When an app install fails, Intune usually gives you a hex code and one line of text. This quick reference lists the codes admins meet most on Windows, iOS/iPadOS and Android, with Microsoft's meaning, the usual cause and the first check, grouped by platform and component. Rows link to this site's detailed guides where they exist.
Codes in this quick reference
0x87D1041C The application was not detected after installation completed successfully.Intune admin center (app install status)0x87D300C9 The unmonitored process is in progress, however it may timeout.Intune admin center / Company Portal0x87D30065 Failed to retrieve content information.Intune admin center (app install status)0x87D30067 Error unzipping downloaded content.Intune admin center (app install status)0x80070643 (exit code 1603) ERROR_INSTALL_FAILURE: a fatal error occurred during installationIntune admin center / AppWorkload.log0x80070652 (exit code 1618) ERROR_INSTALL_ALREADY_RUNNING: another installation is already in progressIntune admin center / AppWorkload.log0x80070642 (exit code 1602) ERROR_INSTALL_USEREXIT: the user canceled installationIntune admin center / AppWorkload.log0x80070653 (exit code 1619) ERROR_INSTALL_PACKAGE_OPEN_FAILED: the package couldn't be openedIntune admin center / AppWorkload.log
+ 50 more codes in the tables below.
How to read these codes#
In the Microsoft Intune admin center, app errors appear under Apps › All apps › (app) › Device install status (or User install status), on a device's Managed apps page, and in Troubleshooting + support › Troubleshoot. The prefix tells you which component raised the code:
0x87D1…: Intune status codes, used on several platforms;0x87D13B…are Apple install results.0x87D30…: agent installs, such as Win32 apps run by the Intune Management Extension (IME); macOS PKG and DMG codes are in the macOS app guide.0x8007…: a Windows error wrapped as an HRESULT, often the installer's own exit code.0x80073C…and0x80CF…: MSIX/AppX deployment.0x8A15…: WinGet, which the IME uses for Microsoft Store apps.0xC7D1…: Android device administrator and Samsung Knox installs.
Reports and Graph exports may show signed decimals instead; PowerShell converts both ways:
PowerShell
'0x{0:X8}' -f -2016345060 # 0x87D1041C
[int]0x87D1041C # -2016345060
0x80070643 -band 0xFFFF # 1603, the installer exit codeWindows: Win32 apps and the Intune Management Extension#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D1041C | The application was not detected after installation completed successfully. | Install succeeded but a detection rule doesn't match (path, 32/64-bit, version, context), or the app updated itself (common with self-updating MSIs) or was removed | Test the detection rule; read the result in AppWorkload.log (0x87D1041C guide) |
0x87D300C9 | The unmonitored process is in progress, however it may timeout. | The installer was still running when the IME stopped watching: a hidden prompt, a wrong silent switch, or longer than Installation time required (60 minutes by default) | Run the command as SYSTEM on a test device; it must finish with no UI |
0x87D30065 | Failed to retrieve content information. | The IME couldn't get the app's content details; Microsoft documents no cause (admins report proxy, firewall or TLS inspection, or a failed upload) | The download step in AppWorkload.log; re-upload if every device fails (download errors guide) |
0x87D30067 | Error unzipping downloaded content. | The package couldn't be extracted: antimalware scanning the IME folders (Microsoft recommends excluding them) or, as admins report, a damaged package | Antivirus exclusions for the IME Content folder and C:\Windows\IMECache; repackage |
Installer exit codes (Win32 and MSI)#
Intune compares the installer's exit code with the app's return codes: by default 0 and 1707 mean Success, 3010 Soft reboot, 1641 Hard reboot and 1618 Retry. Any other code is a failure, usually shown as 0x8007 plus the code in hex, so 1603 appears as 0x80070643. MSI line-of-business apps return the same Windows Installer codes.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80070643 (1603) | ERROR_INSTALL_FAILURE: a fatal error occurred during installation | Failed custom action, missing prerequisite, wrong context or pending restart | Log with /l*v; search for Return value 3 |
0x80070652 (1618) | ERROR_INSTALL_ALREADY_RUNNING: another installation is already in progress | Another Windows Installer session is running | What else is installing at the same time |
0x80070642 (1602) | ERROR_INSTALL_USEREXIT: the user canceled installation | Installer UI was closed or canceled | Make the command silent (/qn or the vendor's switch) |
0x80070653 (1619) | ERROR_INSTALL_PACKAGE_OPEN_FAILED: the package couldn't be opened | The command names a file or path that isn't in the package | Compare with the .intunewin source folder |
0x80070659 (1625) | ERROR_INSTALL_PACKAGE_REJECTED: forbidden by system policy | A device policy blocks the install | Windows Installer and application control policies |
