Merge pull request #19436 from MicrosoftDocs/main

Auto Publish – main to live - 2026-01-21 08:30 UTC

Author: learn-build-service-prod[bot]

intune/intune-service/apps/quickstart-add-assign-app.md

@@ -1,94 +1,110 @@
 ---
 title: Add and Assign an App
-description: In this article, you'll use Microsoft Intune to add and assign an app.
-ms.date: 10/02/2025
+description: Learn how to add and assign apps to user groups in Microsoft Intune. Ensure your workforce has access to the apps they need.
+ms.date: 01/20/2026
 ms.topic: how-to
 ms.reviewer: bryanke
 ms.collection:
 - M365-identity-device-management
 - FocusArea_Apps_Add
 ---
 
-# Step 8: Add and Assign an App
+# Step 8 - Add and assign an app in Microsoft Intune
 
-In this article, you'll use Intune to add and assign an app to your company's workforce. One of an admin's priorities is to ensure that end users have access to the apps they need to do their work.
+In this article, you use Intune to add and assign an app to your company's workforce. The goal is to assign apps that users need to do their work. For example, you can assign Microsoft 365 Apps so users can read email, and create and edit documents and spreadsheets.
 
 [!INCLUDE [intune-evaluate](../includes/intune-evaluate.md)]
 
-If you don't have an Intune subscription, [sign up for a free trial account](../fundamentals/free-trial-sign-up.md).
-
 ## Prerequisites
 
-- To complete this evaluation step, you must [create a user](../fundamentals/quickstart-create-user.md), [create a group](../fundamentals/quickstart-create-group.md), and [enroll a device](../enrollment/quickstart-setup-auto-enrollment.md).
-
-## Sign in to Intune
-
-Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) as the built-in **[Application Manager](../fundamentals/role-based-access-control-reference.md#application-manager)** Intune role.
-
-If you created an Intune Trial subscription, the account that created the subscription is a Microsoft Entra [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator).
-
-> [!CAUTION]
-> [!INCLUDE [global-admin](../includes/global-admin.md)]
+:::row:::
+:::column span="1":::
+[!INCLUDE [licensing](../../includes/requirements/licensing.md)]
+:::column-end:::
+:::column span="3":::
+> - A Microsoft Intune subscription. [Sign up for a free trial account](../fundamentals/free-trial-sign-up.md).
+:::column-end:::
+:::row-end:::
+
+:::row:::
+:::column span="1":::
+[!INCLUDE [rbac](../../includes/requirements/rbac.md)]
+:::column-end:::
+:::column span="3":::
+> Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with the following role:
+> - Built-in **[Application Manager](../fundamentals/role-based-access-control-reference.md#application-manager)** Microsoft Intune role
+:::column-end:::
+:::row-end:::
+
+:::row:::
+:::column span="1":::
+[!INCLUDE [device-configuration](../../includes/requirements/device-configuration.md)]
+:::column-end:::
+:::column span="3":::
+> To complete this step, you must:
+> - [Create a user](../fundamentals/quickstart-create-user.md).
+> - [Create a group](../fundamentals/quickstart-create-group.md).
+> - [Enroll a device](../enrollment/quickstart-setup-auto-enrollment.md)
+:::column-end:::
+:::row-end:::
 
 ## Add the app to Intune
 
-An app can be included so that Intune can manage aspects of the app.
+When you add an app to Intune, you assign that app to the users and groups that need it. You can choose to assign the app to any group you choose, including the group you created in [Step 3 - Create a group](../fundamentals/quickstart-create-group.md).
 
 Use the following steps to add an app to Intune:
 
-1. Sign in to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All Apps** > **Create**.
+1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Apps** > **All Apps** > **Create**.
 2. In the **App type** drop-down box, select **Windows 10 and later** from **Microsoft 365 Apps**.
 3. Click **Select**. The **Add app** steps are displayed.
-4. Confirm the default details in the **App suite information** step and click **Next**.
-5. Confirm the default settings in the **App settings** step and click **Next**.
-6. Select the group assignments for the app. For more information, see [Add groups to organize users and devices](../fundamentals/groups-add.md).
-7. Click **Next** to display the **Review + create** page. Review the values and settings you entered for the app.
-13. When you're done, click **Create** to add the app to Intune.
-
-## Assign the app to a group
+4. Confirm the default details in the **App suite information** step and select **Next**.
+5. Confirm the default settings in the **App settings** step and select **Next**.
+6. Select the group assignments for the app. You can select the group you created in [Step 3 - Create a group](../fundamentals/quickstart-create-group.md). For more information, see [Add groups to organize users and devices](../fundamentals/groups-add.md).
+7. Select **Next** to display the **Review + create** page. Review the values and settings you entered for the app.
+8. When you're done, select **Create** to add the app to Intune.
 
