Which permission does the app registration need?

The Microsoft Graph application permission DeviceManagementApps.ReadWrite.All, with admin consent.

Can I update an app that is already in Intune?

Yes. Pick an Intune app with the same bundle ID or package name and the build goes in as its new version.

Does AppForShare assign the app to users?

No. Assignment to groups and devices stays in Intune.

From tested build to your Intune, in one step

Team

Many companies test an internal app with a link first and then roll it out to staff phones with Microsoft Intune. Between the two, someone downloads the build and uploads it again in the Intune admin center.

On Team, an Owner or Admin connects your Microsoft Entra app registration once. From then on, "Send to Intune" on the build page uploads the build you tested to your Intune as a line of business app.

Start free See plans

Example

Send to Intune, Field App 3.1.0 (204)

SigningEnterprise, profile valid until Aug 2027
TargetNew version of "Field App (iOS)"
StatusUploaded and committed

Example values.

Made for

Companies that deploy internal iOS and Android apps with Intune
IT teams that want the tested file, not a new download, to reach Intune
Agencies that deliver apps into a client's Intune

What it ends

Downloading a build and uploading it again in the Intune admin center
Not being sure the file in Intune is the one testers approved

How it works

Step 1
Register an app in Entra
In Microsoft Entra, register an app with the Microsoft Graph application permission DeviceManagementApps.ReadWrite.All and admin consent, and make a client secret.
Step 2
Connect it
On Integrations, an Owner or Admin adds the tenant ID, client ID and client secret. The secret is sealed and never shown again.
Step 3
Send the build
On the build page, Send to Intune: pick a new app or a new version of an Intune app with the same bundle ID or package name, tick the confirm box and send.
Step 4
Assign it in Intune
The app appears in Intune. Which groups and devices get it is decided in Intune, as before.

What is sent

An enterprise or ad hoc signed .ipa goes to Intune as an iOS line of business app, and a signed APK as an Android line of business app. AppForShare encrypts the file in the format Intune expects, uploads it through Microsoft Graph to the storage address Intune gives, and commits it.

Only an Owner or Admin can send, after a confirm tick. Each build has at most one open send, and every send is a line in the activity feed. From the CLI: appforshare store-upload <id|slug> --to intune --yes; the MCP tool intune_status reads the status.

Where AppForShare stops

AppForShare hands the file to your Intune and stops there. It does not manage devices or assign apps; Intune does that.

Good to know

App Store or development signed .ipa files, builds with an expired profile and .aab uploads are not sent.
One open send per build. There is no email per send; the build page and activity feed show the result.

Questions

Which permission does the app registration need?: The Microsoft Graph application permission DeviceManagementApps.ReadWrite.All, with admin consent.
Can I update an app that is already in Intune?: Yes. Pick an Intune app with the same bundle ID or package name and the build goes in as its new version.
Does AppForShare assign the app to users?: No. Assignment to groups and devices stays in Intune.
Which plan do I need?: Team.