Shopping from Intune devices

1 Connect the tenant

SoftwareCentral must be connected to your Intune tenant as an application, with the permissions it needs. See Intune Configuration and Intune Permissions. The tenant must be enabled, and each shopper must belong to it: the shop finds a user's tenant from their sign-in name.

Then make the Intune applications available in the shop and delegate them to groups, as described in Software Administration and Preparing applications.

2 How the shop finds the device

An Intune device may be anywhere, so the shop cannot look it up on the network. Choose one of two ways:

Way	How it works
Primary devices (simplest)	Turn on Shop for primary devices. The shop uses the devices where the shopper is the Intune primary user, and asks when there is more than one. Nothing to install on the devices, and it also works for Macs. See Shopping for primary devices.
The SoftwareCentral client	Set Computer name lookup to Only use SoftwareCentral Client. The client tells the shop the name of the device the shopper is using. It runs on Windows only. See The SoftwareCentral client.

Both can be on together: the shop uses the primary devices, and the client only for shoppers who have no primary device at all.

3 Shopping from outside the network

Devices that reach SoftwareCentral over a VPN need nothing more. Without a VPN:

The SoftwareCentral website must be reachable from outside your organisation.
If you use the client, it must be installed in a local folder on each device, because the usual share cannot be reached. Deploy it with Intune, for example as a Win32 app.
The SoftwareCentral URI scheme on the device must point to that local client. The script below does it.

4 Registering a local client

Set the path to the client on the first line, and deploy the script with Intune as a platform script that runs in the system context. The last lines also remove the browser question in Edge and Chrome.

$pathToClient = "C:\SoftwareCentral\SoftwareCentralClient.exe"

# Add the client to the URI scheme
$registryPath = "HKLM:\SOFTWARE\Classes\SoftwareCentral"
New-Item -Path "$registryPath\shell\open\command" -Force | Out-Null
New-ItemProperty -Path $registryPath -Name "(Default)" -Value "URL:SoftwareCentral Protocol" -PropertyType String -Force | Out-Null
New-ItemProperty -Path $registryPath -Name "URL Protocol" -Value "" -PropertyType String -Force | Out-Null
New-ItemProperty -Path "$registryPath\shell\open\command" -Name "(Default)" -Value """$pathToClient"" ""%1""" -PropertyType String -Force | Out-Null

# Remove the question in Microsoft Edge
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\URLAllowlist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\URLAllowlist" -Name "1" -Value "SoftwareCentral://*" -PropertyType String -Force | Out-Null

# Remove the question in Google Chrome 102 and later (Chrome 77-101: use URLWhitelist instead of URLAllowlist)
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\URLAllowlist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\URLAllowlist" -Name "1" -Value "SoftwareCentral://*" -PropertyType String -Force | Out-Null

If the allow lists already have an entry named 1, use the next free number. The browser question can also be removed with an Intune configuration profile instead; see Removing the browser question. All the registry keys are explained in Installing the client.

5 Signing in

Users who sign in to their device with an account from your local Active Directory are signed in to the shop automatically, as on any other device. This is not a requirement: users with a cloud-only account can sign in with Microsoft Entra ID when SoftwareCentral is set up for it. See Create App Registration for Azure OpenID Authentication.

6 Best practice

Turn on Shop for primary devices for Intune users. The shop then uses the devices where the shopper is the Intune primary user. Nothing has to be installed on those devices.
Keep the tenant enabled. The shop only uses the devices of an enabled tenant. A shopper whose tenant is disabled gets none of the Intune devices from the shop.
Keep the client for shoppers who have no primary device. With both settings on, the client is only needed when the shopper has no primary device.
Register the client on every device before you turn on Only use SoftwareCentral Client. With that setting the shop never looks the device up on the network, so a device without the client cannot be identified.

7 Troubleshooting

Symptom	Cause	What to do
The shop does not offer the Intune devices of a shopper, and the Log has the warning “The user 'name' does not appear to belong to an enabled Intune tenant.”	The shopper does not belong to an enabled Intune tenant. The warning is only written on an installation that is Intune only.	Check that the tenant is enabled and that the shopper belongs to it. Then ask the shopper to open the shop again.
The first window stays on “Please wait...” and the shop does not open.	The browser cannot start the client for the `SoftwareCentral:` link. The client must be registered on the device, and the path to it in the script must exist.	Register the client as described in Registering a local client, and check the path on the first line of the script.
The first window says “You may close this window”.	The page tries to close itself and then shows this text. It does this whether or not the shop has opened.	Close the window. If the shop did not open, follow the row above.
The shopper sees “Please select your current device:”.	The shopper has more than one primary device.	The shopper chooses the device to shop for.