- Remote help for Intune and Microsoft Endpoint Manager - Tue, Jan 25 2022
- Windows 10/11 Azure AD/Intune Enterprise subscription is not valid - Mon, Nov 8 2021
- Upgrade from Windows 10 to Windows 11 with Setupconfig.ini and Intune - Wed, Sep 22 2021
SCCM has received many cool new features that make it possible to do some tasks more or less in real time, run scripts, use CMPivot, and perform application approval. This is amazing! Why are they developing application approval in this direction?
Because we need to be faster in today's modern world, end users are used to a fast experience when they install apps on their phones, for example. Another reason is performance—many of us create two or three collections per app. Collection evaluation takes time and is very expensive in performance. Using this new modern way of deploying apps solves all of that with better performance and faster delivery. Who doesn't want that?
So how does instant application delivery work in SCCM 1906 then? Let's start with the prerequisites.
First, we need to enable the following role under Updates and Servicing > Features in the admin console.
This feature enables approval of any app that users request, but only for the computer the users request it for. It also hides all available device-targeted deployments in Software Center on the clients if the deployment requires admin approval.
In this way, we can use the Install application feature, and the end user doesn't see the application until approval. Then it will start installing immediately. As always, when testing out a new feature, also make sure to upgrade your SCCM clients—in this case to the 1906 version if they aren't already.
The next step is to test it out. We need to deploy an application to our devices and make it require approval. In my example, I use the Microsoft Edge Beta, and I deploy it to the All Windows Clients collection as shown below. Deploying something to All Systems doesn't feel right, and we should always avoid it, but it would work as well.
Then we select An administrator must approve a request for this application on the device as shown below.
Now we've deployed Microsoft Edge as available to all computers. After completing this, we can go back to the Devices node in the console, select a test client, and select Install Application. Note: this is only available in the Devices node in the admin console.
Then we select the application to install. Only applications deployed with the An administrator must approve a request for this application on the device option selected are visible in the list.
The application then installs on the client within seconds. Amazing! This short video below shows how it looks and how long it took when I tested it out.
When we select Install Application, we can see in the BGBMgr.log file on the site server that it sends a notification to the client, and that contains the approved application to install.
And in the CcmNotification.log file on the client, we can see that the client notification message comes down and triggers the action… all in real time—impressive!
We can also see all approved apps for a device in the admin console under Software Library > Application requests, and from there we can take the following actions:
- Retry Install
- Deny (uninstall)
- Approve (if we denied it and want to approve it again)
Selecting Deny will uninstall the application just as fast as installing it. We have a new option as well—Retry Installation, which can be very useful for troubleshooting when, for example:
Subscribe to 4sysops newsletter!
- The application fails to install, and we want to retry the installation
- The end user uninstalls the app
To sum it up, instant application delivery in SCCM 1906 has received a lot of new features. Scripting is still possible, and the scripts in my last post still work like charms. I have also tested the Superseedance application, which also works as expected. Be sure to try out this new feature. Your end users will be amazed with the speed in which it can deliver an application.
Want to write for 4sysops? We are looking for new authors.
It would be nice to clear devices from this approval list. I’m finding I used instant application delivery for a device, the device now gets reimaged and deployed to another user, the approved software automatically installs to the new user.
Other Systems Management Appliances/Solutions have been able to deliver applications instantly without tying it to a device forever. Or am I missing something in SCCM?