How to Deploy PPKG Files Using Intune

Have you heard about PPKG files? On the fly configuration files which you can send via email. I will discuss more about provisioning package files in this post. Hope this will help you to learn how to deploy PPKG files with Intune.

What is .PPKG File?

PPKG files are the provisioning package files created by Windows Imaging and Configuration Designer tool. These PPKG files will be with extension (*. PPKG). You can apply the provisioning package to Windows 10 devices.

How to Create PPKG Files?

You can create PPKG files using Windows Imaging and Configuration Designer (WICD) tool. This WICD is a free tool to customize and configure the windows 10. The WICD tool is included in Windows ADK.

Patch My PC

During the installation of Windows 10 ADK, you will get an option to install Windows Imaging and Configuration Designer tool. This WICD tool can be used to creates a .PPKG provisioning package.

Benefits of Using PPKG

  1. Can use on both mobile and desktop devices
  2. Simple to apply
  3. No network connectivity required. You can send PPKG file as email to user
  4. Deploy PPKG using SCCM
  5. Deploy PPKG using Intune ( we will cover in this post)

Features of WICD Tool

Below are some of the areas where you can use Windows Imaging and Configuration Designer (WICD) tool.

  1. Accounts (Example: Azure AD enrolment, domain join)
  2. Browser settings
  3. certificates
  4. applications (add/remove)
  5. Regional settings
  6. Edition upgrade
  7. Policies (example: Wi-Fi, Bluetooth, update, etc)
  8. Execute scripts (PowerShell, VBS, etc)
  9. Computer naming
  10. Remove pre-installed software
PPKG customisation
Features of WICD Tool or PPKG file

Deploy PPKG Files with Intune

In this post, you will see how to deploy PPKG with Intune. You can use this approach in Windows Autopilot scenario as well to apply the image customization. In this post as an example, I will create PPKG to add root certificate and disable blue tooth settings.

1E Nomad

High-level Steps InvolvedDeploy PPKG Files with Intune

  1. Create PPKG file
  2. Wrap PPKG file as Intunewin format
  3. Create Win32 apps and deploy

Create PPKG – Disabling Bluetooth & Deploy CA Root

From the Windows 10 Start menu click on the Windows Imaging and Configuration Designer (WICD) shortcut to create PPKG files.

Deploy PPKG Files with Intune
  • Wizard will provide options for creating a provisioning package.
  • Select Advanced provisioning
Windows configuration designer
  • Navigate to Policies section and disable Bluetooth in the wizard. I have used this setting just as an example only. Based on your requirement you can configure the required setting
Windows configuration designer PPKG
  • Next, navigate to the certificate section.
  • Browse and add the root CA.
Root CA
  • At last, we will export the customizations as provision package (PPKG file).
Provisioning package

Wrap PPKG file as Intunewin format and deploy using Intune

Next, we need to wrap the PPKG file using Win32 App Packaging Tool. The output of the tool will be in Intunewin format. I have another blog explaining how to wrap and deploy using Intune.

More details about Win32 or .EXE app deployment with Intune is explained in my previous post here.

Intune Console Actions to Deploy PPKG Files

After wrapping the PPKG file to the intunewin format, you can upload the file to Intune. More details about the steps to upload and create an application with Intune is explained in my previous post here.

Please use below PowerShell command line while configuring in Intune. Below command line apply the provisioning package (PPKG) silently.

intune program
  • powershell.exe “Add-ProvisioningPackage -Path “XXXXX.ppkg” -ForceInstall -QuietInstall”
  • powershell.exe Remove-ProvisioningPackage -PackageId “{XXXXX}”

Refer here for more details on PPKG install and uninstall command line switches.

Results and Troubleshooting PPKG File Deployment

The best place to check or troubleshoot PPKG deployment is Event Viewer. You can see the PPKG related events in the event viewer section “Provisioning-Diagnostics-provider”. More details about Windows MDM Troubleshooting is available in the post here.


Applying package ‘Custom.ppkg’ ID: {426c45cf-a045-4cb1-92cf-aa4f69ead9d8}.

  • You can see the Root certificate which configured in PPKG is applied successfully.
Provisioning-Diagnostics-provider Root CA

ProvXML category ‘Certificates’ completed successfully. Provisioning succeeded.

  • You can see the policy to turn off Blue tooth is applied by PPKG

Configuring ProvXML with category ‘Policies’. ProvXML data:Policy/Config/Connectivity/AllowBluetooth

Provisioning-Diagnostics-provider Bluetooth
  • Blue tooth is turned off and disabled successfully
Provisioning-Diagnostics-provider Bluetooth off

Conclusion – Strategic Approach

Traditionally Provisioning packages (.PPKG) are manually executed by IT admin or users to deploy configuration. I would say PPKG is an excellent tool. But we should not rely only on provisioning packages (PPKG). I would try to avoid deploy PPKG files with Intune.

In the Modern desktop deployment, Windows Autopilot and Intune are strategic tools which should be used to deploy Win 10 settings, apps, and any image customizations. Intune doesn’t natively support PPKG file as deployment type. Hence, we need to wrap provisioning package (PPKG) to Intunewin format for Intune deployment.