Configure WinGet Integration

The App Catalog is populated automatically from the PowerStacks catalog index, so browsing, searching, and publishing all work out of the box. These settings are in Store Administration > System, under Catalog Sourcing. A GitHub token is optional: you only need one for the “Show More Results” deep search, for higher rate limits when publishing a lot of apps, or to read a private custom repository. Per-app installer manifests are fetched from the WinGet repository on GitHub only when you publish an app.

GitHub personal access token (optional)

Without a token, the catalog still populates and normal browse, search, and publishing all work; each app you publish makes only a few GitHub requests, well within GitHub’s anonymous limit. A token adds two things: the “Show More Results” deep search, and higher rate limits for high-volume publishing.

	Without a token	With a token
Browse, search, publish	Works	Works
GitHub API requests	60 per hour	5,000 per hour
”Show More Results” deep search	Not available (browse, cached results, and exact package-ID lookups like Google.Chrome still work)	Full search across the WinGet repository in real time

The deep search needs a token because GitHub’s code search API requires authentication.

To create and add the token:

1. Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic).
2. Select Generate new token > Generate new token (classic).
3. Give it a descriptive name, for example “App Store for Intune WinGet”.
4. Select the public_repo scope.
5. Select Generate token and copy the value (it starts with ghp_).
6. In the portal, open Store Administration > System. Under Catalog Sourcing, paste the value into GitHub Personal Access Token (Optional) and select Save.

The token is stored in Azure Key Vault and is never shown in logs or the UI.

WinGet repository URL (advanced)

By default the catalog uses Microsoft’s official repository, https://github.com/microsoft/winget-pkgs. Organizations that maintain their own WinGet repository can point App Store at it (format: https://github.com/owner/repo or owner/repo). The repository must use the WinGet layout, with manifests under manifests/.

When you set a custom repository, App Store uses it for everything:

• App Catalog. The catalog is built from the packages in your repository, at the latest version of each, instead of from the PowerStacks catalog index. The App Catalog lists every package in your repository, in alphabetical order.
• Packaging. Manifests and installers are read from your repository when you publish.
• Update checks. Apps you have published are checked for newer versions in your repository.

A private repository needs a GitHub personal access token with read access to its contents. App Store sends the token only to GitHub, and only for a custom repository.

To use a custom repository:

1. Open Store Administration > System.
2. Under Catalog Sourcing, enter the repository in Catalog Repository URL.
3. For a private repository, enter a token in GitHub Personal Access Token (Optional).
4. Select Save.

Saving a different repository URL rebuilds the App Catalog from that repository straight away. To refresh it again later, for example after you add packages to the repository, select Sync catalog now. The time of the last refresh, the repository it read, and the number of packages it found are shown under the button. If a refresh fails, the catalog is left as it was and the error is shown.

To go back to Microsoft’s repository, clear Catalog Repository URL and select Save.

Caution

The App Catalog shows only the repository you choose. Saving a different URL removes apps the new repository does not contain from the App Catalog. Apps you have already published to Intune are not removed, but they are checked for updates against the new repository.

Note

Verify manifest integrity against Microsoft’s signed index checks that a package is one Microsoft publishes. With a custom repository that carries packages Microsoft does not publish, turn it off, or those packages are refused at packaging.