Managing Software Approval Requests in Configuration Manager: The Software Center Approval Workflow

The old Application Catalog is gone, and with it the web portal where users used to request software and admins used to approve or deny those requests. If you’re still searching for that workflow, you’re looking in the wrong place: modern Configuration Manager handles the whole process inside Software Center and the console itself.

This covers both halves of the job: configuring an application deployment so it requires approval, and actually approving or denying the requests that come in, using the current console workflow rather than the retired Catalog.

Why there’s no Catalog anymore

The Application Catalog and its Company Portal-style request page were deprecated years ago and have since been removed from current branch entirely. Microsoft folded the approval functionality into Software Center and the admin console instead, first as an optional feature and now as the standard, supported way to run an approval workflow. There’s no separate site role to install and no IIS-hosted portal to maintain, which is one less thing to patch and break.

Step 1: turn on the optional feature

Before configuring anything, enable the feature that gives you per-device approval tracking:

1. In the console, go to Administration, Overview, Updates and Servicing, Features.
2. Find Approve application requests for users per device in the list.
3. Right-click it and choose Turn on.

If you skip this, you can still use the older “Require administrator approval if users request this application” checkbox, but you lose the per-device request tracking and the cleaner request list in the console.

Step 2: configure the deployment

In the Deploy Software wizard, on the Deployment Settings page, you’ll see two things that determine whether approval is even offered:

With both of those satisfied, select “An administrator must approve a request for this application on the device” (this is the option enabled by the optional feature above). Finish the wizard as normal with your scheduling and user experience settings.

In Software Center, the app now shows a Request button instead of Install. Users click it, the request lands in the console, and Software Center notifies the user once it’s actioned. A denied request shows “Your request to Install this app has been denied.”

Approving or denying a request

1. Go to Software Library, Application Management, Application Requests.
2. Select the request. The device column shows exactly which machine the user requested it from, which matters if they have more than one.
3. Right-click and choose Approve or Deny (or use the ribbon).

Approving lets the user install on that specific device only; a request from a different device needs its own approval. Denying behaves differently depending on state: if the app hasn’t installed yet, the user is simply blocked from installing it. If it’s already on the device, denying triggers an uninstall on the client’s next policy cycle, so don’t deny an old request without checking whether the software is already in use.

If a previously approved app failed to install, or got removed some other way, select it in Application Requests and use Retry install from the ribbon rather than making the user submit a new request.

Automating approvals with PowerShell

For high volumes, or scheduled tasks that pre-approve known-good requests, use the ConfigMgr PowerShell module:

# Approve a specific request, installing outside business hours
Approve-CMApprovalRequest -Id 16777400 -InstallActionBehavior NonBusinessHours

# List current pending requests
Get-CMApprovalRequest | Where-Object { $_.State -eq 0 }

This needs the Approve permission on the Application object, which the built-in Application Administrator and Application Author roles both include. If a service account is doing the approving, give it a scoped custom role rather than full Application Administrator.

Keeping the request list clean

Unapproved requests clear themselves out after 30 days, but approved and pending ones don’t expire on their own. The Delete Aged Application Request Data site maintenance task controls this behaviour, so if your Application Requests node is cluttered with years-old entries, check that the task is actually enabled and running on your schedule rather than disabled at some point in the past.

Frequently asked questions

Can I require approval for a device collection deployment?

No. Approval options only appear for deployments targeted at user collections. If you need approval-gated software on shared or kiosk devices, you’ll need to rethink the deployment as user-targeted or handle it outside this workflow entirely.

What happens if I deny a request for an app that’s already installed?

The client uninstalls it on its next policy evaluation. Check the device and installation state before denying an older or forgotten request, not just the request itself.

Does the same approval cover a user’s other devices?

No. Approval is tracked per user and per device together. The same user logging into a second machine has to submit and get a separate approval for that device.

Do I still need this if we’ve moved to Intune?

Not directly. Intune’s Company Portal has its own request/approval model for Win32 apps. This workflow is specifically for Configuration Manager clients still being managed on-premises or in co-management, where Software Center is the primary install experience.