only one department, and what does nobody actually use any more? That clean-up often also turns up licences you can cancel, just like unused Microsoft 365 licences.
Required or available: two kinds of assignment
For each app you choose how it reaches a group. Required means the app is installed automatically on the devices or for the users in that group. Use this for the basics: the Microsoft 365 apps, the browser, security software and the printer driver. Combined with Windows Autopilot, those basics are already installed when a new laptop is switched on for the first time.
Available means the app is ready in the Company Portal, but is only installed when the employee asks for it. That is useful for software a few people need, such as a drawing program or a tool for the finance team. A third kind of assignment, Uninstall, removes software instead, for example a program you no longer want to allow.
The Company Portal: your own business app store
The Company Portal is the app and website where employees see the software available to them. They search for a program, click Install and Intune does the rest, without an admin password. Employees no longer need to download software from the internet, and you know everyone uses the approved version. Give apps a clear name, a short description and a logo, and feature the most used apps.
Does an employee want something that is not there? Agree that such a request goes to the IT partner. They assess the program, add it if it is fine, and from then on it is available to everyone in the Company Portal. The same principle applies to browser extensions.
Don’t forget updates and removal
Deploying is half the job. Apps from the Microsoft Store and the Microsoft 365 apps are updated automatically. For Win32 apps you add a new version and specify that it replaces the old one; Intune then updates existing installations. Include this in your patch management, because outdated software is a common way in for attackers. Check regularly in Intune whether installations succeeded; failed installations are shown per device.
When an employee leaves or changes role, you only change the group. Software linked to that group can then be removed automatically, and licences for paid programs become free.
How Floor ICT handles this
Floor ICT takes stock with you of the software currently on the laptops and turns it into a list: standard for everyone, per department and on request. We add the programs to Intune, package the software that is not in the Store, and set up groups, assignments and the Company Portal. After that we keep versions up to date, handle new software requests and check that installations succeed. That way a new colleague has everything they need on day one, without anyone needing admin rights.