-After you've added an app to Microsoft Intune, you can assign the app to additional groups of users or devices.
+## Update the app assignment (optional)
 
-> [!NOTE]
-> This evaluation step builds on previous evaluation steps in this series. See [prerequisites](quickstart-add-assign-app.md#prerequisites) in this article for details.
+After you add an app to Microsoft Intune, you can assign the app to more groups of users or devices at any time.
 
-Use the following steps to assign an app to a group:
+Use the following steps to update an app assignment:
 
-1. In [Intune](https://aka.ms/intuneportal), select **Apps** > **All Apps**.
+1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Apps** > **All Apps**.
 2. Select the app that you want to assign to a group.
-3. Click **Properties**. Next to **Assignments** click **Edit**.
-5. Click **Add Group** under the **Required** section. The **Select group** pane is displayed.
-6. Find the group that you need to added and click **Select** at the bottom of the pane.
-1. Click **Review + save** > **Save** to assign the group.
+3. Select **Properties**. Next to **Assignments**, select **Edit**.
+4. Select **Add Group** under the **Required** section. The **Select group** pane is displayed.
+5. Find the group that you want to add and choose **Select** at the bottom of the pane.
+6. Select **Review + save** > **Save** to assign the group.
 
-You now have assigned the app to an additional group.
+You now have assigned the app to another group.
 
 ## Install the app on the enrolled device
 
-End users must install and use the Company Portal app to install an app made available by Intune. You, acting as an end user, can use the following steps to verify that the app is available to the user of the enrolled device.
+End users must install and use the Company Portal app to install an app made available by Intune. You, acting as an end user, can use the following steps to verify that the app is available to the user on Intune-enrolled devices.
 
-1. Sign in to your enrolled Windows Desktop device.
+1. Sign in to your enrolled Windows device. You can use the device you enrolled in [Step 5 - Enroll a Windows device in Microsoft Intune](../enrollment/quickstart-enroll-windows-device.md).
 
     > [!IMPORTANT]
-    > The device must be [enrolled with Intune](../enrollment/quickstart-enroll-windows-device.md). Also, you must sign in to the device using an account contained in the group you assigned to the app.
+    > - The device must be enrolled in Intune.
+    > - You must sign in to the device with an account that belongs to the same group you assigned the app to.
 
 2. From the **Start** menu, open the **Microsoft Store**. Then, find the **Company Portal** app and install it.
 3. Launch the **Company Portal** app.
-4. Click the app that you added using Intune. In this article you added the **Microsoft 365 Apps** suite.
+4. Select the app that you added to Intune. In this article, you added the **Microsoft 365 Apps** suite.
 
     > [!NOTE]
-    > If you did not successfully assign any apps to the Intune user, you'll see the following message:
-    > *Your IT administrator did not make any apps available to you.*
+    > If you don't successfully assign any apps to the Intune user, you see the following message:
+    > `Your IT administrator did not make any apps available to you.`
 
-5. Click **Install**.
+5. Select **Install**.
 
-If your business needs require that you assign the Company Portal app to your workforce, you can manually assign the Windows 10 Company Portal app directly from Intune. For more information see, [Manually add the Windows 10 Company Portal app by using Microsoft Intune](company-portal-app.md).
+If your business needs require that you assign the Company Portal app to your workforce, you can manually assign the Windows Company Portal app directly from Intune. For more information, see [Manually add the Windows Company Portal app by using Microsoft Intune](company-portal-app.md).
 
 ## Next steps
 
-In this article, you added apps to Intune, assigned the apps to a group, and installed the apps on the enrolled Windows Desktop device. For more information about managing apps in Intune, see [What is Microsoft Intune app management?](app-management.md)
+In this article, you added apps to Intune, assigned the apps to a group, and installed the apps on the enrolled Windows device. For more information about managing apps in Intune, see [What is Microsoft Intune app management?](app-management.md)
 
-To continue to evaluate Microsoft Intune, go to the next step:
+To continue evaluating Microsoft Intune, go to the next step:
 
 > [!div class="nextstepaction"]
-> [Step 9: Create and assign an app protection policy](quickstart-create-assign-app-policy.md)
+> [Step 9 - Create and assign an app protection policy](quickstart-create-assign-app-policy.md)

intune/intune-service/apps/quickstart-create-assign-app-policy.md

@@ -1,44 +1,63 @@
 ---
 title: Create and Assign an App Protection Policy
-description: In this article, you use Microsoft Intune to create and assign and app protection policy.
+description: Learn how to create and assign an app protection policy in Microsoft Intune to protect your organization's data. Get step-by-step guidance.
 ms.topic: how-to
-ms.date: 02/28/2025
+ms.date: 01/20/2026
 ms.reviewer: dagerrit
 ms.collection:
 - M365-identity-device-management
 - FocusArea_Apps_Protect
 ---
 
-# Step 9: Create and Assign an App Protection Policy
+# Step 9 - Create and assign an app protection policy in Microsoft Intune
 
-In this article, you use Intune to create and assign an app protection policy to a client app on an end user's device. Intune uses app protection policies to confirm that your apps are meeting your organization's data protection requirements.
+In this article, you learn how to create and assign an app protection policy in Microsoft Intune to protect apps on user devices. App protection policies help ensure your apps meet your organization's data protection requirements, keeping corporate data secure.
 
