Deploying Apps To Mac Using Intune

  1. Mar 27, 2019  You can use Microsoft Intune to manage Windows PCs as computers by using the Intune software client. This article provides tips and best practices for using Intune to make software deployments to Windows PC clients.
  2. Self-service workflows enable users to download and install apps as and when required. Apps that a user is entitled to get, are provisioned when the user signs in. Other apps can be used as a trial for a limited time. This also frees up admins from creating and deploying multiple packages and updates.
  3. I have not been able to find documentation on this anywhere for InTune. I tried installing Powershell Core on a test Mac, but I have not been able to find any commands related to local account creation for macOS. Company Portal. I have iOS apps that I would like to make available, but not required to users. I was hoping the CP would solve this.
-->

You can use Microsoft Intune to manage Windows PCs as computers by using the Intune software client. This article provides tips and best practices for using Intune to make software deployments to Windows PC clients. Intune deploys only software that can be installed silently without user interaction.

May 23, 2018  After you've added an app to Intune, you can assign the app to users and devices. This article provides more details on the supported Windows 10 scenarios, and also covers key details to note when you're deploying apps to Windows. Line-of-business (LOB) apps and Microsoft Store for Business apps are the app types supported on Windows 10 devices.

Original product version: Microsoft Intune
Original KB number: 2583929

Only the standalone version of Intune works. No co-management or hybrid with SCCM yet. With that out of the way, let’s take a look at the new Intune console and create an Office 365 package ready to deploy. Deploy Office 365 with Microsoft Intune. Sign into the Azure portal and navigate to Intune Mobile appsApps. Above the list of apps. Oct 28, 2019  As more apps are notarized by developers, it will lower the barrier for developers to publish these apps to Mac App Store, therefore, paving the way for a richer app ecosystem for macOS devices that can be easily purchased using Apple Business Manager and deployed using Microsoft Intune.

Prepare for software distribution

Before you distribute an update or other software package, gather the necessary installation or update files. These files must include either an installation executable file such as Setup.exe or a Windows Installer file such as Application.msi. If the installer file requires other files or folders to complete the installation, put all these files into a single, accessible folder so that they can be added to the software package by the Intune Software Publishing wizard.

For .exe files, Intune adds the /Install switch automatically. Most .exe files typically require additional command-line arguments to turn off the default user interaction and install the package silently. Microsoft Intune deployments support only .exe installer packages. If you want to deploy runtime executable files, use a third-party tool to create an installer package.

For .msi files, Intune adds the /quiet switch automatically. The installer packages should detect that the installation is under the SYSTEM account, and automatically install in silent mode. However, this depends on how the software publisher creates the package. If an application installation requires user context, it probably can't be deployed by using Intune.

Test the software installation by using the SYSTEM account

Before you deploy the software package, test whether the package can be installed silently under the SYSTEM account. To do this, follow these steps:

  1. Download PsExec.

  2. Open an elevated Command Prompt window.

  3. Navigate to the location of PsExec, type the following command, and then press Enter:

  4. This opens a new Command Prompt window as the system context. Type whoami at the new command prompt. You should see the following result:

    nt authoritysystem

  5. Navigate to the location of the deployable package, and then run it by using the correct switches for silent installation.

    Most common switches for software deployment:

    • Lync 2010 (EXE): /silent
    • Skype (EXE): /verysilent
    • Skype (MSI): /passive /qn
    • Internet Explorer 10 (EXE): /quiet /passive /norestart
    • Internet Explorer 11 (EXE): /quiet /norestart
    • Notepad ++ (EXE): /s
    • Firefox (EXE): -ms
    • Adobe Reader (EXE): /sAll /rs /msi EULA_ACCEPT=YES

    If you aren't sure which switches to use for silent installation, run the command by adding the /? or /help switch.

    Here is an example of Skype MSI:

    In addition to the /quiet switch that is added by Intune, you must add the /passive and /qn switches to enable silent installation.

  6. If the installation fails, determine which switches will force the package to install through the SYSTEM account. For help, contact the software publisher or search for the information on the internet.

