Intune App Requirement Rules: What They Are, How They Work, Examples

In Microsoft Intune, an App Requirement Rule defines the criteria a device must meet for an application to be installed. These rules allow you to specify conditions such as the operating system version, minimum free disk space, specific device models, or any other hardware or non-hardware specifications. If a device does not meet the requirements, Intune prevents the application from being installed.

Intune checks these requirements before attempting the installation, giving IT administrators greater control over which devices or users receive specific applications.

How to Set Up Application Requirement Rules in Intune

Here’s an overview of how to set up and use requirement rules in Intune:

1. Open the Microsoft Intune portal:

• Navigate to Apps > All apps in the Microsoft Intune admin center.

2. Select the App

• Choose the app for which you want to create a requirement rule.
• Requirement rules can be added to Windows and macOS line-of-business (LOB) apps, Win32 apps, and custom applications.

3. Navigate to App Requirements

• Within the app’s configuration settings, locate the Requirements tab. 
• This section will display various settings that can be applied based on the type of app (e.g., Win32 apps offer more specific requirements than web apps).

4. Define Requirement Rules

Depending on the operating system, you can set different rules, including:

• Operating System Architecture: Indicate if the app requires a specific CPU architecture (e.g., x86, x64).
• Minimum Operating System: Specify the minimum OS version required for the app.
• Disk Space Required: Define the minimum free disk space needed on the device to install the app.
• Physically memory required (RAM): Set the minimum amount of RAM required.

5. Additional requirement rules (Win32 apps only):

• You can create custom detection scripts to verify whether an app requirement has been met. This is useful if you need complex conditions beyond the standard settings

6. Review and Save:

• Once the requirements rules are set, save the configuration. 
• Devices that don’t meet the criteria will be excluded from installation.

7. Deploy the App:

• Deploy the app as usual. 

Devices will be assessed against the requirement rules upon deployment, and only those meeting the criteria will proceed with the installation.

Now that you know what App Requirement Rules are and how to set them up, let’s explore two practical use cases where additional rules can help refine app deployment.

Use Case 1: Prevent your app from being available on non-desktop devices

To ensure that an app is only installed on Desktop PCs, you can create a custom requirement rule using PowerShell.

1. Create a PowerShell detection script to check if the device is a Desktop PC. It should look like the one below:

Function Detect-Desktop
{
	Param( [string]$computer = “localhost” )
	$isDesktop = $false
	#The chassis is the physical container that houses the components of a computer. Check if the machine’s chasis type is 3.Desktop
	if(Get-WmiObject -Class win32_systemenclosure -ComputerName $computer | Where-Object { $_.chassistypes -eq 3})
	{
        $isDesktop = $true
    }
	$isDesktop
}
If(Detect-Desktop)
{
    Write-Output “Desktop”
}

2. Save it on your device. 

3. Go to Intune and upload the PowerShell script as an additional requirement rule. It should look like the below:

Once that is set and your Intune app is saved, the app will not be made available to laptops, tablets, or other non-desktop devices.

Use Case 2: Prevent Adobe Reader Installation If Adobe DC Pro Is Detected

This is a great example of a situation where you have unknown users with Adobe DC Pro – a paid, licensed version – installed on their machine, but you need to deploy Adobe Reader (Free) to the entire infrastructure.

Since you don’t know who these users are or what their device names are, you can create a requirement rule based on a registry key that is specific to the Pro version.

That registry key is:

HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Distiller

To prevent Adobe Reader from installing on devices with Adobe DC Pro, configure the requirement rule to check for this key.

If the key is detected, the requirement rule is not met, and Adobe Reader will not be installed.

Conclusion

Microsoft Intune provides built-in requirement rules for app installations, but more importantly, it allows you to create custom requirement rules to fit your organization’s needs.

• You can enforce hardware-specific installation rules, such as restricting an app to desktop PCs.
• You can prevent software conflicts by checking registry keys or running detection scripts.

By leveraging custom detection rules, you can ensure that apps are deployed only where they are needed, improving compliance, efficiency, and resource management.