A Guide to Microsoft Intune Management Extension Deployment
Learn how to use Microsoft Intune Management Extension for granular device control and complex application management on Windows devices in this step-by-step guide.
Summary of key Intune Management Extension concepts
The following table lists nine important aspects of the Microsoft Intune Management Extension.
| Aspect | Description |
|---|---|
| Supported operating system (OS) | Windows 10 (1607 or later) and 11 only |
| Installation method | Automatic |
| Default sync period | Every 8 hours |
| Manual Sync supported | Yes |
| Installation folder | C:\Program Files (x86)\Microsoft Intune Management Extension\ |
| Log location | C:\ProgramData\Microsoft\IntuneManagementExtension\Logs |
| Important logs | IntuneManagementExtension.log, AgentExecutor.log, AppWorkload.log, Win32AppInventory.log |
| PowerShell script retry | Three times, once every 60 minutes or when the device reboots |
| Win32 app retry | Three times, once every 5 minutes, and then after 24 hours. |
Overview of Microsoft Intune Management Extension
Microsoft Intune Management Extension enables complex device and application management capabilities on Windows devices by extending Intune’s native Windows device management functionality.
Supported operating systems
The Microsoft Intune Management Extension is currently supported only on Windows 10 (1607 or later) and Windows 11 devices as of this writing.
Prerequisites
The prerequisites for using the Microsoft Intune Management Extension are:
- .NET Framework 4.7.2 or higher.
- Windows 10 version 1607 or later.
- Windows 10 version 1709 or later when devices are enrolled using bulk auto-enrollment.
- For PowerShell scripts, PowerShell 5.1 or newer is required.
- Devices must be joined through Entra ID join or Hybrid Entra ID join, and also enrolled in Intune.
- Note: Microsoft Entra registered and workplace-joined devices are also supported.
- Devices must be able to access Intune endpoints. Check out the official Microsoft documentation for the complete list of supported devices.
Supported capabilities
IT administrators can perform the following advanced tasks using Intune Management Extension:
- PowerShell script execution: Using the Intune Management Extension, administrators can remotely run PowerShell scripts addressing various scenarios on supported and enrolled Windows devices.
- Win32 application deployment: Organizations with legacy or custom Win32 applications can use the Intune Management Extension to manage applications that Intune cannot otherwise manage.
- Custom compliance and policy enforcement: Organizations can run custom scripts to monitor compliance, thus enabling policy enforcement to maintain compliance.
How Microsoft Intune Management Extension works
The installation of the Microsoft Intune Management Extension is automatically triggered on Windows 10 and 11 devices that meet the above prerequisites. The installation process is silent. Once an Intune Management Extension is installed on a device, it signs in with Intune services for authentication and receives its assigned features.
Microsoft Intune Management Extension sync frequency
By default, Intune Management Extension syncs every 8 hours. You can also manually sync a managed device from either the Company Portal app or using the Task Manager.
How to verify a Microsoft Intune Management Extension installation
There are several ways to verify an Intune Management Extension installation:
- Check the C:\Program Files (x86)\Microsoft Intune Management Extension folder.
- Look for the Microsoft Intune Management Extension service in Windows Services.
- Check the registry entries at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension.
- Inspect scheduled tasks in Windows Task Scheduler for Sync and Client Health.
- Look at the log files in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
Microsoft Intune Management Extension logs and their location
The logs for Intune Management Extension are located at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
| Log File | Description |
|---|---|
| AgentExecutor | Information on all the PowerShell scripts that are executed. |
| AppActionProcessor | Information about Win32 app deployments related to action execution and state transition. |
| AppWorkload | Detailed information on Win32 application deployment activities. |
| ClientCertCheck | Status of client certificates; errors and expirations included. |
| ClientHealth | Health status of the device’s Intune Management Extension. |
| DeviceHealthMonitoring | Device health metrics collected and reported by Endpoint Analytics. |
| HealthScripts | Executed health scripts. |
| IntuneManagementExtension | Primary log for all Intune Management Extension activities. |
| Sensor | Health information of the endpoint analytics data collector. |
| Win32AppInventory | Discovery and inventory of Win32 applications. |
Removal scenarios for Microsoft Intune Management Extension
The Microsoft Intune Management Extension may be removed under the following conditions:
- No scripts or apps assigned to the device.
- Intune MDM no longer manages the device.
- Errors lead to an irrecoverable state for over 24 hours.
How to use Microsoft Intune Management Extension
Let’s learn how to use Microsoft Intune Management Extension to deploy a PowerShell script on a Windows device. The device used in this demonstration meets the prerequisites: it is Microsoft Entra-joined and Microsoft Intune-managed.
Steps:
- Go to the Microsoft Intune admin center at https://intune.microsoft.com/ and log in.
- Navigate to Devices, select Scripts and remediations under Manage devices, and choose Platform scripts. Click + Add and select Windows 10 and later.
- Provide the script a Name and click Next.
- Browse and select the PowerShell script location. Choose the options accordingly and click Next.
- Assign groups, users, and devices to the script and click Next.
- Review the settings and click Add to complete the process.
You should now see the script on the list. Monitor until the Assigned status changes to Yes.
Conclusion
Microsoft Intune Management Extension is a sidecar agent supporting advanced configuration use cases, custom scripts, and application deployments. It significantly expands Intune’s MDM capabilities for Windows 10/11 devices, providing the flexibility that enterprises need.