Skip to content
Andy Kemp Consulting

Using AppDeploy#

AppDeploy works through seven steps, listed down the left. Move between them with Back and Next, or click a step. Nothing goes to Intune until you choose Upload to Intune in step 7.

1. Package#

Drop an MSI, an EXE or a folder on the window, or choose Choose an installer… or Choose a folder….

  • A single installer is packaged on its own.
  • A folder is packaged with everything in it, as Microsoft's packager does: keep it to what the installer needs. Choose the Setup file from the list.
  • For an MSI, AppDeploy reads its product name, version, product code and publisher before anything is built.

Choose Build the package. AppDeploy encrypts the content into a .intunewin in the same format as Microsoft's IntuneWinAppUtil, then proves it before you can upload it: it decrypts it and checks its HMAC and SHA-256. Show in folder opens it. Packages are kept in %LOCALAPPDATA%\AKC\AppDeploy\Packages unless you choose Change….

2. Install#

What AppDeploy recognised#

AppDeploy reads the installer's own bytes (nothing runs) to tell which technology it uses, and suggests silent switches with how confident it is:

Installer Install Uninstall
Windows Installer (MSI) msiexec /i "setup.msi" /qn /norestart msiexec /x "{product code}" /qn /norestart
WiX Burn bundle setup.exe /quiet /norestart setup.exe /uninstall /quiet /norestart
Inno Setup setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- "%ProgramFiles%\<app>\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
NSIS (Nullsoft) setup.exe /S "%ProgramFiles%\<app>\uninstall.exe" /S
Advanced Installer setup.exe /exenoui /qn /norestart setup.exe /x /exenoui /qn /norestart
InstallShield (Basic MSI) setup.exe /s /v"/qn REBOOT=ReallySuppress" from the local test
Squirrel (per user) Setup.exe --silent "%LocalAppData%\<app>\Update.exe" --uninstall -s
PowerShell script powershell.exe -NoProfile -ExecutionPolicy Bypass -File script.ps1 your own

Where the uninstaller lives in the app's folder, AppDeploy guesses the folder from the installer's product name and says it's a guess. Where there's nothing to go on, the command shows <app folder>: replace it, or run the local test. The review won't upload while <app folder> is still there.

Use the suggested commands puts the suggestions back if you've changed them.

Commands and behaviour#

  • Install command and Uninstall command: Intune runs these from the package's folder, so the setup file needs no path. They must run with no windows or questions.
  • Install as: System for most apps; User for per-user installers such as Squirrel.
  • Restart behaviour: decide from the return code (the default), the app install may force a restart, Intune will force a restart, or no specific action.
  • Maximum run time: 60 minutes unless you change it. Graph v1.0 doesn't have this setting, so a different value is set through Microsoft Graph beta straight after the app is created.
  • Return codes: the admin centre's defaults (0 and 1707 success, 3010 soft reboot, 1641 hard reboot, 1618 retry). Add any your installer uses.

Test it on this PC#

Test the install runs the install command on this PC, as Intune would (through cmd.exe, from the installer's folder), with administrator rights. Windows asks for them for the installer only: AppDeploy itself is never elevated. Use a test PC or virtual machine if you can.

AppDeploy reads Windows' list of installed apps (64-bit, 32-bit and per-user) before and after, finds what the installer added, and shows:

  • what the exit code means to Intune;
  • the app Windows recorded, with its version and publisher;
  • a suggested uninstall command, with the silent switch added and paths written as %ProgramFiles% so they work on every device;
  • a suggested detection rule.

Use these results fills them in (and the version, in step 5). Test the uninstall runs the uninstall command and checks the app has left the list.

If the installer is still waiting after the maximum run time, AppDeploy stops waiting: usually the install command isn't silent. Choose Stop waiting to stop sooner. The installer runs elevated, so AppDeploy can't close it: close it yourself.

3. Detection#

How Intune tells the app is installed. All the rules must be true.

  • MSI product code: leave the product code empty to use the package's own, so it follows each new version. Optionally check the version is at least a value (empty uses the package's version).
  • File or folder: exists, doesn't exist, or a file's version is at least a value. Tick Look in the 32-bit Program Files for a 32-bit app on 64-bit Windows.
  • Registry: a key exists, a value exists, a value equals some text or a number, or a value is a version at least. Keys start HKEY_LOCAL_MACHINE\ or HKEY_CURRENT_USER\; tick Read the 32-bit registry rather than typing WOW6432Node.
  • PowerShell script: the app counts as installed when the script exits 0 and writes something to standard output. A script can't be combined with other rules. Up to 200 KB.

A version check ("at least") means a newer version also counts as installed, which suits apps that update themselves.

4. Requirements#

  • Processor: x64, x86 and Arm64. A 32-bit installer still runs on x64 and Arm64 Windows: tick those you've tested.
  • Minimum Windows version: any supported Windows 10 or 11, or a Windows 11 release.
  • Free disk space and memory, in MB, or empty for none.

Devices that don't meet them show the app as not applicable.

5. Listing#

What people see in Company Portal.

  • Name, App version, Description (Company Portal shows Markdown) and Publisher: filled in from the MSI or the installer's file details.
  • Category: your tenant's Company Portal categories. They load when you open the step signed in; the refresh button loads them again.
  • Show this as a featured app: featured apps appear first in Company Portal.
  • Logo: the installer's own icon is used automatically (up to 256 px, with its transparency). Choose an image for a PNG or JPEG instead, up to 1 MB; 512 × 512 works well.
  • More details: information and privacy links (full web addresses), developer, owner, and notes for admins.

6. Assign#

Who gets the app. Leave it empty to upload unassigned and assign in Intune later.

  1. Set Add as: Required installs it automatically, Available puts it in Company Portal, Uninstall removes it.
  2. Type the start of a group's name (or paste its object ID). Security and Microsoft 365 groups are listed; mail-only distribution lists aren't. Choose Add, or Exclude to leave that group out.
  3. Or choose All users or All devices. Available is for users, so All devices is added as Required.

Each assignment can be changed to another intent, and has Settings:

  • End-user notifications: all, restart only, or none.
  • Download in the foreground (Delivery Optimisation priority).
  • For Required: Available from and an Installation deadline, in each device's own time or in UTC. Empty means as soon as possible.
  • Restart grace period: the grace period, the countdown before the restart and how long people can snooze.

AppDeploy stops the upload if a group is in twice, is both included and excluded, or a deadline has passed.

Assignment filters will come in a later update.

7. Review and upload#

Every value that will be sent, in one place, with anything that's stopping the upload listed above the button. The package's encryption keys go to Intune with the upload, as the admin centre sends them; they're never shown or logged.

Upload to Intune:

  1. creates the Win32 app, with the listing and logo;
  2. sets the version and maximum run time through Graph beta, if needed;
  3. uploads the content in 6 MB blocks, renewing the upload address on long uploads;
  4. commits it with the package's encryption details and waits for Intune to check it;
  5. waits for Intune to publish the app, sets the category and makes the assignments.

Open in Intune goes to the app in the admin centre. If the upload stops part-way, upload again to finish the same app, or remove it. If only the assignments fail, the app is still uploaded: Try the assignments again.

Projects#

File, Save project keeps everything: the source, every step's settings, the logo and the assignments, in %LOCALAPPDATA%\AKC\AppDeploy\Projects. Projects never hold secrets: the package's keys stay in the .intunewin.

For the next version, open the project, choose the new installer in step 1 and build. Every setting carries over: the install and uninstall commands get the new file name, the version, publisher and logo come from the new installer, and an MSI detection rule left on the package's own product code follows the new version. Run the local test again if the vendor has changed how it installs.