Skip to content
Andy Kemp Consulting

Before you start: permissions and set-up#

What you need#
Windows Windows 10 or 11, 64-bit. Nothing to install: AppDeploy is one EXE.
Intune A tenant with Intune licences.
Day-to-day account Intune's Application Manager role, or a custom Intune role that can create, read, update and assign mobile apps. No directory roles.
For set-up, once A Cloud Application Administrator. Global Administrator isn't needed.

AppDeploy runs with your normal rights. Only a local test run asks for administrator rights, and only for the installer it runs.

Set up your tenant (once)#

AppDeploy signs in with its own app registration in your tenant, with delegated Microsoft Graph permissions. Nothing is registered in, or sent to, Andy Kemp Consulting's tenant.

The automatic way: Tools, Set up this tenant#

A Cloud Application Administrator does this once:

  1. In AppDeploy, choose Tools, Set up this tenant. It explains what it will create; choose OK and sign in.

    This one sign-in goes through Microsoft Graph Command Line Tools, Microsoft's own app for Graph PowerShell, because something has to sign in before AppDeploy's registration exists. It asks for Application.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All for you only. If Microsoft asks you to consent, leave Consent on behalf of your organisation unticked. Nothing is cached.

  2. AppDeploy checks your roles. Cloud Application Administrator or Application Administrator carries on. Global or Privileged Role Administrator gets a warning that it's more than needed. Anyone else is stopped before anything changes.

  3. It creates the AKC AppDeploy app registration (single tenant, public client, no secret), its enterprise app, and admin consent for exactly the three permissions below. Run it again and it corrects the registration rather than adding another.
  4. It saves the client ID and tenant in Tools, Settings, and forgets the administrator's sign-in.

Then sign in (top right) with your Application Manager account.

Optional, afterwards

In Entra, set Assignment required on the AKC AppDeploy enterprise app and assign your Intune admins, so no one else can sign in to it. You can also target Conditional Access at it.

The permissions#

Delegated permission Why
DeviceManagementApps.ReadWrite.All Create Win32 apps, upload their content, set categories and assign them
Group.Read.All Search for groups to assign to
User.Read Show who's signed in

They're delegated: AppDeploy can only ever do what the signed-in person's own Intune role allows.

By hand#

If your tenant blocks Microsoft Graph Command Line Tools, or you'd rather do it yourself, in the Entra admin centre:

  1. App registrations, New registration: name AKC AppDeploy, Accounts in this organizational directory only, redirect URI platform Public client/native: http://localhost.
  2. Authentication, Add a platform, Mobile and desktop applications: add ms-appx-web://microsoft.aad.brokerplugin/<Application (client) ID> (the Windows sign-in broker). Set Allow public client flows to Yes.
  3. API permissions, Microsoft Graph, Delegated: the three permissions above, then Grant admin consent as a Cloud Application Administrator.
  4. In AppDeploy, Tools, Settings: the Application (client) ID and your tenant ID or domain.

There's no client secret or certificate: AppDeploy is a public client.

Signing in day to day#

Sign in at the top right with your Application Manager account. AppDeploy uses the Windows sign-in broker, so Windows Hello, passkeys and device-based Conditional Access work. Where the broker isn't available (Windows Server, some LTSC builds, Windows Sandbox, some VMs) it signs in through your browser instead.

After sign-in, AppDeploy checks the permissions have consent and your account can manage Intune apps. If your account also holds Global, Privileged Role, Intune, Cloud Application or Application Administrator, it warns you: AppDeploy doesn't need them. Keep those for when they're needed, through PIM.