Package Once, Deploy to Every Tenant: Escaping the Win32 App Repackaging Loop
TL;DR
- Traditional app packaging fails in three ways: it is time consuming, it is complex, and every update or new tenant forces you to repeat the same manual work.
- Package managers like Chocolatey and the Windows-native Winget replace manual installer downloads with libraries of prepackaged applications driven by install commands.
- As of February 2023, Intune's Microsoft Store integration with Winget handles app updates for catalog apps, but anything outside the Store, like Google Chrome, still needs a Win32 IntuneWin package.
- Deploying apps through Intune instead of an RMM means Windows Autopilot installs them during the unboxing experience rather than after the RMM agent lands.
- For MSPs, the real gap is multi-tenant: without tooling like Simeon Cloud, the same app gets repackaged and redeployed in every customer tenant you manage.
Count what it takes to keep one app current the manual way: download the installer, package it for deployment, load it into an RMM or SCCM, push it, then repeat the entire sequence at the next update. Multiply by every app in the catalog, and for MSPs, by every tenant under management. That arithmetic is the case for automating app packaging on Windows devices, and as of February 2023 the options are better than most admins realize.
Why does traditional packaging keep failing?
Three reasons, and they compound:
It eats time. Manually downloading installation files, packaging them for deployment, adding them to a bulk deployment tool like an RMM or SCCM, then manually repackaging at every update is a permanent background job.
It is genuinely complex. Packaging an app means specifying install and uninstall commands, deciding whether the package installs in user or system context, and writing detection rules that confirm the install actually succeeded.
It is redundant. Whether you manage updates in a single environment or deployments across many, the same manual steps repeat for every deploy and redeploy in every environment.
These pitfalls hit MSPs and enterprise teams alike. MSPs typically push applications through their RMM today; enterprise shops usually lean on something like SCCM.
What do package managers fix?
A Windows package manager replaces the download-and-package step with a library of prepackaged applications.
Chocolatey (opens in new tab) is the popular open source option: a library of prepackaged apps driven by install commands, ideal for deploying and updating common software like Google Chrome across an organization.
Winget is Microsoft's answer, built natively into later versions of the Windows OS. The concept matches Chocolatey: a library of prepackaged apps you can install and update by command, including apps that never appear in the Microsoft Store.
For a look at Winget working alongside Intune, this Winget plus Intune walkthrough (opens in new tab) is a good start.
Where does Intune get you, and where does it stop?
Intune can push applications to Windows devices, and Microsoft recently improved Microsoft Store app deployment with a native Winget integration: you select an app from the catalog, deploy it, and Microsoft manages the app updates. That is the friendly path.
The problem is that not every app lives in the Microsoft Store. Take Google Chrome. For manual deployments, Intune supports MSI and Win32 applications. MSI apps are straightforward; Win32 apps get complicated and time consuming, because you need a command line tool to convert them into an IntuneWin file, a container holding all the installation files so Intune can push the app to devices.
You can get creative with a combination of package managers and IntuneWin files to cover an organization, but that approach is more complex to implement, and it still does not solve deployment across many Microsoft tenants. For MSPs, that means redeploying the same apps over and over in every customer tenant.
It is still worth fighting for Intune as the deployment vehicle over an RMM. The reason is Windows Autopilot: apps deploy as part of the unboxing experience, instead of waiting until after the RMM agent installs. Two video walkthroughs cover the mechanics: deploying apps in Intune (opens in new tab) and Intune app deployment end to end (opens in new tab).
What closes the multi-tenant gap?
This is where a third-party tool like Simeon Cloud (opens in new tab) earns its place. Simeon has a native application builder: you add your Microsoft tenants, create a new application, and the tool steps you through downloading an empty IntuneWin file and uploading it to Microsoft Intune in the Endpoint Manager admin center. From there, upload the installation file and Simeon packages the app so it can be deployed to many Microsoft tenants at once.
Watch the full demo of that workflow: automating app packaging with Simeon Cloud (opens in new tab). We also looked at Simeon's broader desired state configuration capability in our review of managing Microsoft security configurations.
Open source projects worth bookmarking
Several community projects combine IntuneWin files and Winget to automate app deployment:
- Romanitho/Winget-Install (opens in new tab): PowerShell scripts for Winget with SCCM and Intune
- Romanitho/Winget-AutoUpdate (opens in new tab): daily app updates as system, with connected-user notifications and allowlist/blocklist support
- o-l-a-v/winget-intune-win32 (opens in new tab): examples of using Winget from Intune, including system context
- How to: winget and Intune from scloud.work (opens in new tab)
- Prepare a Win32 app to be uploaded to Microsoft Intune (opens in new tab)
Frequently asked questions
What is an IntuneWin file?
A packaging format produced by Microsoft's command line content prep tool. It wraps all of an app's installation files so Intune can push the app to Windows devices as a Win32 deployment.
Why prefer Intune over an RMM tool for app deployment?
Intune deployment works with Windows Autopilot, so apps install as part of the out-of-box unboxing experience. With an RMM, apps install only after the RMM agent itself has been deployed to the device.
What is the difference between Chocolatey and Winget?
Both are Windows package managers with libraries of prepackaged apps. Chocolatey is a long-running open source project; Winget is Microsoft's equivalent, built natively into later versions of Windows and now integrated with Intune's Microsoft Store app deployment.
Apps deployed, settings verified
Automating app deployment is one half of tenant standardization. CloudCapsule handles the other: 250+ security controls checked per tenant in about 60 seconds, so configuration matches the standard everywhere apps do.
Book a demo
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