Test the software deployment

Before you deploy the software to all Windows PCs, we recommend that you assign it as Available, and then manually install it from https://portal.manage.microsoft.com on at least one PC. If the installation seems not to occur, check the following log to verify whether the package tried to install:

C:Program FilesMicrosoftOnlineManagementLogsupdates.log

Note

If the package starts installing and the log shows that it hasn't progressed for several hours, the process is likely stuck and waiting for user interaction.

Unsupported scenario: Deploy scripts or batch files

The Intune service is usually used to deploy .msi or .exe files. Microsoft doesn't support using Intune to deploy custom scripts or batch files.

References

-->

How To Deploy Microsoft Intune

After you've added an app to Microsoft Intune, you can assign the app to users and devices. It is important to note that you can assign an app to a device whether or not the device is managed by Intune.

Note

The Available deployment intent is not supported for device groups, only user groups are supported.

The following table lists the various options for assigning apps to users and devices:

Devices enrolled with IntuneDevices not enrolled with Intune
Assign to usersYesYes
Assign to devicesYesNo
Assign wrapped apps or apps that incorporate the Intune SDK (for app protection policies)YesYes
Assign apps as AvailableYesYes
Assign apps as RequiredYesNo
Uninstall appsYesNo
Receive app updates from IntuneYesNo
End users install available apps from the Company Portal appYesNo
End users install available apps from the web-based Company PortalYesYes

Note

Currently, you can assign iOS/iPadOS and Android apps (line-of-business and store-purchased apps) to devices that aren't enrolled with Intune.

To receive app updates on devices that aren't enrolled with Intune, device users must go to their organization's Company Portal and manually install app updates.

Assign an app

  1. Sign in to the Microsoft Endpoint Manager admin center.

  2. Select Apps > All apps.

  3. In the Apps pane, select the app you want to assign.

  4. In the Manage section of the menu, select Assignments.

  5. Select Add Group to open the Add group pane that is related to the app.

  6. For the specific app, select an assignment type:

    • Available for enrolled devices: Assign the app to groups of users who can install the app from the Company Portal app or website.

      Best Small-Business Billing and Invoicing Software 2020 Need to get paid? Customers are 30% more likely to pay invoices online, 1 and if you send invoices the same day, you’re 1.5 times more likely to get proper compensation. 2 So it pays—literally—to invest in an invoicing and billing software in 2020. Top 10 Best Free Invoicing Software Tools For Small Businesses. As a small business owner, keeping up-to-date with invoicing is essential. Aside from it being the only way your clients or customers will pay you, it is also necessary for your annual tax checkup. If you require a little bit more than solo invoicing software, we've also listed the best accounting software tools for small businesses. Here are some of the best invoicing tools on the market. Jun 09, 2016  5 Best Small Business Invoicing Software for Mac June 9, 2016 by Noemi Tasarra-Twigg 9 Comments There are 28 million small business in the United States, accounting for 54% of sales in the country; and the trend is that the number of small businesses is growing, especially with startups cropping up left and right – not to mention freelancers. https://ninph.netlify.app/invoicing-software-for-small-business-mac-2017.html.

    • Available with or without enrollment: Assign this app to groups of users whose devices are not enrolled with Intune. Users must be assigned an Intune license, see Intune Licenses.

    • Required: The app is installed on devices in the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins.

    • Uninstall: The app is uninstalled from devices in the selected groups if Intune has previously installed the application onto the device via an 'Available for enrolled devices' or 'Required' assignment using the same deployment. Web links cannot be removed after deployment.

      Note

      For iOS/iPadOS apps only:

      • To configure what happens to managed apps when devices are no longer managed, you can select the intended setting under Uninstall on device removal. For more information, see App uninstall setting for iOS/iPadOS managed apps.
      • If you have created an iOS/iPadOS VPN profile that contains per-app VPN settings, you can select the VPN profile under VPN. When the app is run, the VPN connection is opened. For more information, see VPN settings for iOS/iPadOS devices.

      For Android apps only: If you deploy an Android app as Available with or without enrollment, reporting status will only be available on enrolled devices.

      For Available for enrolled devices: The app is only displayed as available if the user logged into the Company Portal is the primary user who enrolled the device and the app is applicable to the device.

