Public Roadmap

This document outlines the planned features and current development status of the App Store for Intune.

Last updated: August 2026

Current status

The App Store for Intune is a full application lifecycle management platform for Microsoft Intune, running entirely in your own Azure tenant. It spans the whole lifecycle: a self-service catalog and configurable approval workflows, automated packaging and deployment of thousands of applications plus your own MSI, EXE, and ZIP uploads, and automated third-party updates with ring-based rollout and rollback.

Core features (available now)

User self-service
- Browse app catalog with search and filtering
- Request apps with justification
- Track request status
- View installation instructions
Approval workflows
- Multi-stage approval workflows
- Manager and group-based approval
- Reusable named workflows shared across apps, with a tenant default
- Email notifications for approvers
- Automatic follow-up reminders
Admin management
- Sync apps from Microsoft Intune
- Configure app visibility and approval requirements
- Manage approval workflows per app
- Portal branding and customization
- Terms of Service management
Integrations
- Microsoft Entra ID authentication
- Microsoft Intune for app deployment
- Public application catalog for new app discovery
- Email notifications via Microsoft Graph
Reporting
- ROI calculator (help desk cost savings)
- Request reports by app, user, and approval activity
- CSV export for all reports
- Trend charts showing request patterns over time
- Install status tracking with deployment metrics
Automated third-party updates
- Track apps published from the catalog for available updates
- Admin dashboard showing apps with available updates
- Single-action “Apply Update” to update app versions

Planned features

Near-term (next 1-2 sprints)

Feature	Description
Chargeback and license reports	Aggregate approved requests by app cost, department, and license into quarterly and 90-day summaries for chargeback and procurement. Per-request approval detail already ships today
Catalog access badges	Show a “You have access” or “Already requested” badge in the catalog before a user requests. Duplicate submissions are already blocked at request time

Medium-term (3-6 months)

Feature	Description
Approval delegation	Delegate approvals when out of office
Self-service catalog requests	Allow users to request apps from the public catalog
Code signing for App Control (WDAC)	Sign the entire deployment payload at packaging time, the PSAppDeployToolkit module, the generated install script, and the detection and requirement scripts, with your organization’s own Azure Trusted Signing certificate. Deployments then run cleanly under App Control for Business (WDAC) enforcement trusting only your certificate, so you never have to trust the public toolkit publisher certificate
~~Disaster recovery~~	~~DR documentation, geo-redundancy options, backup/restore procedures~~ (Completed)
Rate limiting	API rate limiting for security and performance
Intune Multi Admin Approval support	Honor a tenant’s Intune MAA policy when publishing apps to Intune, using the Microsoft Graph approval workflow
Admin publishing approval workflow	Optional in-app approval gate for admin app publishing, configurable per action (new apps vs. version updates), built on the existing App Store approval engine
Expanded tag capabilities	Build on the tags shipped in 1.38.0. Tag-based visibility maps a tag to one or more Microsoft Entra ID groups so only members see the apps carrying that tag, with further tag-driven organization and automation to follow in a later version
Uninstall groups for published apps	Create a Microsoft Entra ID uninstall group when an app is deployed to Intune or made visible, to support later automated license reclamation

Long-term (6+ months)

Feature	Description
Microsoft Teams approvals	Approve/reject directly from Teams Adaptive Cards
iOS/Android store apps	Import and package iOS and Android store apps, with VPP license management and mobile update detection. Assigning mobile apps that already exist in your Intune catalog through the request and approval flow works today
Automated license reclamation	Identify unused app installs from usage telemetry and reclaim their licenses by removing devices through the app’s uninstall group
Vulnerability-driven patching	Pull vulnerability findings and recommended versions from Microsoft Defender Vulnerability Management, match them to catalog apps, and deploy the fix as an update-only rollout with one action, then confirm remediation on the next Defender scan. Closes the detect-to-patch loop inside your own tenant
ServiceNow integration	Bidirectional ticket sync

Recently completed

August 2026

App tags
- Apply up to 10 colored, reusable labels to an app to organize and filter the catalog
- Type-ahead from a shared list, with tag colors set under Store Admin
- Filter both the catalog and the admin app list by tag
Multiple categories, in sync with Intune
- An app can belong to more than one category
- Categories reconcile with Microsoft Intune in both directions, with neither side overwriting the other
- Category pickers list the full set of categories from your Intune tenant
Delete apps from Intune
- Remove an app from Intune from within App Management, with an optional prompt to also delete its deployment group
App settings edited in one place
- Editing an app opens the App settings wizard, where the icon, categories, tags, and cost all live
Store Administration reorganized into focused nodes
- The single Settings tab is retired in favor of one node per domain (Permissions, Categories, Tags, Branding, Deployment, Integrations, Communications, System, License)
- Settings that have a working surface moved onto it: catalog sourcing and storefront display on App Catalog, update cadence on App Updates, the ROI cost input on Analytics, the manager-approval default in Approval Workflows
- The Setup Wizard is now a top-level Getting Started entry

