Microsoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes

The Microsoft Store app (new) type in Intune installs and updates Store apps through the Intune Management Extension (IME) and WinGet. When an install fails, the code you're chasing is usually WinGet's own 0x8A15xxxx code, a Store policy on the device, or an install-context mismatch. In this post I'll decode the common codes, list the policies that break the integration, and show how to test on the device.

Symptoms#

• A Microsoft Store app (new) shows Failed in the app's device install status, often with a code in the 0x8A15 range.
• Users selecting Install in the Company Portal get Requirements Not Met.
• A system-context UWP app reports 0x87D1041C, although the app is on the device.
• Win32 apps from the Store fail only on the corporate network, while UWP apps install fine.

0x8A15001B The Microsoft Store client is blocked by policy
0x8A15001C The Microsoft Store app is blocked by policy
0x8A15003A Operation is blocked by Group Policy
0x8A15005E The server certificate did not match any of the expected values.
0x8A150008 Downloading installer failed
0x8A150101 Application is currently running. Exit the application then try again.
The application was not detected after installation completed successfully (0x87D1041C)
Requirements Not Met

Why it happens#

The IME uses WinGet and the Microsoft Store source to install the package. UWP and MSIX content comes from the Microsoft Store. Win32 apps in the Store (still in preview) are .exe or .msi installers that the publisher hosts on its own infrastructure. Failures fall into four groups:

• Policy. Store or Desktop App Installer policies on the device disable the Store source, App Installer, or Store apps.
• Network. The device needs to reach both the Microsoft Store and the publisher's content. A proxy that inspects TLS can break the Store connection.
• Context. Each app installs as System or User. Microsoft Entra registered devices must use System.
• Prerequisites. The device must support the IME and have at least two processor cores. Paid apps aren't supported, an app won't install where it's unavailable in the region, and apps with an ARM64 installer aren't supported.

How to fix it#

1. Read the code#

Descriptions come from Microsoft's WinGet return code list:

2. Check Store and App Installer policies#

Microsoft lists the policies that affect Store app deployments, with these recommended values:

Use these values even where a setting's name suggests the opposite. The two App Installer policies aren't built into Intune (Microsoft points to a custom profile), so a stray value usually comes from a custom profile or a GPO under Windows Components › Desktop App Installer; check gpresult /h on hybrid joined devices. Quick look at the policy keys:

$keys = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore',
        'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller',
        'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement',
        'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller'
foreach ($k in $keys) {
    if (Test-Path $k) { "== $k"; Get-ItemProperty -Path $k | Select-Object * -ExcludeProperty PS* }
}

3. Fix network and TLS inspection#

Allow the endpoints in Microsoft's Store proxy guidance and exempt them from TLS inspection. 0x8A15005E means the server certificate wasn't one WinGet expected, which is exactly what an inspecting proxy produces. For Win32 Store apps, ask the publisher which download hosts its installer uses, because that content doesn't come from Microsoft.

4. Match the install context#

• On Microsoft Entra registered devices, set Install behavior to System. A User-context app assigned as Available produces Requirements Not Met in the Company Portal.
• Assigning a UWP app in System context to a device that already has it reports 0x87D1041C, but Microsoft notes the app still installs correctly. A System install also needs the app not to be installed for any user yet, so remove per-user copies first and avoid mixing contexts.
• For Win32 app detection problems in general, see 0x87D1041C: the app installed but Intune can't detect it.

5. Test on the device#

Take the Package Identifier from the app's properties in Intune and run:

winget --info
winget source list
winget show --id <PackageIdentifier> --source msstore
winget install --id <PackageIdentifier> --source msstore --accept-package-agreements --accept-source-agreements

This runs as you rather than SYSTEM (Microsoft doesn't support the WinGet CLI in the system context), but policy blocks and network failures usually reproduce the same way. Logs to read:

• C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log for the IME's install attempts (see reading IME logs).
• Interactive WinGet logs in %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir; winget --info prints the folder.
• For UWP packages, the Microsoft-Windows-AppXDeploymentServer/Operational event log.

Verify the fix#

• Sync the device and confirm the app shows Installed in its device install status and in the Company Portal.
• winget list --id <PackageIdentifier> shows the package, and AppWorkload.log shows the install and a successful detection.
• Check updates too: UWP apps update through the Store unless the auto-update policy blocks it, while Win32 Store apps are updated by Intune only while they stay assigned.

Prevent it next time#

• Keep the four policies above at Microsoft's recommended values and review inherited GPOs.
• Exempt Store endpoints from TLS inspection before rolling out the app type.
• Default to System context for shared and Entra registered devices.
• Watch the Intune known issues list; see current Intune known issues.
• For more codes, see the Intune app install error codes quick reference.

References#

• Add Microsoft Store apps to Microsoft Intune (Microsoft Learn)
• Debugging and troubleshooting issues with WinGet (Microsoft Learn)
• WinGet return codes (Microsoft winget-cli documentation)
• DesktopAppInstaller Policy CSP (Microsoft Learn)