How to Silently Install the Backblaze Client with Microsoft Intune (Windows)

You can use Microsoft Intune to package, deploy, and monitor the Backblaze Computer Backup client on managed Windows devices. This guide describes a centralized Microsoft Win32 app deployment in which devices use one IT-managed Backblaze account.

Use a pilot group to validate installation, account association, and backup activity before you assign the app to your production fleet.

Note

These instructions provide general guidance for silently deploying Backblaze Computer Backup with Microsoft Intune. Configuration requirements may vary by environment and as Intune is updated. Consult Microsoft’s current documentation for Win32 app management and adding and assigning Win32 apps to confirm the requirements for your environment. Test installation, account association, and backup activity with a pilot group before deploying to production.

Understand the Deployment Models

In a centralized deployment, devices use one IT-managed Backblaze account. The same email address is passed to every installation through BZEMAIL, so the installer does not need to retrieve an email address from Active Directory.

In a decentralized deployment, each device uses an individual user’s Backblaze account. Backblaze’s Windows silent installer can retrieve an email address from a domain’s Active Directory when run under a user account. Without Active Directory, the installer must receive the appropriate email address for each deployment.

This guide provides the centralized Intune procedure. For decentralized deployment requirements and scripting examples, see Silently Install the Backblaze Client on Windows. Test the installation context, user permissions, and email resolution before using a decentralized method with Intune.

Prerequisites

Before you begin, ensure that you have the following items:

• Administrator access to the Microsoft Intune admin center.

• Managed 64-bit Windows 10 or Windows 11 devices that meet the current requirements for both Backblaze Computer Backup and Intune Win32 app management.

• Devices that are registered with or joined to Microsoft Entra ID, enrolled in Intune, and able to receive the Intune Management Extension.

• An active Backblaze group with sufficient licenses for the intended deployment.

• The groupID and groupToken for the Backblaze group.

• The current Backblaze MSI installer and the latest Microsoft Win32 Content Prep Tool.

• A pilot device group.

Note

Backblaze groups without purchased licenses are limited to silent deployment to 10 accounts until a license is purchased for the group. This is an account limit, not a stated 10-device limit.

For the current platform requirements, see Backblaze Supported Operating Systems and Intune Win32 app management prerequisites.

Download and Package the Installer

1. Create separate source and output folders on an administrative Windows computer. Do not place the Microsoft Win32 Content Prep Tool in the source folder because the tool packages every file and subfolder in that location.

2. Download the current MSI installer to the source folder and retain the filename install_backblazemsi.msi.

3. Run the Microsoft Win32 Content Prep Tool. Replace the sample folder paths with the folders that you created.

   IntuneWinAppUtil.exe -c "C:\Intune\Backblaze\Source" -s "install_backblazemsi.msi" -o "C:\Intune\Backblaze\Output" -q

4. Confirm that the output folder contains install_backblazemsi.intunewin.

Create the Win32 App

1. Sign in to the Microsoft Intune admin center.

2. Select Apps > All apps > Create.

3. In the Select app type pane, select Windows app (Win32), and click Select.

4. On the App information page, click Select app package file.

5. Select install_backblazemsi.intunewin, and click OK.

6. Enter an app name and description, enter Backblaze, Inc. as the publisher, and complete any optional fields required by your organization.

7. Click Next.

Configure the Installation Program

Microsoft Intune requires Win32 apps to install without user interaction. Use the quiet MSI option (/qn).

Configure the Centralized Installation

Use the same IT-managed Backblaze email address on every device.

1. On the Program page, select Command line for Installer type, if the field is displayed.

2. In Install command, enter the following command. Replace the example email address and the placeholders, including the angle brackets, with your account and group values:

   msiexec.exe /i "install_backblazemsi.msi" /qn BZEMAIL=backup-admin@example.com BZGROUPID=<groupID> BZGROUPTOKEN=<groupToken>

3. For Install behavior, select System.

4. Complete the remaining Program settings in the following section before clicking Next.

Complete the Program Settings

Use the MSI product code from the packaged installer for the uninstall command. Retain Intune’s extracted command if it uses that product code and performs a silent uninstall. Otherwise, use this template and replace <MSI-product-code> with the actual product code, including its enclosing braces:

msiexec.exe /x "<MSI-product-code>" /qn

Test removal on a dedicated pilot device. Recheck the command after client updates if the installed product code changes.

After completing these settings, click Next to open the Requirements page.

Configure the Requirements

On the Requirements page, configure the following minimum settings:

Backblaze Computer Backup does not support Windows Server. See Unsupported Operating Systems. Windows in S mode does not support this MSI installation workflow. See Microsoft’s Win32 app troubleshooting guidance.

Configure the Detection Rule

Intune requires at least one detection rule. The following MSI rule checks the packaged installer’s product code without requiring a particular version. Test that it still detects Backblaze after a client update before expanding the deployment.

1. On the Detection rules page, for Rules format, select Manually configure detection rules.

2. Click Add.

3. For Rule type, select MSI.

4. In MSI product code, use the product code extracted from the packaged Backblaze MSI. If Intune populates the field automatically, confirm that it matches the packaged installer.

5. For MSI product version check, select No.

6. Click OK.

7. Click Next.

Important: Disabling the version check does not disable the product-code check. If a client update changes the registered MSI product code, this rule can report the app as not installed. For a Required assignment, Intune can then offer the packaged installer again. If this occurs during testing, use a file, registry, or script detection rule that you have verified against both the original and updated client. See Microsoft’s detection-rule guidance.

