How to Deploy Winget Apps to Microsoft Intune: Complete 2026 Guide

Deploying applications to Microsoft Intune remains one of the most time-consuming tasks for IT administrators. Between downloading installers, creating IntuneWin packages, writing detection rules, and configuring deployment settings, a single app can take hours to get right. The Windows Package Manager (Winget) has changed how Windows applications are discovered and installed -- but bridging the gap between Winget and Intune has traditionally required significant manual effort.

This guide covers three methods to deploy Winget apps to Microsoft Intune: using IntuneGet for fully automated deployment, manual packaging with the IntuneWin Content Prep Tool, and Microsoft's built-in Winget catalog in the Intune portal. By the end, you will know exactly which approach fits your organization and how to get your first app deployed in under 5 minutes.

What Is Winget to Intune Deployment?

Winget to Intune deployment is the process of taking applications from the Windows Package Manager (Winget) repository and packaging them for distribution through Microsoft Intune. Winget maintains a repository of over 10,000 application packages with verified installers, version metadata, and hash validation. Intune, as Microsoft's cloud-based endpoint management platform, requires applications in a specific format -- the .intunewin package -- with detection rules that verify successful installation.

The challenge lies in the translation layer between these two systems. Winget applications use standard installer formats (MSI, EXE, MSIX) while Intune needs those installers wrapped in the IntuneWin format along with install commands, uninstall commands, detection rules, and requirement rules. Automating this translation is where tools like IntuneGet deliver the most value.

Why Winget Matters for Intune Admins

Before Winget, IT admins sourcing applications for Intune had to manually visit vendor websites, download installers, verify file integrity, and hope the download link would remain stable for future updates. Winget solves several critical problems:

• Centralized app repository: Over 10,000 verified packages in a single searchable catalog, eliminating the need to hunt for installers across vendor websites.
• Hash verification: Every package includes SHA256 hashes ensuring installer integrity, reducing the risk of deploying tampered binaries through Intune.
• Version tracking: Winget tracks every published version of an application, making it straightforward to deploy specific versions or update existing Intune deployments when new releases appear.
• Standardized metadata: Package manifests include publisher information, license details, installer types, and silent install switches -- exactly the data needed for Intune Win32 app configuration.

The combination of Winget's comprehensive catalog and Intune's device management capabilities creates a powerful deployment pipeline. The question is how efficiently you connect them.

Method 1: Using IntuneGet (Recommended)

IntuneGet is a free, open-source tool that fully automates the Winget to Intune deployment pipeline. It handles application discovery, IntuneWin packaging, detection rule generation, and Intune upload in a single workflow. Here is how to deploy your first Winget app to Intune using IntuneGet:

Step 1: Sign in with your Microsoft Entra ID

Navigate to intuneget.com and sign in with your Microsoft Entra ID account. IntuneGet uses Microsoft authentication directly -- no separate account creation needed. Your account needs Intune admin permissions (DeviceManagementApps.ReadWrite.All) to create and upload app packages.

Before any deployment, IntuneGet runs a pre-upload permission check that tests your actual API access. This catches permission issues before you invest time in packaging, avoiding the frustrating mid-process failures common with manual deployment.

Step 2: Search and select applications from the Winget catalog

Use the search bar to find applications from the full Winget repository of 10,000+ packages. IntuneGet supports partial and fuzzy search -- type "chr" to find Google Chrome, or "code" to find Visual Studio Code. For applications that are difficult to find by name, IntuneGet includes AI-powered app discovery that uses OpenAI to match your search query to the correct Winget package ID.

Select one or multiple applications to deploy. You can review the package details including version, publisher, installer type, and silent install switches before proceeding.

Step 3: Deploy to Microsoft Intune

Click the deploy button and IntuneGet handles the rest. Behind the scenes, it performs the following steps automatically:

1. Downloads the application installer from the Winget source
2. Creates the .intunewin package using the Microsoft Win32 Content Prep Tool
3. Generates detection rules based on the installer type (MSI product code, file path, or registry key)
4. Configures install and uninstall commands with silent switches
5. Uploads the package to your Microsoft Intune tenant via the Graph API
6. Sets up requirement rules (OS architecture, minimum OS version)

The entire process takes approximately 5 minutes per application. Once uploaded, the app appears in your Intune portal ready for assignment to device groups or users. For a detailed walkthrough of the initial setup, see the Getting Started guide.

