Company Portal Disappearing on Windows 24H2: Root Causes, AppX Re-registration & Intune Remediation

Since the 24H2 broad rollout resumed in Q2 2026 for enterprise rings, we've triaged this ticket pattern across four separate tenants: Company Portal.exe vanishes from the Start Menu, taskbar pins go dead, and the affected user can no longer self-remediate compliance issues — because the tool that reports compliance is the thing that's missing. If you're running Autopatch or staged feature update rings and you've seen a spike in "Company Portal not found" tickets correlating with 23H2→24H2 upgrades since mid-2026, this is your root cause map and remediation kit.

The Three-Stage Failure Chain

Company Portal loss on 24H2 isn't one bug — it's three independent failure modes that share a common trigger (the in-place feature update image apply) and get conflated in ticket queues because the symptom is identical. Triage requires branching, not a single fix-all script.

Root Cause 1: Per-User AppX Loss (the most common — 70%+ of tickets)

The overwhelming majority of these tickets trace back to how Company Portal was originally deployed. If it was pushed as a Store app or MSIX assigned to User context rather than a genuinely provisioned all-users package, the 24H2 image-apply process can leave the package binaries on disk but drop the per-user registration record. Get-AppxPackage for that user comes back empty or shows Status: NotAvailable, while Get-AppxProvisionedPackage -Online still shows the provisioned entry — because provisioning and per-user registration are tracked independently in the AppX deployment database, and 24H2's servicing stack changes don't reliably replay the registration step for every existing profile.

Root Cause 2: Store for Business Deprecation Debt

Microsoft retired the Store for Business/Education sync connector in 2023, but plenty of tenants never migrated their private line-of-business or Store-sourced app assignments off it — they just stopped touching that blade. If Company Portal (or a wrapper policy referencing it) was ever synced through that connector, the underlying licensing/content source metadata is now stale. Post-24H2, when the device re-evaluates app assignments during the OOBE-adjacent policy refresh, the app source resolution fails silently: no error surfaces in the console, the assignment just sits at Not applicable indefinitely.

Root Cause 3: MDM Certificate Re-enrollment / Detection Rule Mismatch

Least common, but nastiest to diagnose because it looks identical from the user's chair. During a feature update, the device's MDM enrollment certificate can be silently renewed as part of the post-upgrade device attestation flow. This forces a full app assignment re-evaluation cycle in IME. If Company Portal was ever packaged as a Win32 app (some tenants do this deliberately to control versioning outside Store cadence) with a detection rule keyed to a specific registry value or MSI product code that changed between CP builds, the re-evaluation reads "not detected," uninstalls the stale record, and the reinstall fails against the same broken detection logic — an infinite fail loop that never surfaces as a hard error in Company Portal app status, just perpetually cycling between Install command line failed and Pending.

Detection & Remediation: The Four Scripts

Ad-hoc fixes don't scale past a handful of tickets. Below is the full kit we run in production: a Proactive Remediation pair for the self-healing device-side fix, a bulk diagnostic for identifying the blast radius tenant-wide, and a Graph SDK v2 script for triggering bulk sync once you've isolated the affected cohort.

Script 1 — Detection (Proactive Remediation, runs as SYSTEM)

# Detect-CompanyPortalRegistration.ps1
# Purpose: Proactive Remediation DETECTION script
# Context: SYSTEM
# Exit 0 = healthy (no remediation needed) | Exit 1 = remediation required

$ErrorActionPreference = 'Stop'
$logPath = "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\CP-Detect.log"

function Write-Log {
    param([string]$Message)
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Add-Content -Path $logPath -Value "[$ts] $Message" -ErrorAction SilentlyContinue
}

try {
    Write-Log "=== Detection run started ==="

    # Step 1: Confirm the package exists at all (provisioned or per-user)
    $provisioned = Get-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -eq 'Microsoft.CompanyPortal' }

    $userPkg = Get-AppxPackage -AllUsers -Name 'Microsoft.CompanyPortal' -ErrorAction SilentlyContinue

    ifnot $provisioned -
    
Was this article helpful?
    

      
        👍
        0
      
      
        👎
        0