Store Administration

Store Administration groups the portal’s configuration into focused nodes, one per domain, instead of a single Settings tab. Each node is named for what it configures: Permissions, Categories, Tags, Branding, Deployment, Integrations, Communications, System, and License. Settings that have a natural working surface live on that surface, so update cadence sits on the App Updates page and catalog sourcing sits on the App Catalog page, rather than on a separate settings screen.

If you are upgrading from an earlier version, the old Settings tab has been retired. Use the tables below to find where each setting now lives.

Where Each Setting Lives

Settings inside Store Administration:

Setting	Node
Admin, Approver, User Access, and Request on Behalf group assignments	Permissions
Category colors	Categories
Tag colors	Tags
Logo, favicon, brand colors, text, and the dark-mode theme toggle	Branding
Group name prefix, auto-create Entra ID groups	Deployment
BI for Intune connection	Integrations
Notifications, Terms of Service, portal URL	Communications
Self-update and release channel, custom domain, currency	System
License key and entitlement status	License

Settings that live on the surface they configure:

Setting	Where to find it
Catalog repository URL, GitHub PAT, manifest-integrity verification, icon resolution	App Catalog page, Catalog Settings panel
Max featured apps, categories on home page, hero app	App Catalog page, Catalog Settings panel
Automatic update checking, check interval, update notifications, auto-deploy through rings	App Updates page, Update Settings panel
Help desk cost per ticket (ROI)	Analytics report
Require manager approval by default	Approval Workflows builder
Setup Wizard	Getting Started (top-level entry)

The rest of this page documents the Store Administration nodes in detail. For the settings that moved onto other surfaces, follow the links above.

Permissions

Control who has admin and approver access to the portal, and who can request on behalf of others.

Setting	Description
Admin Group	(Required) Entra ID group Object ID. Members have full admin access to sync apps, manage the portal, and view all requests. If not configured, all admin endpoints return 403 Forbidden.
Approver Group	Entra ID group Object ID. Members can approve or reject requests (in addition to workflow-specific approvers).

Important (v1.10.6+): The Admin Group is required. If no Admin Group ID is configured (in either Permissions or appsettings.json), all users are denied admin access. See the Setup Guide for initial configuration instructions.

Lost admin access? If the Admin Group ID is accidentally cleared, the appsettings.json / environment variable value is used as a fallback. If neither is set, you must set AppSettings__AdminGroupId as an environment variable (or in appsettings.json) and restart the application to regain access.

Recommended Conditional Access Policy

Since App Store for Intune is used to request apps for Intune-managed devices, we recommend protecting access to the portal with a Conditional Access policy that requires:

• Managed device, the device accessing the portal must be enrolled in Microsoft Intune.
• Compliant device, the device must meet your organization’s compliance policies.

This ensures users can only request apps from trusted, compliant devices.

Prerequisites

Before creating the policy:

1. You must have Microsoft Entra ID P1 or P2 license (or Microsoft 365 E3/E5, etc.).
2. You need the Conditional Access Administrator or Global Administrator role.
3. Have at least one compliance policy configured in Microsoft Intune.

Creating the Conditional Access Policy

1. Go to Conditional Access

   • Go to Azure Portal.
   • Go to Microsoft Entra ID > Security > Conditional Access.
   • Select + New policy.

2. Name the policy

   • Enter a descriptive name: App Store for Intune - Require Compliant Device.

3. Configure Assignments - Users

   • Under Users, select 0 users and groups selected.
   • Select Include > All users.
   • (Optional) Under Exclude, add a break-glass admin account for emergency access.

4. Configure Assignments - Target Resources

   • Under Target resources, select No target resources selected.
   • Select Cloud apps.
   • Select Include > Select apps.
   • Search for and select your App Store for Intune app registration (there is a single registration):
     • App Store for Intune (or whatever you named your app registration).
   • Select Select.

5. Configure Conditions (optional)

   • Under Conditions > Device platforms.
   • Select Not configured.
   • Set Configure to Yes.
   • Select Include > Select device platforms.
   • Check: Windows, iOS, Android (the platforms you manage).
   • Select Done.

6. Configure Access Controls - Grant

   • Under Grant, select 0 controls selected.
   • Select Grant access.
   • Check Require device to be marked as compliant.
   • Check Require Microsoft Entra hybrid joined device (optional, for hybrid environments).
   • Select Require one of the selected controls (OR) or Require all the selected controls (AND) based on your requirements.
   • Select Select.

7. Configure Session Controls (optional)

   • Under Session, you can configure:
     • Sign-in frequency: Require re-authentication periodically.
     • Persistent browser session: Disable persistent sessions for extra security.

8. Enable the policy

   • Set Enable policy to Report-only first to test.
   • Select Create.

9. Test and enable

   • Monitor the Sign-in logs for a few days in Report-only mode.
   • Verify legitimate users can access the portal from compliant devices.
   • Verify access is blocked from non-compliant or unmanaged devices.
   • Once verified, edit the policy and change to On.