0x80070666 (1638) | ERROR_PRODUCT_VERSION: another version of this product is already installed | The MSI can't upgrade the installed version | Remove it first or use supersedence |
0x80070667 (1639) | ERROR_INVALID_COMMAND_LINE: invalid command line argument | A typo in switches or properties, or bad quotes | Run the command in an elevated prompt |
3010 | ERROR_SUCCESS_REBOOT_REQUIRED: success, a restart is required to complete the install | Soft reboot; detection may pass only after the restart | The app's Device restart behavior |
1641 | ERROR_SUCCESS_REBOOT_INITIATED: success, the installer has initiated a restart | The installer restarted the device (Hard reboot) | Suppress it with REBOOT=ReallySuppress |
Windows: MSIX, line-of-business and Microsoft Store apps#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80073CFF, 0x80CF201C | To install this app, you must have a sideloading-enabled system. | Not signed with a trusted signature, or AllowAllTrustedApps not enabled | The certificate chain on the device; the trusted-apps policy |
0x80073CF0 | The package could not be opened (unsigned, or publisher doesn't match the certificate) | Unsigned package, or publisher name differs from the certificate subject | The AppxPackagingOM event log |
0x80073CF3 | The package failed update, dependency, or conflict validation. | Conflicting package, missing dependency or wrong architecture | The AppXDeployment-Server event log |
0x80073CFB | The provided package is already installed, and reinstallation of the package is blocked. | A rebuilt or re-signed package with the same version | Increment the version, rebuild and re-sign |
0x8000FFFF | An unexpected error occurred during installation. | Generic failure | The installation logs |
Microsoft Store apps (WinGet)#
The IME installs Store apps through WinGet, so failures often carry WinGet codes; reproduce them with winget on the device (winget --info shows the log folder). See the Store app errors guide.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x8A150008 | APPINSTALLER_CLI_ERROR_DOWNLOAD_FAILED: Downloading installer failed | Network, proxy or TLS inspection | Repeat the download without the proxy |
0x8A150011 | APPINSTALLER_CLI_ERROR_INSTALLER_HASH_MISMATCH: The installer file's hash does not match the manifest | The installer changed at its source, or was altered in transit | Retry later; test without TLS inspection |
0x8A150014 | APPINSTALLER_CLI_ERROR_NO_APPLICATIONS_FOUND: No packages found | The package ID isn't available to this device | winget search --id <id> --source msstore |
0x8A15001B | APPINSTALLER_CLI_ERROR_MSSTORE_BLOCKED_BY_POLICY: The Microsoft Store client is blocked by policy | A Store policy blocks the Store source | Store and App Installer policies on the device |
0x8A15001C | APPINSTALLER_CLI_ERROR_MSSTORE_APP_BLOCKED_BY_POLICY: The Microsoft Store app is blocked by policy | A policy blocks this app | As above |
0x8A15001E | APPINSTALLER_CLI_ERROR_MSSTORE_INSTALL_FAILED: Failed to install the Microsoft Store app | Generic Store install failure | Install with winget and read its log |
iOS/iPadOS apps#
Licences and volume purchase (VPP)#
Most trace back to the location (VPP) token or the licence type; see the VPP guide.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D1313D | Could not retrieve license for the app with iTunes Store ID | Intune couldn't get a licence for the app from Apple | Sync the token, then the device; reassign as device-licensed, or revoke and reassign |
0x87D13B7E | License Assignment failed with Apple error 'No VPP licenses remaining' | All licences in use | Buy more or reclaim unused licences |
0x87D13B95 | Can't find VPP license for app. | Licence missing or out of sync | Revoke and reassign the licence |
0x87D13B7D | Unknown error (one documented cause: an expired VPP token) | Several, including an expired token | Tenant administration › Connectors and tokens › Apple VPP tokens |
0x87D13BA9 | The app installation has failed. (ErrorUserEnrollmentUnsupported) | Device licensing on an account-driven User Enrollment device, which supports only user licensing | Use user licensing (User Enrollment guide) |
0x87D13B60 | The app is scheduled for installation, but needs a redemption code to complete the transaction. | A paid app deployed without volume purchase | Buy it in Apple Business Manager |
0x87D13B99 | User must sign in to the App Store. | The install needs an Apple Account (store app or user licensing) | Use device licensing, or have the user sign in |
Device state and user responses#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D11388 | iOS/iPadOS device is currently busy. | The device was locked | Unlock it and sync |
0x87D13B62 | The user rejected the offer to install the app. | Cancel on the install prompt | Ask the user to accept next time |
0x87D13B63 | The user rejected the offer to update the app. | Cancel on the update prompt | Deploy as required, or ask the user to accept |
0x87D13B68 | User declined app management | Management prompt declined | Ask the user to accept app management |
0x87D13B66 | The app is managed, but has expired or been removed by the user. | Uninstalled, expired, or a detection mismatch | Reinstall it, or let the required install retry |
