Set default app associations via Windows 10 MDM

by

This blog post will be about setting default app associations, or file type associations, on Windows 10 devices. Starting with Windows 10, version 1703, it’s possible to set the default app associations via Windows 10 MDM. In this post I’ll briefly go through this setting and I’ll show how to configure the setting via Microsoft Intune hybrid and Microsoft Intune standalone. I’ll end this post by showing the end-user experience.

Configuration

Starting with Windows 10, version 1703, a new setting was introduced that allows an administrator to set the default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. Every sign-in. In other words, the end-user can make adjustments. However, once the end-user signs-out and signs-in again, the default associations will be applied again. This does require the PC to be Azure AD joined.

Get the required information

Let’s start by getting the required information to configure the custom OMA-URI setting. The required OMA-URI setting is available in the Policy CSP.

OMA-URI setting: ./Vendor/MSFT/Policy/Config/ApplicationDefaults/DefaultAssociationsConfiguration

The required OMA-URI value requires the following steps to get it in the correct format.

1 On Windows 10, version 1703, navigate to Settings > Apps > Default apps and configure the required default apps;
2 Open Command Prompt and run DISM /Online /Export-DefaultAppAssociations:DefAppAss.xml to export a required app associations file;
3

Base64Encode_orgOpen your favorite Base64 encoder and encode the content of DefAppAss.xml to Base64 format.

In my example I was only interested in switching to Internet Explorer as the default browser and keeping Microsoft Edge as the default for PDF reading. That allowed me to remove all the remaining content from the DefAppAss.xml. Then I used base64encode.org to easily encode the remaining content of the DefAppAss.xml to Base64 format (see screenshot).
4 The result in Base64 format is the OMA-URI value.

Configure the setting

After getting the required information, let’s have a closer look at the configuration of the setting. The setting can be used in Microsoft Intune hybrid and Microsoft Intune standalone, by using the configuration guidelines shown below.

Environment Configuration guidelines
Microsoft Intune hybrid

DefAppAss_MIhThe configuration in Microsoft Intune hybrid can be performed by starting the Create Configuration Item Wizard in the Configuration Manager administration console. Make sure to select Windows 8.1 and Windows 10 (below Settings for devices managed without the Configuration Manager client) on the General page and to select Windows 10 on the Supported Platforms page. Now select Configure additional settings that are not in the default setting groups on the Device Settings page and the configuration can begin by using the earlier mentioned OMA-URI setting and value.

Once the configurations are finished, the created configuration items can be added to a configuration baseline and can be deployed to Windows 10 devices.

Microsoft Intune standalone (Azure portal)

DefAppAss_MIsThe configuration in Microsoft Intune standalone, in the Azure portal, can be performed by creating a Device configuration. Create a new profile, or add a row to an existing custom profile. With a new profile, make sure to select Windows 10 and later as Platform and Custom as Profile type. In the Custom OMA-URI Settings blade, add the custom settings by using the earlier mentioned OMA-URI setting and value.

Once the configurations are finished, the profile can be saved and can be deployed to Windows 10 devices.

Note: This post is based on the custom OMA-URI settings configuration. At some point in time this configuration can come available via the UI of Microsoft Intune standalone and/or hybrid.

End-user experience

Now let’s end this post by having a quick look at the end-user experience. Below on the left is the default Windows configuration and below on the right is the applied policy with the custom app associations. I know that this doesn’t provide a lot of information. However, it does show one important fact, which is that there is nothing preventing the end-user from making adjustments. The end-user can still make adjustments, but those adjustments will be reverted during the next sign-in.

DefaultBrowser_Edge DefaultBrowser_IE

More information

For more information about the Policy CSP, please refer to this article about the Policy CSP.

40 thoughts on “Set default app associations via Windows 10 MDM”

  1. Question on this – I am developing a Guest \ Kiosk style modern managed device – I have set this in our policy to default to Chrome. As I am using the new shared PC Guest account, which generates a new profile on each login, I am not seeing this default being set. Any thoughts?

  3. We need the profile to be cleared per use, and the machine to log out after 15mins (client requirements). I am using the new Guest mode with profile management enabled to clear out the local profile on log off. The machine is public use and needs to have many applications available and the machine mostly useable (full office 365 suite installed). If you have any ideas on best accomplishing this I’m all ears 🙂

  9. How do we set a default site in chrome (its in kiosk mode). We got kiosk mode to work with it adding a chrome shortcut to the desktop but need it to be a specific site.

  11. Hi Peter

    Great guide.
    Weird problem that I’m running into is that neither the export or if I display them with get-defaultappassociations display the real associated apps. It just returns Edge for PDF and mail for mail.

    Any ideas?

  15. Hi Peter

    No, apparently when I used elevated PS it used the admin account’s ‘profile’ which I elevated with, which ofcourse was blank and therefor default.
    After making the user, that had the right settings, local admin, it worked.

  17. Pingback: How to customize Windows 10 using Intune and Autopilot

  18. Hi Peter Base64 Encode asks which new line seperator to use (linux or Windows)

    Does this affect the OMA URI output?

  20. It worked like a charm for the Windows. You saved our organization so much headaches. 950+ devices thank you.

  22. Great work Peter….been using your solutions to setup and test intune and has helped enormously!…..

  24. Hi,

    In the new release it’s now possible to push the XML directly into de Intune MDM without conversion by Bash64. Maybe handy to know 😉

  26. This might be a dumb question, but I can’t find the information anywhere as to where this command outputs the .xml file?

  28. Pingback: Replicating Task Sequences in Autopilot - Part 1 - Bare Metal - MSEndpointMgr

  29. I am trying this out and I seem to be getting hung up on the export results. I need to make an association for .text files (not .txt files) for excel. We have an application that will only export to .text and not anything useful like .csv… I can make the change on my system, in settings, but i do not see it populate in the list when I either export or just Get-DefaultAppAssociations. Any ideas as to why I cant see this association in the output of my command? Any help would be greatly appreciated, thanks.

  31. Hi Peter,

    Thank you so much for sharing such a valuable information.
    Could you also please guide about how we can place shortcuts of specific sites in favorites and on desktop so that user can easily access those sites?

    Best Regards

  33. I can’t use above logic to set outlook as default mail client app as you mentioned it is IE but I tried same logic for Outlook. any thoghts

  35. This blog post helped me apply default apps to a fleet of laptops with minimal effort. Thanks for sharing with the community!

    Question – would the raw XML output of DISM work as-is without base64 encoding, if the OMI-URI’s value datatype was set to “String (XML)” instead of just “String”?

  37. Hi Peter,

    Really useful post, thank you.
    I used this with adobe reader for PDFs. After a reboot however, I found that the app association was reset to edge. On the subsequent reboot though, it changed back to adobe and has been okay since. Is this something you have seen before?

    Thanks

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.