Deploying the MAP Growth Secure Testing Browser with Microsoft Intune

Note: NWEA no longer builds or distributes an .msi installer package for MAP Growth.  All network installations for the MAP Growth Secure Testing Browser for Windows must be deployed using the .exe installer.

NWEA distributes the MAP Growth Secure Testing Browser for Windows as an .exe installer. We do not build or distribute an .msi package for MAP Growth. 

Districts can still mass deploy the browser through Microsoft Intune. Because there is no .msi, deployment goes through the Windows app (Win32) path. District’s will need to  package our .exe into the .intunewin format and deploy it from there.  This article covers the Windows and Intune setup only and is broken down into the following sections:

• Prerequisites
• Step 1: Package the .exe as a .intunewin file
• Step 2: Add the app in Intune
• Step 3: Configure the program settings
• Step 4: Requirements and detection rules
• Step 5: Assign and deploy
• Troubleshooting

Prerequisites

Prior to installing, please ensure the following minimum requirements are met:

• Windows Enterprise, Pro, or Education edition. 

• Devices are enrolled in Intune and Microsoft Entra joined, Entra registered, or hybrid joined. 

• Application size is under 30 GB. 

• The installer must support silent installation. Intune does not support interactive installations, so any installer that prompts during setup will fail. 

The MAP Growth Secure Testing Browser supports silent installation using the switches shown in Step 3.

Step 1: Package the .exe as a .intunewin file

1. Download the Microsoft Win32 Content Prep Tool from GitHub. 
2. Place Setup Lockdown Browser.exe in its own folder, separate from the prep tool. Everything in that folder is compressed into the resulting package. 
3. Run IntuneWinAppUtil.exe. Running it without parameters walks through the required inputs step by step. 

Available command line parameters: 

• -c   Folder containing the setup files 
• -s   Setup file, in this case the .exe 
• -o   Output folder for the .intunewin file 
• -q   Quiet mode 

Recommended: install the .exe manually on a test device before packaging. This confirms the silent switches work and identifies the exact install directory, which is needed for the detection rule in Step 4.

Step 2: Add the app in Intune

1. Sign in to the Microsoft Intune admin center. 

2. Select Apps, then All Apps, then Create. 

3. In the Select app type pane, choose the Windows platform, then select Windows app (Win32). 

4. Select Select app package file, browse to the .intunewin file, and select OK. 

Step 3: Configure the program settings

On the Program page, enter the install command: 

"setup lockdown browser.exe" /v/qn /s 

There is no space in the /v/qn parameter. The /s switch suppresses the installation prompts so the install runs unattended.

Step 4: Requirements and detection rules

• On the Requirements page, set the minimum operating system. For the 2026-2027 school year, the MAP Growth minimum for PC is Windows 11 (23H2, 24H2, or 25H2). 

• On the Detection rules page, use a file path or version check pointing to the install directory confirmed during the manual test install. Intune uses this to determine whether the app is already present, which prevents redownloading to devices that already have it.

Step 5: Assign and deploy

• Assign the app to the appropriate device or user groups. 

• Review the settings, then select Create. 

The Intune Management Extension installs automatically the first time a Win32 app or PowerShell script is targeted to a user or device. The extension checks for new assignments hourly, and also on service or device restart. 

Troubleshooting

If installations fail, the Intune Management Extension logs on the device are the first place to look. The primary log is IntuneManagementExtension.log, which tracks the full delivery and install flow. AgentExecutor.log tracks PowerShell script execution and ClientHealth.log tracks agent health.