Questions about Avyna Catalog, asked before anything is signed.

No. It sits on top of it. Intune stays your deployment and device-management system; Catalog is how people ask for what it delivers and how those requests get approved.

No. You publish applications that already exist in your Intune catalog, and access is granted through the install group you nominate.

Company Portal lets people install what has already been assigned to them. Deciding who is eligible still happens beforehand, by hand. Catalog is the part in front of that.

Entra ID Governance is Microsoft’s own answer and a real product — it does things Catalog does not, notably access that expires and recurring access reviews. The differences that matter to most organizations are shape and reach: it is sold per user per month on top of an Entra P1 or P2 licence, and it is built for organizations running a formal governance programme. Catalog does one job — request, approve, grant — for a whole organization at one price, and can be running a minute after you buy it.

You can route and approve a request in a service desk. What you cannot do without building it is the last step: someone still has to go into Entra or Intune and grant the access. That step is where the delay lives, and it is the one Catalog removes. Plenty of organizations keep their service desk and use Catalog for software and group access specifically.

Many organizations have. It works, and then it becomes something one person owns — until they change role. The build is not the expensive part; the next five years are.

Six permissions, granted once by a Global Administrator and listed on the Microsoft consent screen: read devices, read Intune apps, read Intune managed devices, read all users’ profiles, sign in and read the user’s own profile, and read/write group memberships — the last being what actually grants approved access.

Three things, by design. If the directory read comes back incomplete, nothing is removed. If a run would remove an implausible share of your people, it stops and reports instead of proceeding. And the root user is never removed automatically.

To Stripe, and only to Stripe. Payment is taken on Stripe’s own hosted checkout page, and changing a card, downloading invoices or updating billing details happens in Stripe’s billing portal. There is no page in Catalog where a card number is typed, and our systems store Stripe references rather than card data.

No. Sign-in is with their Microsoft work account.

No, and no. Catalog grants access; it does not take it back. Access ends when someone leaves the directory, or when an administrator removes them from the group in Entra directly. There is no expiring or time-limited access and no recurring review.

Macs, yes. Device-targeted application requests cover Windows and macOS, and the requester is only offered devices running the operating system the application is published for. iPhones, Android and Linux, no: not today. Applications and groups assigned to people rather than devices are unaffected.

Yes. Managers get an All demands report across the organization, and moderators get the requests for the items they moderate. Filter it by status, request and update dates, platform, device, requester, subject, approver and moderator, then export the filtered set to Excel. Applications and groups export as two separate files, prepared in the background and available for 24 hours. What Catalog does not give you is a system-wide audit log. You get each request’s full history and this report.

They are removed from Catalog and their open requests are closed, with their approvers told no action is needed. Their place in the plan is released.

The request is marked failed, the requester is told, and they can submit it again.

Yes. Each application and group can be restricted to named users or named directory groups, nested groups included.

Yes, from their own profile. They name up to three colleagues, permanently or for a set period. The delegate sees the requests in their own queue, and every action records both who clicked and whose approval they were covering. If a delegate leaves Catalog, the coverage pauses and the person who delegated is told. Naming a colleague who is not yet a Catalog user counts against your plan’s user limit.

No. An approver can leave a comment of up to 1,000 characters when approving or rejecting, and the rejection email includes it when there is one, but neither is required.

Yes. A support form takes a title, a description and screenshots, returns a reference and continues by email. You can reach it from the sign-in screen, the app footer and the screen shown when your organization has run out of places. Catalog publishes no support hours or response times.

The number of people who can use Catalog. That is the only difference. Every plan is the complete product — the same catalog, the same approval chains, the same scoping, the same automatic fulfilment — sized to a different directory.

30 days, on every plan and on both billing terms. It is the whole product, so there is no smaller version to try. A payment method is taken at sign-up on Stripe’s hosted checkout, and nothing is charged until the 30 days are up. Cancel before then and you are not billed, including on a twelve-month commitment: that term starts when billing starts, not when you sign up.

Per organization, by the number of Catalog users included in the plan — not per seat, and not by feature. Beyond the largest plan, the offer is built with you.

Everyone already counted keeps full access. New people cannot sign in until the plan is raised, and they get an explanation plus a one-click way to notify the administrators. Administrators are warned before the limit and notified when it is reached, and raise it from the billing screen without contacting anyone.

Only if you are inside the smaller plan’s limit at the time the change takes effect. If you are over it, the change is refused and you are told why, rather than people silently losing access.