July 2026

Reusable approval workflows
- Define an approval workflow once and share it across many apps
- Set a tenant default that new apps use automatically
- Per app, choose the default, a specific shared workflow, or a custom override
- Configure it in the app settings wizard alongside visibility, assignment, and deployment
Group Automations (Preview)
- Keep a Microsoft Entra device group in sync with the devices that have a given app installed
- Membership refreshed daily from BI for Intune
- Target an app update or ring deployment at just the devices that need it, instead of everyone

April 2026

Ring deployments
- Staged rollout of app updates through deployment rings
- Integrates with your existing Autopatch deployment rings
- Health-gated progression, with per-app rollback if a release goes wrong

February 2026

Escalation rules
- Auto-escalate approval requests that stay pending past a configurable time
- Notify an alternate approver or a Microsoft Entra ID group, re-escalating on a schedule
Scheduled update checking
- Background service that checks for third-party updates automatically on a configurable interval
- Optional auto-deploy and email notification when updates are found
Audit trail viewer
- Searchable admin view of all portal activity (user, action, entity, date)
- Filter by action and entity type, with CSV export
Store Health (Application Insights)
- Admin dashboard for latency, error rate, and active-user metrics
- Falls back to database-derived metrics until App Insights is configured
Azure Key Vault integration
- All secrets (Microsoft Entra ID, SQL, Storage) stored in Key Vault
- Managed Identity access (no plaintext secrets in App Settings)
- Soft delete enabled for accidental deletion recovery
- Automatic deployment via ARM template
Disaster recovery and geo-redundancy
- Geo-redundant storage (GRS) enabled by default
- Geo-redundant SQL backups for cross-region recovery
- Full DR documentation with recovery runbooks
- Tier 3 (High Availability) manual setup guide
Unit test infrastructure
- xUnit test framework with Moq and FluentAssertions
- Test data factories for Apps, Users, Requests
- Mock services for IIntuneService, IAzureADService, INotificationService
- In-memory database context for isolated testing
- GitHub Actions CI workflow for automated testing
Microsoft Teams notifications
- Send notifications to Teams channels via Incoming Webhooks
- Rich Adaptive Cards with requestor, app details, and action buttons
- Configurable notifications for new requests, approvals, and rejections
- Test button to verify webhook configuration
- Full documentation in Admin Guide
User details in reports
- Display department and job title from Entra ID in approval reports
- Show manager information for requestors
- Enhanced CSV export with user details
Improved Win32 detection metadata
- Fetch ProductCode and UpgradeCode from app manifests
- Improved detection rules for Win32 apps
- Better uninstall detection using registry entries
Unsupported app type filtering
- Filter out unsupported app types during Intune sync
- Cleaner app list without Windows MSI LoB, macOS apps, etc.
- Automatically removes existing unsupported apps
Intune-style toggle switches
- New pill-shaped toggle buttons with Yes/No labels
- Consistent styling across the admin interface
Performance improvements
- Memory caching for Graph API group membership checks (5-minute cache)
- Faster loading of packaging jobs page
- Always-visible cancel button for packaging jobs
Intune install status tracking
- Real-time deployment status (Pending Install, Installing, Installed, Failed)
- Background polling service checks Intune every 15 minutes
- Install status tiles on reports dashboard
- Error message display for failed installations
Dashboard analytics and charts
- Trend chart showing requests vs completions over time
- Top requested apps horizontal bar chart
- Status distribution breakdown
- Configurable time ranges (7, 14, 30, 90 days)
Automated third-party updates (Phase A+B)
- Apps published from the catalog are tracked for updates
- “Check for Updates” dashboard in Admin panel
- Single-action “Apply Update” to update app versions
Terms of Service
- Click-through TOS with version tracking
- Admin management for creating and activating TOS versions
- User acceptance tracking for compliance
Follow-up reminder emails
- Configurable reminder interval and count
- Background service for automated reminders
CSV export for reports
- Export all report views to CSV
- Failed requests tile added to dashboard
Portal access enforcement
- Restrict portal access to specific Entra ID group
Microsoft-style header UI
- User profile dropdown with sign-out
- Settings gear with dark mode toggle

January 2026

App catalog browser and Win32 packaging
PSADT v4 installer packaging
Microsoft Store-style home page with hero app
Portal branding customization
Dark mode with user preference
Basic reports and ROI calculator

Feature requests

To request a new feature:

Check if it’s already on the roadmap above
Open a GitHub issue with the “enhancement” label
Describe the use case and expected behavior

PowerStacks reviews and prioritizes feature requests based on customer impact and alignment with our product vision.

Not currently planned

Feature	Reason
Multi-tenant support	Portal is designed for single-tenant deployments
Container deployment	App Service works well with in-app updates
On-premises deployment	Cloud-first design with Azure dependencies

Documentation

Administration guide - Complete administration documentation
Setup guide - Deployment and configuration instructions
User guide - End user documentation