Claude Code for Intune

I just wanted to see if I could wrap the user installer for Claude Code into something actually usable for Company Portal.

A small developer toolkit packaged as Win32 apps for the Intune Company Portal. The main app is Claude Code. Claude Desktop, VS Code, PowerShell 7, and Git for Windows come along as well.

The goal: give one Entra group ("Developers") an easy way to install Claude Code on a managed Windows device, all through normal Intune deployment.

What is in the kit

App	Installer source	Context
Claude Code	Anthropic bootstrap (claude.ai/install.ps1)	User
Git for Windows	Direct installer (Inno Setup .exe)	System
VS Code	Direct installer (Inno Setup .exe, System)	System
PowerShell 7	Direct installer (MSI)	System
Claude Desktop	Anthropic CDN MSIX (claude.ai/api/desktop/...)	System

Claude Desktop references: Deploy Claude Desktop for Windows, Enterprise configuration for Claude Desktop.

All five apps are separate installs in Intune. None of them is set up as a Win32 dependency of any other. Claude Code works on its own. Users can install the other four from Company Portal when they want them.

Repo layout

claude-code-intune/
├── README.md            # this file
├── apps/
│   ├── claude-code/
│   │   ├── README.md
│   │   ├── Detect.ps1            # uploaded to Intune on its own
│   │   └── package/              # input to IntuneWinAppUtil.exe
│   │       ├── Install.ps1
│   │       └── Uninstall.ps1
│   ├── git-for-windows/          # same shape, plus a bundled Git-*-64-bit.exe
│   ├── vscode/                   # same shape, plus a bundled VSCodeSetup-x64-*.exe
│   ├── powershell-7/             # same shape, plus a bundled PowerShell-*-win-x64.msi
│   └── claude-desktop/           # same shape, plus a bundled Claude.msix and policies.json
└── docs/
    └── intune-configuration.md   # how to package, set up, and assign the apps

The bundled installer files are gitignored.

Building .intunewin packages

Two helper scripts run before the build:

1. .\source\Update-Tooling.ps1 - downloads the latest Microsoft Win32 Content Prep Tool into source\IntuneWinAppUtil.exe and checks the Authenticode signature.
2. .\source\Update-Installers.ps1 - downloads the latest Git for Windows, VS Code (System x64), PowerShell 7, and Claude Desktop installers into the per-app package/ folders. Each download is signature-checked.

Both scripts write files that are gitignored, so each clone downloads its own.

Then build all five .intunewin packages at once:

.\source\Build-AllPackages.ps1

Or build one app on its own:

.\source\IntuneWinAppUtil.exe -c apps\<app>\package -s Install.ps1 -o build\<app>

package/ is the folder that goes into the .intunewin. It holds the install and uninstall scripts plus the bundled installer or MSIX for the four system-context apps. Detect.ps1 is not packaged. It is uploaded to Intune on its own as a custom detection script. See docs/intune-configuration.md for the full per-app build, setup, and assignment steps.

Conventions

• PowerShell 5.1 only (the Intune Management Extension runs Windows PowerShell, not pwsh).
• Win32 install/uninstall scripts re-launch themselves as 64-bit via sysnative when spawned by IME's 32-bit process.
• Logs are written in CMTrace format (open them in CMTrace or OneTrace). User-context logs go to %LOCALAPPDATA%\Hawkweave\ClaudeCodeIntune\Logs. System-context logs go to %ProgramData%\Hawkweave\ClaudeCodeIntune\Logs.
• Install and uninstall scripts isolate cleanup-step errors from the main exit code; a failed cleanup never hides install/uninstall success or failure.
• Exit code contract: 0 = success, 1 = failure, 3010 = success with reboot required. Intune surfaces 3010 as "Installed successfully, reboot required" in Company Portal via the Device restart behavior setting. Only Claude Desktop's -EnableCowork path currently emits 3010, when DISM's VMP enable queues a reboot.

Out of scope

• ARM64.
• Devices that are not joined to Entra ID.
• Sign-in automation. Users sign in to Claude Code and Claude Desktop themselves on first run.

License

MIT - see LICENSE.

Not affiliated with Anthropic. "Claude", "Claude Code", and "Claude Desktop" are trademarks of Anthropic, PBC, used here only to identify the upstream products this kit deploys.