In Intune, you can determine who has access to an app by assigning groups of users to include and exclude. Before you assign groups to the app, you must set the assignment type for an app. The assignment type makes the app available, required, or uninstalls the app.

To set the availability of an app, you include and exclude app assignments to a group of users or devices by using a combination of include and exclude group assignments. This capability can be useful when you make the app available by including a large group, and then narrow the selected users by also excluding a smaller group. The smaller group might be a test group or an executive group.

As a best practice, create and assign apps specifically for your user groups, and separately for your device groups. For more information on groups, seeAdd groups to organize users and devices.

When working with group assignments, if Microsoft Entra soft-deletes groups, Intune displays them as soft deleted in the console and their assignments are removed. Restoring the groups restores their assignments.

Important scenarios exist when including or excluding app assignments:

• Exclusion takes precedence over inclusion in the following same group type scenarios:

  • Including user groups and excluding user groups when assigning apps

  • Including device groups and excluding device group when assigning apps

    For example, if you assign a device group to theAll corporate users user group, but exclude members in theSenior Management Staff user group,All corporate users except theSenior Management staff get the assignment, because both groups are user groups.

• Intune doesn't evaluate user-to-device group relationships. If you assign apps to mixed groups, the results might not be what you want or expect.

For example, if you assign a device group to theAll Users user group, but exclude anAll personal devices device group,All users get the app. The exclusion doesn't apply.

As a result, we don't recommend assigning apps to mixed groups.

Include and exclude groups when assigning apps

To assign an app to groups by using the include and exclude assignment:

1. Sign in to theMicrosoft Intune admin center.

2. SelectApps >All Apps. The list of apps that has been added to Intune is shown.

3. Select the app that you want to assign. A dashboard displays information about the app.

4. SelectProperties under theManage section.

5. SelectEdit next toAssignments.

6. SelectAdd all users under theAvailable with or without enrollment section to assign this app to all users.

7. SelectAdd group under theAvailable with or without enrollment section.

8. Select the group that you want to exclude from the app assignment.

9. ChooseSelect to include the group.

10. SelectIncluded under theGroup mode next to the group you added. TheEdit assignment pane is displayed.

    [NOTE]By default, the groups you select are assigned in included mode.

11. SelectExclude as theMode under theAssignment settings in theEdit assignment pane.

12. SelectOK to exclude the selected group.

13. SelectExcluded Groups to select the groups of users that you want to make this app unavailable to.

14. Select the groups to exclude. This action makes this app unavailable to those groups.

15. SelectReview + save to make your group assignments active for the app.

When you make group assignments, groups that have already been assigned aren't available to be modified. If you want to select a group that currently isn't available, first remove the group from the app's assigned list.

To edit assignments, in the appAssignments pane, select the row that contains the specific assignment that you want to change. You can also remove an assignment by selecting the ellipse (…) at the end of a row, and then selectingRemove.

Next steps

• For more information about including and excluding group assignments for apps, see theMicrosoft Intune blog.
• Learn how tomonitor app information and assignments.