Communications

The Communications tab (formerly “Terms of Service”) consolidates all notification, messaging, and company branding settings in one place.

Best practice: email notifications

• Use a dedicated shared mailbox for notifications.
• Grant the app Mail.Send permission on that mailbox.
• Use a recognizable From address, such as apprequest@company.com.
• Include your portal URL so users can open it to view status.

Company Information

Configure your organization’s branding details. These fields are used in notification messages and will support further message customization in future releases.

Setting	Description
Company Name	Your organization’s name, displayed in notifications
Company Logo	Upload a logo image (PNG/JPEG). Displayed in branded communications
Support Email	Contact email for support inquiries
Support Phone	Contact phone number for support

Email Notifications

Configure how App Store for Intune sends email notifications.

Setting	Description
Enable email notifications	Turns email notifications on or off
Send As User	The mailbox notifications are sent from. Enter part of its name and select it in the results. A shared mailbox works well
From Address	The Send As mailbox’s own address. It fills in when you select the mailbox. Email always comes from the Send As mailbox
Portal URL	Your App Store for Intune address, used for links in emails
Show approval emails as an Outlook card	Outlook shows the approval email as a card with a Review and Decide button that opens the portal. Other email clients show the same details as ordinary HTML. This affects presentation only
Originator / Provider ID	The Provider ID from your Microsoft Actionable Email registration. Without it, Outlook shows the plain HTML email instead of the card

When email notifications are on, Email Events turns individual emails on and off:

Setting	Email
Notify requestor when request is submitted	App Request Submitted, to the requestor
Notify approvers when approval is required	Approval Required, to the approvers of the request’s current stage
Notify requestor when request is approved	App Request Approved, to the requestor
Notify requestor when request is rejected	App Request Rejected, to the requestor, with the reason
Notify requestor when app is installed	App Installed, to the requestor
Notify admin when app is published to Intune	App Published, to the administrator who published the app

Times in emails are in UTC.

Note

The App Service’s managed identity must have the Mail.Send Microsoft Graph application permission. It is granted during setup by the Grant Microsoft Graph permissions step.

Create a Mailbox for Email Notifications

For production deployments, we recommend creating a dedicated shared mailbox or service account with minimal permissions rather than using a personal user mailbox. This ensures email delivery is not tied to any individual’s account.

Option A: Shared mailbox (recommended, no license required)

1. In the Microsoft 365 Admin Center, go to Teams and Groups > Shared mailboxes
2. Select Add a shared mailbox:
   • Name: App Store for Intune (or your preferred name)
   • Email: apprequests@yourdomain.com
3. Select Create
4. In App Store for Intune, on Communications, select the shared mailbox in Send As User. From Address fills in with apprequests@yourdomain.com. A new shared mailbox can take a few minutes to appear in the search.

Shared mailboxes do not require a Microsoft 365 license and cannot be used for interactive sign-in, making them ideal for automated email sending.

Option B: Dedicated service account (license required)

1. In Azure Portal > Microsoft Entra ID > Users > New user:
   • Display name: App Store for Intune Service
   • User principal name: svc-apprequest@yourdomain.com
2. Assign a Microsoft 365 license with Exchange Online
3. Disable interactive sign-in: Microsoft Entra ID > Users > [service account] > Properties > Account enabled = No (or use Conditional Access to block interactive sign-in)
4. Select the account in Send As User, as with Option A

Permissions required:

The portal sends emails using the Microsoft Graph Mail.Send application permission held by the App Service’s managed identity. This permission allows the app to send mail as any user in the organization. To limit which mailbox the portal actually uses:

• Select the specific shared mailbox or service account in Send As User
• Optionally, use an Exchange Online Application Access Policy to restrict the Mail.Send permission to only the designated mailbox:

Caution

Microsoft now describes Application Access Policies as legacy and asks that new configurations use Role Based Access Control for Applications in Exchange Online instead. RBAC for Applications grants add to the Mail.Send permission granted in Microsoft Entra ID rather than limiting it, so scoping it that way means changing how the permission is granted. Check Microsoft’s guidance before you choose an approach.

# Connect to Exchange Online
Connect-ExchangeOnline

# Create a mail-enabled security group for allowed senders
New-DistributionGroup -Name "App Store Email Senders" -Type Security

# Add the shared mailbox to the group
Add-DistributionGroupMember -Identity "App Store Email Senders" -Member "apprequests@yourdomain.com"

# Restrict sending to only the mailboxes in this group. Use the App Service
# managed identity's Application (client) ID (Microsoft Entra ID > Enterprise
# applications > Managed Identities > the App Service > Application ID).
New-ApplicationAccessPolicy `
    -AppId "<app-service-managed-identity-client-id>" `
    -PolicyScopeGroupId "App Store Email Senders" `
    -AccessRight RestrictAccess `
    -Description "Restrict App Store for Intune to send emails only from the designated mailbox"

# Test the policy (may take up to 30 minutes to propagate)
Test-ApplicationAccessPolicy -AppId "<app-service-managed-identity-client-id>" -Identity "apprequests@yourdomain.com"

Approval Email Links

Approval notification emails contain a Review request link that opens the request on the portal’s Approvals page, where the approver is signed in. Approving and rejecting happen there.