Policy Summary

Setting	Value
Name	App Store for Intune - Require Compliant Device
Users	All users (exclude break-glass account)
Cloud apps	App Store for Intune app registration
Conditions	Device platforms: Windows, iOS, Android
Grant	Require device to be marked as compliant
Enable policy	Report-only (then On after testing)

Troubleshooting Access Issues

If users report they cannot access the portal:

1. Check Sign-in logs

   • Go to Microsoft Entra ID > Sign-in logs.
   • Filter by the user and application.
   • Look for Failure entries and check the Conditional Access tab.
   • The tab shows which policies applied and why access was denied.

2. Common issues

   Issue	Solution
   Device not enrolled	User needs to enroll their device in Microsoft Intune
   Device not compliant	User needs to resolve compliance issues (updates, encryption, etc.)
   Using personal device	User needs to use their work-managed device
   Policy excluding wrong users	Review the Exclude settings in the CA policy

3. Verify device status

   • Go to Microsoft Intune admin center > Devices.
   • Search for the user’s device.
   • Check Compliance status and any failed compliance policies.

Alternative: Allow Browser Access with App Protection

If you need to allow browser access from unmanaged devices (less secure), you can create an alternative policy:

1. Create a second CA policy for browser access.
2. Target the same apps.
3. Under Conditions > Client apps, select Browser only.
4. Under Grant, require Approved client app or App protection policy.
5. This allows access from unmanaged devices but with some protection.

Recommendation: For maximum security, require compliant managed devices. App Store for Intune is designed for employees requesting apps on their managed devices, so this policy aligns with the intended use case.

Categories and Tags

Categories and Tags each have their own node in Store Administration. Today both hold the color settings that control how category and tag chips render across the catalog.

• Categories holds category colors. Categories are the shelves an app browses under and stay in sync with Microsoft Intune in both directions. See App Management.
• Tags holds tag colors. Tags are portal-only labels for organizing and filtering the catalog. See App Tags.

Branding

Configure the portal’s visual identity for all users.

Setting	Description
Logo	Upload the logo shown in the portal header.
Favicon	Upload the browser-tab icon.
Brand colors	Set the accent colors applied across the portal.
Brand text	Set the portal name and footer text.
Enable dark mode	Set the default dark-mode theme for all portal users.

Dark Mode Behavior

The portal resolves dark mode from three sources, in priority order:

1. User preference, users can select the sun or moon icon in the header to toggle dark mode for themselves.
2. System preference, if the user has not set a preference, the portal auto-detects the operating system’s dark mode setting.
3. Admin default, falls back to the dark-mode setting configured in Branding.

User preferences are stored in localStorage and persist across sessions. Users can always override the admin default for their own viewing preference.

Dark Mode Styling

When dark mode is active, the portal uses a vignette-style design inspired by Microsoft Learn and the Microsoft Intune admin center:

• Main content area: Darkest (#1a1a1a) with a subtle inset shadow for depth.
• Header and footer: Medium dark (#252525) with subtle borders.
• Outer edges: Lighter dark gray (#2d2d2d).

This creates a professional look where the center content draws focus while the periphery provides visual framing.

Note

Dark mode settings persist across page refreshes and sign-in or sign-out cycles. The admin default is loaded through a public API endpoint so it applies even before the user authenticates.

Deployment

Deployment holds the defaults the portal uses when it creates Entra ID groups and Intune assignments for published apps.

Setting	Description
Group Name Prefix	Prefix used when auto-creating Entra ID groups (default: AppStore-). Groups are named {prefix}{AppName}-Required. Use this to identify portal-managed groups in your tenant.
Auto-create Entra ID groups	Automatically create a security group when an app does not have a target group configured.

Integrations

Integrations holds the connection to BI for Intune. Configuring the connection here lets App Store for Intune data appear alongside your other Microsoft Intune reporting. Additional integrations will be added to this node in future releases.

Communications

Communications holds all notification, messaging, and Terms of Service settings, including company information, email notifications, Microsoft Teams bot notifications, approval reminders, and stale-request escalation. See Communications for the full reference.

System

System holds the instance-level settings that configure the deployed portal as a whole and belong to no content domain: self-update and release channel, custom domain, and currency.

Version and Updates

The System node displays version information and controls how the portal updates itself:

Setting	Description
Current Version	Displays the installed portal version, build date, and environment.
Automatically check for updates	When enabled, the portal periodically checks for new versions.
Show update notifications	When enabled, displays a notification banner when updates are available.
Check for Updates	Manual button to check for available updates.
Install Update	One-click button to download and install updates (requires configuration).
Release Channel	Select the update channel: Latest for production builds, or Preview for early-access builds.

When an update is available, you see:

• An update badge with the new version number.
• A link to release notes.
• An Install Update button (if in-app updates are configured).

Enabling In-app Updates

The portal supports one-click updates directly from the Admin Dashboard. This feature downloads the latest release and deploys it through Azure’s Kudu ZIP deploy API.