Configure Dependencies and Supersedence

1. On the Dependencies page, do not add a dependency unless your environment requires a separate prerequisite.

2. Click Next.

3. On the Supersedence page, do not add a superseded app for the initial Backblaze deployment.

4. Click Next.

5. If Intune displays the Scope tags page, add any scope tags required by your organization, and click Next.

Assign the App to a Pilot Group

1. On the Assignments page under Required, click Add group.

2. In the Select groups pane, select the pilot device group.

3. Click Select.

4. Configure End user notifications, Availability, Installation deadline, and Delivery optimization priority according to your deployment policy.

5. Click Next.

6. On the Review + create page, review the configuration.

7. Click Create.

Important

Do not assign the app to overlapping user and device groups. Overlapping assignments can complicate installation-context behavior and troubleshooting.

Test the Pilot Deployment

Verify each of the following items before you expand the assignment:

• Intune reports the app as Installed for each pilot device.

• The Backblaze client is installed without displaying prompts or requiring user input.

• The device appears in the intended Backblaze group.

• The device is associated with the intended IT-managed Backblaze account.

• The initial backup begins and the client reports a healthy state.

• The detection rule continues to report Installed after an Intune synchronization and after a Backblaze client update.

• The uninstall command works on a dedicated test device, if your organization intends to support remote removal.

Monitor the Deployment

1. In the Microsoft Intune admin center, select Apps > All apps.

2. Select the Backblaze app.

3. Under Monitor, select Device install status.

4. Review Status and Status details for each pilot device. Investigate Failed, Install Pending, and Not Installed results before expanding the assignment.

5. In the Backblaze web console, confirm that each pilot device appears in the expected group and has started backing up.

6. Expand the assignment only after the Intune installation status and Backblaze backup status are successful.

Roll Out the App

1. In the Microsoft Intune admin center, select Apps > All apps.

2. Select the Backblaze app.

3. Under Manage, select Properties.

4. Next to Assignments, click Edit.

5. Under Required, click Add group.

6. Select the first production deployment group, and click Select.

7. Keep the pilot device group included in the Required assignment. Add production device groups as separate Included groups.

8. Click Review + save.

9. Monitor the deployment for the evaluation period defined by your organization.

10. Confirm that:

    • Intune reports successful installation on the targeted devices.

    • The devices appear in the expected Backblaze group.

    • Initial backup activity begins successfully.

    • No recurring installation, account-association, or authentication errors occur.

11. Add the next production group only after the current ring meets the rollout criteria.

12. Repeat the monitoring and expansion process until all intended devices are assigned.

Manage Client Updates

Backblaze distributes automatic client updates through a gradual rollout. Verify that your Intune detection rule continues to recognize the installed client after an update (see Auto-Update Process).

Setting MSI product version check to No removes the version comparison, but Intune still checks the MSI product code. If that code changes, update the detection method before expanding the deployment. Do not use a detection rule that causes Intune to reinstall an older packaged client over a newer client.

If a device needs a manual update, install the current Backblaze client over the existing installation. Do not uninstall the existing client first. Test an Intune-based update with the pilot group before deploying it more broadly (see Update the Backblaze Backup Client).

Resolve Intune Deployment Issues

Collect Intune Diagnostics

1. In the Microsoft Intune admin center, open the failed Backblaze installation’s Installation details pane.

2. Click Collect diagnostics.
   This option is available only when the Win32 app installation has failed.

3. Enter the following diagnostic file paths:

   %PROGRAMDATA%\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
   %PROGRAMDATA%\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log
   %PROGRAMDATA%\Microsoft\IntuneManagementExtension\Logs\AppActionProcessor.log

4. Click OK.

5. Allow approximately 15 to 20 minutes for Intune to collect the files.

6. When collection is complete, click Download diagnostics.

7. Review the following information:

   • IntuneManagementExtension.log: Agent check-ins, policy requests, processing, and reporting

   • AppWorkload.log: App assignment, installation, applicability, and detection activity

   • AppActionProcessor.log: Detection and applicability checks

Review Logs on a Device

1. On the affected device, open the following folder:

   C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

2. Open the relevant log files in CMTrace or a text editor.

3. Locate the Backblaze app name, installation command, error code, or time of the failed installation.

4. Compare the log events with the device’s Status details in Intune.

Create a Verbose MSI Log

Use this procedure only on a controlled test device because rerunning the installer can modify the existing installation.

1. Create the following folder on the test device:

   C:\Temp

2. Open Command Prompt or PowerShell with administrator privileges.

3. Navigate to the folder that contains install_backblazemsi.msi.

4. Run the centralized installation command with verbose logging enabled. Replace the example email address and the group placeholders with the values used for your deployment:

   msiexec.exe /i "install_backblazemsi.msi" /qn /l*v "C:\Temp\Backblaze-install.log" BZEMAIL=backup-admin@example.com BZGROUPID=<groupID> BZGROUPTOKEN=<groupToken>

5. Reproduce the installation problem.

6. Open the following log:

   C:\Temp\Backblaze-install.log

7. Review the log for MSI errors and Backblaze installation messages.

Use the following Backblaze messages when reviewing the installation log. These are log messages; do not add them to Intune’s process return-code mappings. For more information, see Troubleshooting in the Windows silent installation guide.

For more information about Intune installation issues, see Microsoft Intune troubleshooting documentation.

Important

Installation commands and logs can contain email addresses, groupID, and groupToken values. Store the files securely and redact sensitive values before sharing them.