Guide

Intune Done Right: Automating App Packaging and Updates with PowerShell and WinGet

Keeping applications up to date is one of the most tedious, time-consuming tasks for any modern endpoint admin. Between version sprawl, vendor updates, and testing cycles, it’s no wonder many organisations either fall behind or burn far too much time keeping things current.

Luckily, with PowerShell, WinGet, and a few clever tools, you can automate the process — without breaking the bank or your sanity.

---

The Problem with Traditional App Management

Historically, there have been two common approaches to app lifecycle management:

• Manual packaging: Admins download and repackage every update as a .intunewin file, update detection logic, and redeploy through Intune — an arduous process that often introduces inconsistency.
• Neglect: Apps go untouched, often falling several versions behind, introducing security risks and compatibility issues.

And even if you do get the apps in, there’s still a big gap:

• No business ownership of applications — meaning there’s often nobody responsible for testing or approving updates
• No schedule — since updates arrive whenever the vendor feels like it
• Change process misalignment — most organisations don’t have a change control process built for weekly app updates

Neither approach scales well, especially with remote workforces and short-staffed IT teams.

 

---

Enter WinGet and PowerShell

WinGet, Microsoft’s native Windows package manager, has become powerful enough to support real-world enterprise deployment. When used with PowerShell and Intune, it can:

• Identify the latest available app versions
• Download and install silently with version-specific control
• Package and deploy via Intune
• Maintain consistency across a fleet with minimal manual intervention

 

---

Full Walkthrough: Automating with PowerShell + WinGet + Intune

⚠️ Important Note for Enterprises

While this Winget-based approach is excellent for SMEs and dev-focused environments, I don’t recommend it as a wholesale solution for large enterprises or regulated organisations. It lacks native version control, rollback capability, and structured testing flows.

Use this as a supplement — not a replacement — for enterprise-grade patch management and change control.

 

 

1. Identify Your Application Set

Start by defining which applications you want to manage. You can do this by:

winget export -o baseline-apps.json

This provides a JSON file listing all apps installed via WinGet on a reference machine. Trim this down to only include approved apps.

 

2. Script the Installation with Silent Flags

WinGet supports silent install switches out of the box. Here's an example script to silently install 5 common LOB (line-of-business) apps:

$apps = @(
    "Microsoft.Teams",
    "Microsoft.PowerToys",
    "Notepad++.Notepad++",
    "7zip.7zip",
    "VideoLAN.VLC"
)

foreach ($app in $apps) {
    winget install --id $app --silent --accept-package-agreements --accept-source-agreements
}

Wrap this in a PowerShell script. You can either:

• Package each app individually — allows granular control, targeted assignments, and version-specific detection logic
• Use a single core app script — great for Autopilot or shared machines needing a standardised baseline

💡 The benefit of a core app script is that you control the install order, unlike Intune's Required apps, which install in an unpredictable sequence. This ensures critical apps install first, reducing delays for the user.

Choose based on your organisation’s needs. Enterprises may prefer one-per-app for change control, while SMEs benefit from the simplicity of a single script.

 

3. Package as a Win32 App

Use the Win32 Content Prep Tool from Microsoft:

IntuneWinAppUtil.exe -c "source-folder" -s install.ps1 -o "output-folder"

Deploy the resulting .intunewin package via the Intune admin portal.

 

4. Configure Detection Rules

Use detection logic such as:

• Registry key path & version
• File version
• Existence of an installed .exe

Example for PowerToys:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PowerToys" | Select-Object DisplayVersion

⚠️ Note for core install scripts: If you're installing multiple apps from a single script, you’ll likely need to write custom detection logic for one or more of the apps to ensure Intune knows the install was successful. This might include checking registry values, file versions, or installed MSI product codes for each app — and you'll need to pick a representative one for the app’s detection rule.

 

---

Keeping Apps Updated Automatically

 

Even if you’ve nailed your first-time install process, keeping apps updated is just as important — especially with the frequency of updates in 2025.

To solve this, I came across an excellent open-source script: Winget-AutoUpdate by Romanitho. It’s simple, effective, and gets the job done — use at your own risk, but if you're supporting SMEs or dev teams, it's honestly a lifesaver.

This script:

• Scans for updates to installed Winget apps
• Downloads and installs new versions silently
• Logs to Event Viewer and text logs
• Gives the user a great little notification to tell them what's going on

Install it using:

winget install Romanitho.Winget-AutoUpdate

💡 Particularly useful for SMEs or kiosk devices that don't require tight update controls. It saves time, avoids packaging repetition, and ensures devices stay current — even after Autopilot provisioning. For enterprises that require version control or pre-release testing, Winget-AutoUpdate may not be suitable as a standalone solution.

 

 

 

---

When This Approach Works Best

Ideal for:

• SMEs and startups: Where "latest version" is typically fine and risk is low
• Developer devices: Where agility and staying current outweigh strict change control
• Kiosk/field devices: Where rapid, unattended updates are essential

But less suitable for:

• Regulated environments
• Apps with tight version dependencies
• Situations requiring rollback/version testing

In those cases, consider tools like:

• Patch My PC: For deep version control and compliance
• Chocolatey for Business: Internal repos and testing workflows
• Custom WinGet manifests with version locks

 

---

Bonus Tips

• Baseline Golden Images with winget export
• Use Proactive Remediations to check for outdated apps
• Combine with Delivery Optimisation to reduce bandwidth by enabling peer-to-peer sharing of app content across devices on the same network. This lightens the load on WAN links and accelerates deployments, especially in branch offices. To configure this in Intune:
  1. Go to Devices > Configuration profiles > Create profile
  2. Choose Windows 10 and later > Templates > Delivery Optimization
  3. Set Download Mode to LAN (1) or LAN and Group (2)
  4. Configure peer caching, cache size, and cache age settings
• Always include robust detection logic to prevent loops or unnecessary reinstalls. A common mistake is triggering reinstallation when the detection method fails due to minor version differences or missing registry entries.Example for MSI-installed apps. Ensure detection is specific, version-aware, and avoids overmatching.

 

---

Final Thoughts

App management in 2025 doesn’t need to be painful.

For SMEs and agile orgs, tools like Winget and Winget-AutoUpdate can replace traditional packaging entirely. For enterprises, they offer a complementary approach that handles the 80% of apps that don’t require slow UAT and change boards.

In short:

• Automate where you can
• Control where you must
• And stop babysitting update downloads manually

The future of app deployment is scripted, scheduled, and silent.

 

---

 

Stay tuned for our next post: "Stop Building On-Prem Group Policy Castles in the Cloud."

---

by Jay Ralph