Plan manual remediation before enabling Enterprise App Catalog auto-update

Source facts

Microsoft states that auto-update apps provide neither rollback nor automatic uninstall remediation; removing or remediating a version requires action outside that flow. If Microsoft detects a malicious catalog version, it removes the app and posts an admin-center notification, while customers remain responsible for identifying and remediating affected devices. Auto-update also does not support staged rollout rings or deployment plans. Microsoft Learn.

Applicability

Use this review before enabling auto-update for an Intune Enterprise App Catalog app. Identify the required assignment and target population, and distinguish this workflow from manually guided update supersedence.

DSE recommendation

DSE recommends approving a removal and recovery procedure alongside the decision to automate updates. Assign an owner to monitor notifications, identify affected installations and coordinate application-specific remediation. If pre-release review or staged deployment is required, assess the documented guided update workflow before choosing auto-update.

Verification

On approved test devices, demonstrate how the support team would identify the installed version and carry out the authorized remediation. Verify the resulting application state and business workflow. Record who can act and how affected devices will be tracked; catalog removal alone should not be used to close remediation.

Official references

Microsoft Learn: Microsoft Intune Enterprise Application Management. Source reviewed September 17, 2026.