Everything Catalog does

01 The catalog

Everything in this table is in every plan. Plans differ only by how many people can use Catalog.

Published application catalog

Staff browse a curated set of your Intune applications, with names, descriptions, publisher, version, icons and categories they recognize.

Published group catalog

The same for directory groups, so people can ask to join rather than emailing whoever looks after the group.

Search, categories and platform

People find what they need without knowing its official name, and see what applies to the machine they use.

Windows and macOS

Device-targeted application requests cover both, and the requester is only offered devices running the right operating system.

Item visibility scopes

An application or group can be visible only to named people or named groups, so each person’s catalog shows what they are eligible for and nothing else.

Device-targeted requests

For apps that install to a device, the requester picks which of their own managed devices it goes to.

Device-targeted groups

A published group can be assigned per person or per device, so a device joins the group instead of the person it belongs to. Groups are not tied to a platform, so all of the person’s devices are offered.

02 Approvals

Per-item approval chains

Each application and each group carries its own ordered steps, or none for things that do not need one.

As many steps as the decision needs

No limit on how many approvals a request must clear, and no limit on mixing the kinds of approver across them.

Five kinds of approver, per step

The requester’s manager, their manager’s manager, a third level up, the item’s moderator, or a named person or group, in any order.

Manager-hierarchy approvals

Steps resolve to the requester’s manager, second-level or third-level manager, read from your own directory as each step comes up. The approvers it finds are then recorded on that step.

Named approvers

A step can be a specific person, or any direct member of a specific group.

Comment on either decision

An approver can leave a comment when approving or rejecting. It is optional both ways and stays on the request’s record.

Missing-manager policy

If the requester’s management chain is too short for a step, that step is cleared automatically with the reason recorded, or the request is blocked instead if you turn that on.

Approval delegation

Any approver can name up to three colleagues to act for them, permanently or for a set period. The record shows who acted and whose approval they were covering.

Approver queue

One list per approver of what is waiting on them and what they have already acted on, including what has been delegated to them.

03 Fulfilment and record

Automatic fulfilment

On final approval the person or device is added to the Intune group that grants access. No manual step.

Honest failure

If the hand-off to Intune fails it is retried, and if it still fails the request is marked failed and the requester told plainly.

Request tracking

Requesters see every step, its status, and who is holding it.

Request reference

Every request carries a short code such as APP-7K2MP, on screen and in every email, copyable in one click, with a lookup that takes the right person to the right view.

Full history on every request

Who asked, who approved or rejected, when, on whose behalf, and what they said, kept for the life of the request.

Email at every stage

Submitted, action required, step approved, approved, rejected, canceled, failed, to the people each concerns.

Duplicate requests prevented

Somebody cannot raise the same request twice and leave two approvers acting on it.

Request report and Excel export

Managers see every request in the organization and moderators the ones they moderate, filtered by status, dates, platform, device, requester, subject, approver and moderator. The filtered report downloads as an Excel spreadsheet.

04 Administration

Directory clean-up

People who leave the directory are removed, their place in the plan is released, and their open requests are closed with approvers told why.

Safety guards on that clean-up

An incomplete directory read changes nothing, a run that would remove an implausible share of your people stops instead, and the root user is never removed automatically.

Delegated administration

Separate rights for applications, groups, users, billing and settings, so whoever curates the catalog does not need to be a Microsoft Global Administrator.

Handing over one person’s duties

A user manager moves someone’s rights, moderated items and approval steps to a replacement in one step. The requests already waiting on them move across instead of being cancelled.

Organization settings

Three settings, set once: whether a request that needs a missing manager is blocked or cleared automatically, whether moderators may create applications, and whether they may create groups. The last two are off by default.

User-limit management

Usage against the plan limit shown in the product, with warnings before the limit and notification when it is hit.

Support in the product

A support form with screenshots, reachable from the sign-in screen, the app footer and the screen shown when the plan is full. It returns a reference and continues by email.

Self-serve setup and billing

Organization and agreements, plan, Microsoft consent, then payment: four steps, about a minute. Afterwards you change plan, see invoices, update payment details and cancel without contacting anyone.

Returning without losing your work

An organization that comes back after cancelling chooses whether to keep its previous applications and groups or start clean.

English and French, light and dark

Chosen per person rather than per tenant.