{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "slug": "dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app", "url": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/" }, "title": "Review catalog installer overrides again for each superseding app", "summary": "Will a customized Enterprise App Catalog installer survive the next app version correctly?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:27+00:00", "modified_at": "2026-09-10T00:52:39+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 241, "potentially_affected": "Apply this review only where a catalog app genuinely needs an installer override. Identify the chosen package, architecture, version, and the approved customization rather than assuming catalog defaults authorize every local change.", "dse_recommendation": "Keep the override and its purpose under version review alongside the catalog package.", "primary_source": { "name": "Add an Enterprise App Catalog App to Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-enterprise-catalog-app", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Enterprise App Catalog permits a PowerShell installer to replace its standard command. Intune still uses detection rules to determine installation success. When creating a superseding app, the script is not transferred automatically and a new script is needed. Microsoft warns that custom install logic can break installation or updating; scripts must not contain secrets. Microsoft Learn.

\n

Applicability

\n

Apply this review only where a catalog app genuinely needs an installer override. Identify the chosen package, architecture, version, and the approved customization rather than assuming catalog defaults authorize every local change.

\n

DSE recommendation

\n

Keep the override and its purpose under version review alongside the catalog package. For each superseding app, compare the new default installation behavior with the customization and decide whether the override is still necessary. Recreate and test the script deliberately instead of assuming the prior version follows the app. Review actual approval coverage for script changes rather than relying on the presence of an approval feature.

\n

Verification

\n

Exercise a clean installation, an update from the supported predecessor, and an approved removal in a test population. Inspect the app’s actual state as well as detection results and script output. Confirm that the new package invokes the intended installer and that no sensitive value is embedded in the script or logs. Preserve the reviewed override and test outcomes with that specific app version before expanding assignment.

\n

Official references

\n

Microsoft Learn: Add an Enterprise App Catalog App to Microsoft Intune.

", "content_text": "Source facts\nEnterprise App Catalog permits a PowerShell installer to replace its standard command. Intune still uses detection rules to determine installation success. When creating a superseding app, the script is not transferred automatically and a new script is needed. Microsoft warns that custom install logic can break installation or updating; scripts must not contain secrets. Microsoft Learn.\nApplicability\nApply this review only where a catalog app genuinely needs an installer override. Identify the chosen package, architecture, version, and the approved customization rather than assuming catalog defaults authorize every local change.\nDSE recommendation\nKeep the override and its purpose under version review alongside the catalog package. For each superseding app, compare the new default installation behavior with the customization and decide whether the override is still necessary. Recreate and test the script deliberately instead of assuming the prior version follows the app. Review actual approval coverage for script changes rather than relying on the presence of an approval feature.\nVerification\nExercise a clean installation, an update from the supported predecessor, and an approved removal in a test population. Inspect the app’s actual state as well as detection results and script output. Confirm that the new package invokes the intended installer and that no sensitive value is embedded in the script or logs. Preserve the reviewed override and test outcomes with that specific app version before expanding assignment.\nOfficial references\nMicrosoft Learn: Add an Enterprise App Catalog App to Microsoft Intune.", "content_markdown": "## Source facts\n\nEnterprise App Catalog permits a PowerShell installer to replace its standard command. Intune still uses detection rules to determine installation success. When creating a superseding app, the script is not transferred automatically and a new script is needed. Microsoft warns that custom install logic can break installation or updating; scripts must not contain secrets. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-enterprise-catalog-app).\n\n## Applicability\n\nApply this review only where a catalog app genuinely needs an installer override. Identify the chosen package, architecture, version, and the approved customization rather than assuming catalog defaults authorize every local change.\n\n## DSE recommendation\n\nKeep the override and its purpose under version review alongside the catalog package. For each superseding app, compare the new default installation behavior with the customization and decide whether the override is still necessary. Recreate and test the script deliberately instead of assuming the prior version follows the app. Review actual approval coverage for script changes rather than relying on the presence of an approval feature.\n\n## Verification\n\nExercise a clean installation, an update from the supported predecessor, and an approved removal in a test population. Inspect the app’s actual state as well as detection results and script output. Confirm that the new package invokes the intended installer and that no sensitive value is embedded in the script or logs. Preserve the reviewed override and test outcomes with that specific app version before expanding assignment.\n\n## Official references\n\n[Microsoft Learn: Add an Enterprise App Catalog App to Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-enterprise-catalog-app)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "url": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review catalog installer overrides again for each superseding app", "item": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "url": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/", "headline": "Review catalog installer overrides again for each superseding app", "description": "Will a customized Enterprise App Catalog installer survive the next app version correctly?", "abstract": "Will a customized Enterprise App Catalog installer survive the next app version correctly?", "articleBody": "Source facts\nEnterprise App Catalog permits a PowerShell installer to replace its standard command. Intune still uses detection rules to determine installation success. When creating a superseding app, the script is not transferred automatically and a new script is needed. Microsoft warns that custom install logic can break installation or updating; scripts must not contain secrets. Microsoft Learn.\nApplicability\nApply this review only where a catalog app genuinely needs an installer override. Identify the chosen package, architecture, version, and the approved customization rather than assuming catalog defaults authorize every local change.\nDSE recommendation\nKeep the override and its purpose under version review alongside the catalog package. For each superseding app, compare the new default installation behavior with the customization and decide whether the override is still necessary. Recreate and test the script deliberately instead of assuming the prior version follows the app. Review actual approval coverage for script changes rather than relying on the presence of an approval feature.\nVerification\nExercise a clean installation, an update from the supported predecessor, and an approved removal in a test population. Inspect the app’s actual state as well as detection results and script output. Confirm that the new package invokes the intended installer and that no sensitive value is embedded in the script or logs. Preserve the reviewed override and test outcomes with that specific app version before expanding assignment.\nOfficial references\nMicrosoft Learn: Add an Enterprise App Catalog App to Microsoft Intune.", "datePublished": "2026-09-10T00:29:27+00:00", "dateModified": "2026-09-10T00:52:39+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-149-review-catalog-installer-overrides-again-for-each-superseding-app/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review catalog installer overrides again for each superseding app" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 241, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Add an Enterprise App Catalog App to Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-enterprise-catalog-app" } } ] } }