Method 2: Manual Winget + IntuneWin Packaging

The manual approach gives you complete control over every aspect of packaging but requires significantly more time and scripting knowledge. Here is the typical workflow for manually deploying a Winget app to Intune:

Step 1: Download the installer using Winget

First, identify the Winget package ID for your target application and download the installer. Open a PowerShell terminal and run:

# Search for the application
winget search "Google Chrome"

# Download the installer (example: Google Chrome)
winget download Google.Chrome --download-directory C:\IntunePackaging\Chrome

# Verify the downloaded file
Get-FileHash C:\IntunePackaging\Chrome\*.msi -Algorithm SHA256

Step 2: Package as IntuneWin

Download the Microsoft Win32 Content Prep Tool and use it to create the .intunewin package:

# Create the IntuneWin package
IntuneWinAppUtil.exe -c C:\IntunePackaging\Chrome -s ChromeSetup.msi -o C:\IntuneOutput -q

Step 3: Configure detection rules and upload to Intune

Log in to the Microsoft Intune admin center, navigate to Apps > All apps > Add, and select "Windows app (Win32)". Upload your .intunewin file and manually configure:

• App information (name, description, publisher)
• Install command (e.g., msiexec /i ChromeSetup.msi /qn)
• Uninstall command
• Detection rules (MSI product code, file existence, or registry key)
• Requirement rules (architecture, minimum OS version)
• Return codes for success and failure conditions

This manual process typically takes 1-2 hours per application, including testing. For organizations managing dozens or hundreds of applications, the time investment compounds rapidly.

Method 3: Intune's Built-in Winget Catalog

Microsoft has been gradually integrating the Winget catalog directly into the Intune admin portal. This approach requires the least technical knowledge but comes with notable limitations.

In the Intune admin center, navigate to Apps > All apps > Add and select "Windows package manager app (Winget)". You can search the integrated catalog and add applications directly. Intune handles the packaging and deployment automatically.

However, the built-in catalog has several constraints that make it unsuitable as a sole deployment strategy:

• Limited catalog: Only a subset of the full Winget repository is available. Many common enterprise applications are missing.
• No custom detection rules: You cannot customize detection logic, which can cause issues with applications that install to non-standard paths.
• Limited update control: Update policies are less granular than what you get with IntuneGet's auto-update, notify, ignore, or pin-version modes.
• Requires Winget on endpoints: Target devices need the Winget client installed, which adds a prerequisite to your deployment chain.

Comparison: IntuneGet vs Manual vs Built-in Catalog

The following table compares the three methods for deploying Winget apps to Microsoft Intune across key criteria that matter most to IT teams:

Troubleshooting Common Issues

Whether you use IntuneGet or the manual approach, certain issues can arise when deploying Winget apps to Intune. Here are the most common problems and their solutions:

Detection rule failures

The most common deployment issue is incorrect detection rules. If Intune cannot verify that an application installed successfully, it will report the deployment as failed even though the app is present on the device. For MSI-based installers, use the MSI product code for detection. For EXE installers, use file existence checks (verify the main executable path) or registry key detection. IntuneGet automatically selects the most reliable detection method based on the installer type.

System context vs user context installation

Intune Win32 apps install in system context by default. Some applications, particularly those designed for per-user installation, may fail or install to unexpected locations when run as SYSTEM. If you encounter installation failures, check whether the application supports machine-wide installation and adjust the install behavior in Intune accordingly.

Installer type mismatches

Winget packages can contain different installer types (MSI, EXE, MSIX, Burn bundles). Each type requires different silent install switches and detection strategies. A common mistake in manual deployment is using MSI switches (/qn) for EXE-based installers that use different silent flags (/S, /silent, --silent). IntuneGet reads the Winget manifest to determine the correct installer type and applies the appropriate command-line switches automatically.

Graph API permission errors

If you encounter 403 Forbidden errors during upload, verify your Azure AD app registration has the DeviceManagementApps.ReadWrite.All permission with admin consent granted. IntuneGet's Azure Setup guide walks through the exact configuration required. The built-in permission checker will identify missing permissions before you start any deployment.

Frequently Asked Questions

Conclusion

Deploying Winget apps to Microsoft Intune does not have to be a time-consuming, error-prone process. While the manual approach gives you full control and the built-in catalog offers convenience for basic needs, IntuneGet provides the best balance of automation, app coverage, and flexibility for IT teams that manage application deployments at scale.

With automatic IntuneWin packaging, intelligent detection rule generation, and configurable update policies, IntuneGet turns what was traditionally an hours-long process into a 5-minute workflow. And because it is free and open source, there is no financial barrier to getting started. For a deeper look at how Winget connects to Intune at the architecture level, read our Intune Winget integration guide. If you want to see the time savings quantified, our Winget vs manual deployment comparison breaks down the numbers. And if you are migrating from SCCM, see our SCCM to Intune migration guide.