Prerequisites:

• Portal must be running in Azure App Service.
• Deployment credentials must be configured.

Configuration steps:

1. Get deployment credentials from Azure Portal:

   • Go to your App Service > Deployment Center > FTPS credentials.
   • Copy the Username (starts with $, e.g., $app-apprequest-prod-abc123).
   • Copy the Password.

2. Add app settings in Azure Portal:

   • Go to your App Service > Configuration > Application settings.
   • Add these settings:

   Name	Value
   Deployment__PublishUser	Your FTPS username (e.g., $app-apprequest-prod-abc123)
   Deployment__PublishPassword	Your FTPS password

3. Using the update feature:

   • Go to Admin > System.
   • Select Check for Updates to see if a new version is available.
   • If configured correctly, an Install Update button appears.
   • Select it to download and deploy the update automatically.
   • The application restarts during the update process.

Note: The Install Update button only appears when:

• The portal is running in Azure App Service (not locally).
• Deployment credentials are properly configured.
• An update is available.

Manual Updates

If in-app updates are not configured, you can update manually using either method below:

Back up the database before upgrading

App Store applies database migrations automatically when the new version starts. Before a major upgrade, take a backup so you can roll back if a migration causes problems: export a BACPAC to your storage account, or note the current UTC timestamp to use Azure SQL point-in-time restore. See Disaster recovery.

Method 1: Kudu ZIP Deploy (recommended for existing installations)

For existing deployments, use the Kudu ZIP deployment feature:

1. Download the latest application package: AppRequestPortal.zip.
2. In Azure Portal, go to your App Service.
3. Select Advanced Tools > Go (opens Kudu).
4. Select Tools > Zip Push Deploy.
5. Drag and drop the downloaded ZIP file into the deployment area.
6. Wait for deployment to complete (watch the logs).
7. Restart your App Service if needed.
8. Database migrations run automatically on next startup.

Note

This method preserves your existing configuration and database. The ZIP contains only application files.

Method 2: Fresh install from the Azure Marketplace (new installations only)

For a brand-new installation, deploy from the Azure Marketplace. See Install from the Azure Marketplace for the full walkthrough.

Caution

A fresh Marketplace deployment provisions new resources and should target a new, empty resource group. To update an existing deployment, use Method 1 above.

Currency

Currency sets the tenant-wide format used wherever money appears in the portal, including app cost and the ROI figures on the Analytics report. It is a formatting setting only and does not affect billing.

Custom Domain Configuration

The System node includes a Custom Domain section for configuring a custom domain (e.g., apps.yourdomain.com) for your portal.

Prerequisites

Before configuring a custom domain:

1. Your DNS must be configured with the appropriate CNAME or A record pointing to your Azure App Service.
2. Your Azure App Service must be on the Basic tier or higher (required for custom domains with SSL).

Configuring via Admin Dashboard

1. Go to Admin > System.
2. Go to the Custom Domain section.
3. Read the prerequisites and ensure DNS is configured.
4. Select Configure Custom Domain in Azure.
5. This opens the Azure Portal with a pre-configured ARM template that:
   • Adds your custom domain to the App Service.
   • Creates a free Azure-managed SSL certificate.
   • Binds the certificate to your domain.

After Configuration

Once your custom domain is configured:

1. Update Microsoft Entra ID redirect URIs, add your custom domain URLs to your App Registration.
2. Update Portal URL, in Communications > Email Notifications, update the Portal URL to use your custom domain.
3. Test authentication, sign out and sign back in to verify authentication works.

Note

For detailed DNS configuration, certificate options, and troubleshooting, see Custom Domains.

License

The portal requires a valid PowerStacks license to operate. License status is displayed in the Admin Dashboard and affects portal functionality.

Viewing License Status

1. Go to Admin > License.
2. The License node shows:
   • Current license status (Valid, Expired, Over Device Limit, etc.).
   • License type and expiration date.
   • Device count vs. licensed limit.
   • Last validation timestamp.

License Validation

The portal automatically validates your license:

• On application startup.
• Every 24 hours.
• When you manually select Validate License.

To force a validation check, select the Validate License button in the License node.

Updating the License Key

1. Go to Admin > License.
2. Enter your new license key.
3. Select Save License Key.
4. The portal validates the new key and displays the result.

Alternatively, use the Setup Wizard (reachable from the top-level Getting Started entry) to enter or update your license key.

License Warnings

Users see warning banners in the following situations:

Condition	Banner Message
License expiring soon (30 days or fewer)	“License expires in X days. Please contact your IT administrator to renew.”
Device count in grace period (up to 3% over limit)	“Device count exceeds license limit by X devices. Please contact your IT administrator to upgrade.”
License invalid or expired	Warning message explaining the issue

Note

When device count exceeds the license limit by more than 3%, new app requests are blocked until the license is upgraded or device count is reduced.

Device Count

The portal tracks managed devices from Microsoft Intune that have checked in within the last 30 days. Device count is updated:

• During each app sync from Microsoft Intune.
• When you select Update Device Count in the License node.