Skip to content
Andy Kemp Consulting

Security model#

AppDeploy is built to need as little as possible, and to show you everything before it changes anything.

Least privilege#

Who Needs When
Day to day Intune Application Manager (or a custom Intune role that can create, read, update and assign mobile apps) Every upload
Set-up Entra Cloud Application Administrator (or Application Administrator) Once per tenant
Local test Local administrator on the test PC Only for the installer it runs

AppDeploy warns after sign-in if your account holds Global, Privileged Role, Intune, Cloud Application or Application Administrator, and during set-up if the administrator is Global or Privileged Role Administrator. Neither is needed.

Your tenant's own registration#

Tools, Set up this tenant creates AppDeploy's app registration in your tenant: single-tenant, a public client with no secret or certificate, and delegated permissions only. Nothing is registered in, depends on, or is sent to Andy Kemp Consulting's tenant. To stop AppDeploy, delete or disable the AKC AppDeploy enterprise app.

The permissions are delegated, so AppDeploy can only do what the signed-in person's Intune role allows: an Application Manager scoped to some groups by Intune scope tags is still limited to them.

Permission Used for
DeviceManagementApps.ReadWrite.All Creating Win32 apps, uploading and committing their content, categories and assignments
Group.Read.All The group search in step 6
User.Read Showing who's signed in

What AppDeploy sends, and where#

  • Only to Microsoft Graph (graph.microsoft.com) and the Azure storage address Intune gives it for the upload, plus downloads.andykemp.com to check for updates.
  • Every value that will be sent is on the review screen first.
  • Graph v1.0 is used throughout, except two settings v1.0 doesn't have (the app's version and maximum run time) and adding a category, which go to Graph beta as the Intune admin centre does.

On your PC#

  • AppDeploy runs without administrator rights. The local test asks Windows for administrator rights for the installer it runs, and nothing else.
  • Sign-in tokens stay in the Microsoft sign-in cache, encrypted for your Windows account (DPAPI), in %LOCALAPPDATA%\AKC\AppDeploy. The set-up administrator's sign-in is never cached.
  • The logs (Tools, Open the logs folder) never contain tokens, upload addresses or encryption keys: they're removed before anything is written.
  • Each .intunewin is encrypted with its own new key, as Microsoft's packager does. The keys go to Intune with the upload and are never shown or logged. Project files hold no secrets.

Updates#

AppDeploy checks downloads.andykemp.com for updates and checks each download against its published SHA-256 before using it. To manage updates yourself, set the ManagedUpdates policy (DWORD 1) under HKLM\SOFTWARE\Policies\Andy Kemp Consulting\AppDeploy, and AppDeploy won't update itself.