Manage and secure applications · Topic 2 of 5
Platform Store Apps, Quiet Time and Troubleshooting Installs
MD-102 store apps and monitoring: Apple Business Manager and managed Google Play apps, Quiet Time policies for Outlook and Teams, and troubleshooting app installs.
- 5 min
- ABM apps use a location (VPP) token, with device or user licensing. Managed Google Play needs a connection before Android Enterprise enrollment.
- Quiet Time policy types are Date range, Days of the week (all day or certain hours) and Non-working time (Teams only, needs the Working Time API).
- Quiet Time targets users on iOS/iPadOS and Android.
What it is
Mobile apps usually come from a platform store: Apple Business Manager for iOS, iPadOS and macOS and managed Google Play for Android Enterprise. Intune connects to both so it can license, deploy and update apps. Quiet Time policies mute Outlook and Teams notifications on mobile at set times. When something goes wrong, Intune's monitoring and troubleshooting tools show where an install failed.
How it works
Apple Business Manager apps
Intune syncs with Apple Business Manager (ABM) through a location token (the older name is VPP token). You buy or acquire apps in ABM, and they appear in Intune.
| Item | Detail |
|---|---|
| License type | Device licensing (the app stays with the device, no Apple ID needed) or user licensing (tied to the user's Apple ID) |
| Assignment | Required, Available for enrolled devices or Uninstall. Required installs silently on supervised devices and prompts on others |
| Updates | Apps update automatically when the store publishes a version |
| Token | Add it under Tenant administration, Connectors and tokens, Apple VPP tokens. It must be renewed before it expires |
Device licensing suits shared and corporate devices. User licensing is for user enrolled personal devices that need the Apple ID.
Managed Google Play apps
After you connect Intune to a managed Google Play account, you can approve public apps, publish private apps (your own) and add web apps (shortcuts to sites). Apps are approved in the managed Play store and show up in Intune.
- Assign as Required, Available (through the managed Google Play app) or Uninstall.
- The device's Play store shows only approved apps on Android Enterprise managed devices.
- Updates follow the Play store policies, and a device restrictions profile can set the app auto update mode.
- Connect managed Google Play before enrolling any Android Enterprise device.
Quiet Time policies
Quiet Time policies mute notifications from Outlook and Teams on iOS/iPadOS and Android. Find them under Apps, Quiet Time, Policies.
| Policy type | Mutes | Behaviour |
|---|---|---|
| Date range | Outlook email and Teams | One window with a start and end date and time |
| Days of the week | Outlook email and Teams | Either Mute notifications all day (24 hours on the chosen days) or Certain hours (a daily start and end on the chosen days) |
| Non-working time | Teams only | Uses a user's working time. Configure only if the tenant is integrated with the Working Time API, or people can miss Teams notifications |
You assign the policy to user groups, and it applies to managed apps. It can take from a few minutes to several hours to reach devices, and offline devices pick it up at the next sync. One Days of the week policy can cover weekday evenings (Certain hours) and a whole day such as Sunday (all day). Use a date range for one off events such as company holidays.
Monitoring app deployments
| Where | What it shows |
|---|---|
| Apps, Monitor, App install status | Installed, failed, pending and not applicable counts per app |
| Apps, Monitor, Assignment failures | Apps that could not be assigned |
| Apps, Monitor, Discovered apps | Apps found on managed devices, including software Intune did not deploy |
| Apps, Monitor, App protection status | Status of MAM policies |
| Device, Managed Apps (Troubleshooting + support) | Per user assignment status and raw error codes |
Troubleshooting installation failures
- Check App install status for the device and the error code.
- For Windows Win32 apps, read the logs in
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs: IntuneManagementExtension.log, AppWorkload.log and AppActionProcessor.log. Open them with CMTrace. - Use Collect diagnostics from the app installation details, then download the zip.
- Check the assignment intent, the detection and requirement rules, and any dependency.
- Compare working and failing devices: OS version, architecture, S mode (MSI installs do not work there) and whether a reboot is pending.
- If the status stays Installing, the installer may be waiting for a hidden prompt, so test the silent command.
Common causes: a missing dependency, wrong silent switch, detection rule never satisfied, a device not meeting a requirement rule, an expired Apple token or an unapproved Play app.
A worked scenario
A retailer deploys Outlook and Teams to staff phones. The admin buys the apps in ABM with device licensing and approves them in managed Google Play, and assigns both as required. To protect rest time, she creates a Quiet Time days of the week policy that mutes notifications weekdays from 19:00 to 07:00 and all day Sunday. When a Win32 tool fails on 5 laptops, she opens the App install status, collects diagnostics and finds the dependency never installed.
What to remember for the exam
- ABM apps use a location (VPP) token, with device or user licensing. Managed Google Play needs a connection before Android Enterprise enrollment.
- Quiet Time policy types are Date range, Days of the week (all day or certain hours) and Non-working time (Teams only, needs the Working Time API).
- Quiet Time targets users on iOS/iPadOS and Android.
- Win32 logs live in the IntuneManagementExtension Logs folder, and Discovered apps lists software found on devices.
- For Windows Store apps, add a Microsoft Store app (new), not the retired Store for Business flow.
A schedule that mixes daily hours and a full day off is a single Days of the week policy.
How the exam asks about this
- "Mute notifications every weekday evening and on Sunday." A Days of the week Quiet Time policy.
- "Deploy iOS apps to shared devices without Apple IDs." ABM apps with device licensing.
- "Find software on devices that Intune did not deploy." Discovered apps.
- "A Win32 app stays at Installing." Check the silent command and the IME logs.
Common mistakes
Choosing user licensing for shared iPads. Device licensing avoids Apple IDs.
Using Non-working time without the Working Time API. People miss Teams alerts.
Forgetting the token expiry. App sync stops.
Looking only at the portal. The device logs show the cause.
Check yourself
Which license type avoids needing an Apple ID?
Device licensing.
Which Quiet Time policy type mutes only Teams?
Non-working time.
Where are Win32 app install logs on the device?
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
Topic 2 of 5 in Manage and secure applications
Test yourself on Manage and secure applications
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.