 [!INCLUDE [intune-evaluate](../includes/intune-evaluate.md)]
 
-If you don't have an Intune subscription, [sign up for a free trial account](../fundamentals/free-trial-sign-up.md).
-
 ## Prerequisites
 
-- To complete this evaluation step, you must [create a user](../fundamentals/quickstart-create-user.md), [create a group](../fundamentals/quickstart-create-group.md), [enroll a device](../enrollment/quickstart-setup-auto-enrollment.md), and [add and assign an app](quickstart-add-assign-app.md).
-
-## Sign in to Intune
-
-Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) as the built-in **[Application Manager](../fundamentals/role-based-access-control-reference.md#application-manager)** Intune role.
-
-If you created an Intune Trial subscription, the account that created the subscription is a Microsoft Entra [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator).
-
-> [!CAUTION]
-> [!INCLUDE [global-admin](../includes/global-admin.md)]
+:::row:::
+:::column span="1":::
+[!INCLUDE [licensing](../../includes/requirements/licensing.md)]
+:::column-end:::
+:::column span="3":::
+> - A Microsoft Intune subscription. [Sign up for a free trial account](../fundamentals/free-trial-sign-up.md).
+:::column-end:::
+:::row-end:::
+
+:::row:::
+:::column span="1":::
+[!INCLUDE [rbac](../../includes/requirements/rbac.md)]
+:::column-end:::
+:::column span="3":::
+> Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) with the following role:
+> - Built-in **[Application Manager](../fundamentals/role-based-access-control-reference.md#application-manager)** Microsoft Intune role
+:::column-end:::
+:::row-end:::
+
+:::row:::
+:::column span="1":::
+[!INCLUDE [device-configuration](../../includes/requirements/device-configuration.md)]
+:::column-end:::
+:::column span="3":::
+> To complete this step, you must:
+> - [Create a user](../fundamentals/quickstart-create-user.md).
+> - [Create a group](../fundamentals/quickstart-create-group.md).
+> - [Enroll a device](../enrollment/quickstart-setup-auto-enrollment.md)
+> - [Add and assign an app](quickstart-add-assign-app.md).
+:::column-end:::
+:::row-end:::
 
 ## Create an app protection policy
 
 Use the following steps to create an app protection policy:
 
-1. In [Intune](https://aka.ms/intuneportal), select **Apps** > **Protection** > **Create** > **Windows 10**.
+1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Apps** > **Protection** > **Create** > **Windows 10**.
 2. Enter the following details:
 
-    - **Name**: *Windows 10 content protection*
-    - **Description**: *Users associated with this policy won't be able to cut, copy, or paste any content between the assigned app and other nonmanaged apps on the device.*
+    - **Name**: *Windows content protection*
+    - **Description**: *Users associated with this policy can't cut, copy, or paste any content between the assigned app and other nonmanaged apps on the device.*
     - **Enrollment state**: *With enrollment*
 
 3. Under **Protected apps**, select **Add**. The **Add apps** pane is displayed.
@@ -47,20 +66,20 @@ Use the following steps to create an app protection policy:
 6. Select **Allow Overrides** to set the Windows Information Protection mode. Selecting this option blocks enterprise data from leaving the protected app.
 7. Select **Next** to display the **Advanced settings**.
 8. Select **Next** to display the **Assignments**.
-9. Select **Select groups to include**, select the group, and select **Select**.
+9. Select **Select groups to include**, select the users group, and select **Select**.
+
+    You can only apply app protection policies to groups that contain users, not groups that contain devices.
+
 10. Select **Next** to display the **Review + create** step.
 11. Select **Create** to create your policy.
 
 You see the app protection policy in Intune.
 
-> [!NOTE]
-> App protection policies can only be applied to groups that contain users, not groups that contain devices.
-
 ## Next steps
 
-In this article, you created and assigned an app protection policy. Users of the app that have this policy assigned won't be able to cut, copy, or paste any content between the assigned app and other nonmanaged apps on the device. This type of protection helps protect your organization's data. For more information about app protection policies in Intune, see [What are app protection policies?](app-protection-policy.md)
+In this article, you created and assigned an app protection policy. Users of the app that have this policy assigned can't cut, copy, or paste any content between the assigned app and other unmanaged apps on the device. This type of protection helps protect your organization's data. For more information about app protection policies in Intune, see [What are app protection policies?](app-protection-policy.md)
 
-To continue to evaluate Microsoft Intune, go to the next step:
+To continue evaluating Microsoft Intune, go to the next step:
 
 > [!div class="nextstepaction"]
-> [Step 10: Create and assign a custom role](../fundamentals/quickstart-create-custom-role.md)
+> [Step 10 - Create and assign a custom role](../fundamentals/quickstart-create-custom-role.md)