0x87D13B8F | The application is installed on the device but is unmanaged. | A line-of-business app installed outside Intune | Uninstall it; Intune installs the managed copy at the next sync |
0x87D13B94 | Can't install apps when App Store is disabled. | A restriction disables the App Store | The device restrictions profile |
0x87D13B97 | Can't install apps when device is in Lost Mode. | Lost Mode blocks all use | Disable Lost Mode |
0x87D13B98 | Can't install apps when device is in kiosk mode. | Single-app mode is active | Exclude it from the kiosk profile while installing |
0x87D13B93 | Can only install VPP apps on Shared iPad. | A non-VPP app targeted to Shared iPad | Deploy it through volume purchase |
0x87D13B7F | Needed app configuration policy not present, ensure policy is targeted to same groups. | The required app configuration policy isn't assigned to the same groups | Align both assignments |
0x87D13B9D | The latest version of the app failed to update from an earlier version. | Update sent, new version not reported yet | Recheck after the next check-in |
0x87D1041C | The application was not detected after installation completed successfully. | App detection didn't match the device's response: a different app state or version | Sync; compare the installed version with Intune's |
Network and generic failures#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D1313C | Network connection on the client was lost or interrupted. | Connection dropped while the download URL was sent | Retry on a stable network |
0x87D13B6F, 0x87D13B70, 0x87D13B72, 0x87D13B73, 0x87D13B77 | Your connection to Intune timed out. / You lost connection to the Internet. / The secure connection failed. | App manifest validation failed on the network | Wi-Fi, proxy and TLS inspection |
0x87D13B80 | CannotConnectToITunesStoreError | No connection to the App Store | Test App Store access on that network |
0x87D12906 | Apple MDM Agent error: App installation command failed with no error reason specified. | The device returned no reason | Retry; collect console logs if it repeats |
Android (device administrator and Samsung Knox)#
Microsoft documents these for device administrator and Knox installs, where the Company Portal installs the APK; for Android Enterprise, see the Android errors quick reference.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0xC7D14FB5 | The app failed to install. | A bad APK, Google Play Protect, or a device below the app's minimum API level | Install the APK manually on a test device |
0xC7D14FB7 | The app installation APK file used for the upgrade does not match the signature for the current app on the device. | New version signed with a different certificate | Uninstall the old app, then deploy the new one |
0xC7D14FB6 | The app installation APK file cannot be installed because it was not signed. | Unsigned APK | Sign it before uploading |
0xC7D14FB2, 0xC7D15078 | The download failed because of an unknown error. | Poor Wi-Fi or a slow connection | Retry on a reliable network |
0xC7D15015, 0xC7D1507C | The file download process (or service) was unexpectedly stopped. | Low battery or a very long download | Charge, reconnect, sync |
0xC7D14FB1, 0xC7D14FB9 | The end user canceled the app installation. | Prompt canceled or dismissed | Ask the user to accept it |
0xC7D14FBA | The app installation was canceled because the installation (APK) file was deleted after download, but before installation. | Long gap between download and install | Retry from the notification |
0xC7D14FBB, 0xC7D14FBC | Installation or uninstall canceled because the process was restarted | Device restart, or the OS ended the process | Retry; then collect Company Portal logs |
0xC7D14FB8 | The app failed to uninstall. | Some admin apps can't be uninstalled | Try a manual uninstall |
0x87D1041C | The user uninstalled a required app (device administrator only). | Knox blocks this uninstall; device administrator doesn't | Next sync re-prompts the user |
How to verify a fix#
- Windows: trigger a check-in and read the app's latest lines (IME logs guide): a success exit code, then a detection result that finds the app. A verbose MSI log should end with
Installation success or error status: 0. Failed required apps retry on a schedule, not instantly. - Store apps:
winget list --id <id>lists the package. - iOS/iPadOS: Managed apps shows Installed and the VPP token synced recently.
- Everywhere: the device moves to Installed under Device install status.
PowerShell
# App ID: from the app's URL in the admin center
Restart-Service -Name IntuneManagementExtension
Select-String -Path "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload*.log" -Pattern "<app-id>" |
Select-Object -Last 15References#
- App installation error codes for Microsoft Intune (Microsoft Learn): Android, iOS/iPadOS and MSIX codes
- MsiExec.exe and InstMsi.exe error messages (Microsoft Learn): Windows Installer exit codes
- Troubleshoot Win32 apps in Microsoft Intune (Microsoft Learn)
- WinGet return codes (Microsoft winget-cli documentation)
