How to Identifying Licensed vs Free Applications Before Intune Deployment

Intune and Microsoft Graph cannot automatically classify arbitrary applications as “free” or “licensed”; a reliable workflow must map each managed application to an entitlement source and deny deployment when that entitlement cannot be verified.

Supported boundary

The Intune mobileApp and win32LobApp schemas expose deployment metadata such as name, publisher, notes, publishing state, MSI details, and assignments, but no general price, license requirement, or user-entitlement property.^1^^2^

Therefore:

• 7-Zip/Notepad++: Graph cannot infer “free” from the name, publisher, installer, or product code.
• Visio and other Microsoft cloud products: Graph can report Microsoft licenses assigned to a user, but the workflow must know which SKU or service plan satisfies the application.
• Adobe Acrobat Pro and other third-party products: Microsoft Graph does not know the vendor’s license entitlement. Query the vendor’s licensing API if one exists and suitable credentials are available. Otherwise require manual approval or deny by default.
• Apple VPP apps are a special case: Intune integrates with Apple’s volume-purchased licensing and ensures an app is licensed when installation is attempted. That behavior is specific to Apple VPP, not arbitrary Win32 applications.^3^

Recommended workflow

Maintain a small policy record for each application, for example:

{
  "intuneAppId": "00000000-0000-0000-0000-000000000000",
  "licenseMode": "MicrosoftServicePlan",
  "requiredServicePlanId": "service-plan-guid",
  "failureAction": "Deny"
}

Use values such as:

• None — approved freeware or organization-owned software requiring no per-user check.
• MicrosoftServicePlan — validate a Microsoft SKU/service plan.
• VendorApi — query the publisher’s entitlement system.
• ManualApproval — route to software asset management.
• Deny — classification or entitlement is unknown.

A CMDB or service catalog is preferable in production. Intune’s notes field could hold a strict, validated policy value, but it is unstructured metadata; restrict who can edit it and do not treat arbitrary text as trusted authorization data.

Retrieve the Intune catalog with an active Intune tenant license and DeviceManagementApps.Read.All:

GET https://graph.microsoft.com/v1.0/deviceAppManagement/mobileApps
Authorization: Bearer {token}
Accept: application/json

This returns Intune app metadata, not commercial licensing status.^4^

For a mapped Microsoft entitlement, query the requesting user:

GET https://graph.microsoft.com/v1.0/users/{user-id}/licenseDetails
Authorization: Bearer {delegated-token}
Accept: application/json

Compare the returned SKU and enabled service plans with the plan required by your policy record. This endpoint includes directly assigned and group-assigned licenses. For work or school accounts, its least-privileged delegated permission is LicenseAssignment.Read.All; application permission is not supported, and the signed-in user needs a supported Entra role such as Directory Readers or License Administrator.^5^

That delegated-only restriction means it may not fit a fully unattended daemon. An alternative is entitlement-based group targeting.

Entitlement-based assignment

For Microsoft service plans, create a dynamic user group whose membership rule checks that the required plan is enabled:

user.assignedPlans -any (
  assignedPlan.servicePlanId -eq "required-service-plan-guid"
  -and assignedPlan.capabilityStatus -eq "Enabled"
)

assignedPlans contains service plans, not application classifications or third-party licenses.^6^ Dynamic membership groups require Microsoft Entra ID P1 or P2 licensing.^7^

Operationally:

1. In the Microsoft Entra admin center, create a Security group with Dynamic User membership and enter the rule above.
2. In the Intune admin center, go to Apps → All apps → select the app → Properties → Assignments.
3. Add that entitlement group under Available for enrolled devices or Required, as appropriate.^8^
4. Do not assign the licensed app to broader groups that bypass this entitlement group.

This is entitlement-gated targeting, not an atomic authorization callback immediately before installation. Dynamic-group membership and Intune assignment processing are asynchronous, so entitlement changes can take time to affect deployment. If strict transaction-time enforcement is required, place the entitlement check in the request/approval workflow before adding the user to an app-specific assignment group.

In short, eliminating all mapping is not possible for a mixed Microsoft and third-party catalog. The minimum dependable mapping is:

Intune app ID → licensing policy → required Microsoft service plan, vendor entitlement check, manual approval, or no entitlement required.

References

1. mobileApp resource type
2. win32LobApp resource type
3. How to Manage iOS and macOS Apps Purchased Through Apple Business Manager with Microsoft Intune
4. List mobileApps
5. List licenseDetails
6. Manage rules for dynamic membership groups in Microsoft Entra ID
7. Create and manage dynamic membership groups for B2B collaboration in Microsoft Entra External ID
8. Assign Apps to Groups With Microsoft Intune