Earlier releases described Approve and Reject buttons rendered inside the email body (Outlook Actionable Messages). As of 1.39.0 the email no longer carries those buttons: an action taken from inside an email could not be tied to a signed-in identity with the assurance the portal applies everywhere else, so the decision is made in the portal instead. The Microsoft provider registration and the Originator / Provider ID are no longer required for approval emails to work.

Setting	Description
Show approval emails as an Outlook card	Optional. With a valid Originator / Provider ID, Outlook shows the approval email as a card whose Review and Decide button opens the portal. Approving and rejecting still happen in the portal.
Originator / Provider ID	Optional. Needed only for the Outlook card; the Review request link works without it.

Microsoft Teams Bot Notifications

Send personal Teams notifications to approvers and requestors via a Teams Bot. Each user receives individual Adaptive Card messages in their Teams chat. This uses Microsoft Bot Framework proactive messaging.

Setting	Description
Enable Teams bot notifications	Toggle to turn Teams bot notifications on or off
Bot App ID	The client ID of the bot’s user-assigned managed identity (provisioned automatically when the Teams bot is enabled at deploy time)
Test	Saves your settings and sends a test card to you in Teams. If the card can’t be delivered, the message says why
Approval Required	Notify approvers when their approval is needed
Request Approved	Notify requestor when their request is approved
Request Rejected	Notify requestor when their request is rejected
App Installed	Notify requestor when their app is installed on their device
App Published	Notify admin when a WinGet app is published to Intune

Prerequisites

1. An Azure Bot resource (provisioned automatically by the deploy template when the Teams bot is enabled). As of v1.30.0 it authenticates with a dedicated user-assigned managed identity, not a client secret. See Configure Microsoft Teams bot.
2. The Microsoft Teams channel enabled on the Azure Bot resource
3. The App Store for Intune Teams app uploaded to your Teams admin center and installed for everyone who should get notifications. In tenants on unified app management, install it from the app’s page in Teams apps > Manage apps; otherwise, use an app setup policy. See Configure Microsoft Teams Bot

No separate Bot__ environment variables are needed. As of v1.30.0 the bot authenticates with its user-assigned managed identity; there is no client secret.

Configure the Portal

1. Select Admin. In the left menu, under Store Administration, select Communications
2. Go to Microsoft Teams Bot Notifications
3. Enable Enable Teams bot notifications
4. Enter the Bot App ID (the client ID of the bot’s user-assigned managed identity)
5. Select Test to send a test notification to yourself
6. Select which events should trigger notifications
7. Select Save Settings

How It Works

• You install the App Store for Intune Teams app for the people who should get notifications
• When the bot is installed for a user, Teams sends a conversationUpdate event, the portal stores a conversation reference for that user
• To send a notification, the portal retrieves the stored conversation reference and uses Bot Framework proactive messaging
• For pooled approvals (group-based), the portal expands the group membership and sends individual messages to each group member
• For sequential approvals, only the current stage approvers are notified
• Notifications are sent as Adaptive Cards with request details and action buttons

Troubleshooting

• “The bot could not start a chat with this user”: The Teams app isn’t installed for that person yet, or the install hasn’t reached them. Microsoft notes installs can take up to 24 hours. People can also add the app themselves in Teams
• “The Bot App ID on this page (…) is not the bot this App Store sends as (…)”: Enter the ID the message names, your teamsBotAppId deployment output, and use the same ID in the Teams app package
• 401 errors: Verify the Azure Bot resource’s Microsoft App ID matches the bot’s user-assigned managed identity client ID
• Some users don’t receive notifications: The Teams app isn’t installed for them yet, or they’re outside the users and groups it’s installed for

Note

No additional Microsoft Graph API permissions are required for Teams bot notifications. Bot Framework handles its own authentication.

Group Automation Notifications

Notify the App Store administrators, and the administrator who created an automation, about query-based device group automations. Notifications go out over email and, when Teams bot notifications are on, Teams. The App Store administrators are the members of the Admin Group and the administrator who deployed App Store for Intune.

Setting	Description
Notify when a group’s membership changes (devices added or removed)	Sent after a run that changes the group’s membership, for automations whose own Notify setting is on
Notify when a run fails or is skipped	Sent when a run fails, is skipped or is incomplete
Notify when an automation is created, changed, or deleted	Sent when an administrator creates, changes or deletes an automation

When a notification can’t be delivered, the automation’s last-run line says so.

Approval Reminders

Automatically send reminder emails for pending approvals.

Reminders go to whoever can decide the request’s current stage: the named approver, the manager, or the members of the stage’s group. A request whose stage names nobody reachable is not counted as reminded, and a stage that names nobody authorizes nobody; there is no tenant-wide approver group that quietly takes over.

Setting	Description
Enable approval reminders	Toggle to enable/disable automatic reminders
Reminder Interval (Days)	Days to wait before sending each reminder (default: 2)
Maximum Reminders	Maximum number of reminder emails per request (default: 3)

Stale Request Escalation

Automatically escalate requests that have been pending too long.

Setting	Description
Enable escalation	Toggle to enable/disable automatic escalation
Escalation threshold (hours)	Hours before a request is escalated (default: 48)
Recipient email(s)	Comma-separated email addresses for escalation notifications
Recipient group	Microsoft Entra ID group whose members receive escalation notifications

Terms of Service

The Terms of Service section remains within the Communications tab, allowing admins to create and manage TOS versions that users must accept.