  7. To select the groups of users that are affected by this app assignment, select Included Groups.

  8. After you have selected one or more groups to include, select Select.

  9. In the Assign pane, select OK to complete the included groups selection.

  10. If you want to exclude any groups of users from being affected by this app assignment, select Exclude Groups.

  11. If you have chosen to exclude any groups, in Select groups, select Select.

  12. In the Add group pane, select OK.

  13. In the app Assignments pane, select Save.

The app is now assigned to the groups that you selected. For more information about including and excluding app assignments, see Include and exclude app assignments.

How conflicts between app intents are resolved

A single group is prevented from being targeted for multiple app assignment intents, however if a user or a device is a member of multiple groups that are each assigned with different intents it will result in a conflict. Creating assignment conflicts for applications is not recommended.The information in the following table can help you understand the resulting intent when a conflict occurs:

Nox App Player Download on PC (Windows & Mac)Now before explaining the steps regarding the installation of Nox App Player, it is mandatory to throw light on some of its features that make it apart and several steps ahead of the android emulators running currently in the market. Nox app player mac snapchat. Uninstalled, even removed folders that Nox left behind. Installed com.nianticlabs.pokemongo0.37.0-minAPI19(armeabi-v7a)(nodpi)apkmirror.com and Google would never authenicate.

Deploy App Intune

Group 1 intentGroup 2 intentResulting intent
User RequiredUser AvailableRequired and Available
User RequiredUser UninstallRequired
User AvailableUser UninstallUninstall
User RequiredDevice RequiredBoth exist, Intune treats Required
User RequiredDevice UninstallBoth exist, Intune resolves Required
User AvailableDevice RequiredBoth exist, Intune resolves Required (Required and Available)
User AvailableDevice UninstallBoth exist, Intune resolves Available.
App shows up in the Company Portal.
If the app is already installed (as a required app with previous intent), the app is uninstalled.
If the user selects Install from the Company Portal, the app is installed, and the uninstall intent is not honored.
User UninstallDevice RequiredBoth exist, Intune resolves Required
User UninstallDevice UninstallBoth exist, Intune resolves Uninstall
Device RequiredDevice UninstallRequired
User Required and AvailableUser AvailableRequired and Available
User Required and AvailableUser UninstallRequired and Available
User Required and AvailableDevice RequiredBoth exist, Required and Available
User Required and AvailableDevice UninstallBoth exist, Intune resolves Required (Required and Available)
User Available without enrollmentUser Required and AvailableRequired and Available
User Available without enrollmentUser RequiredRequired
User Available without enrollmentUser AvailableAvailable
User Available without enrollmentDevice RequiredRequired and Available without enrollment
User Available without enrollmentDevice UninstallUninstall and Available without enrollment.
If the user didn't install the app from the Company Portal, the uninstall is honored.
If the user installs the app from the Company Portal, the install is prioritized over the uninstall.

Note

For managed iOS store apps only, when you add these apps to Microsoft Intune and assign them as Required, the apps are automatically created with both Required and Available intents.
iOS Store apps (not iOS/iPadOS VPP apps) that are targeted with required intent will be enforced on the device at the time of the device check-in and will also show in the Company Portal app.
When conflicts occur in Uninstall on device removal setting, the app is not removed from the device when the device is no longer managed.

Managed Google Play app deployment to unmanaged devices

For Android devices in a non-enrolled App Protection Policy Without Enrollment (APP-WE) deployment scenario, you can use Managed Google Play to deploy store apps and line-of-business (LOB) apps to users. Managed Google Play apps targeted as Available with or without enrollment will appear in the Play Store app on the end user's device, and not in the Company Portal app. End user will browse and install apps deployed in this manner from the Play app. Because the apps are being installed from managed Google Play, the end user will not need to alter their device settings to allow app installation from unknown sources, which means the devices will be more secure. If the app developer publishes a new version of an app to Play that was installed on a user's device, the app will be automatically updated by Play.

Steps to assign a Managed Google Play app to unmanaged devices:

  1. Connect your Intune tenant to managed Google Play. If you have already done this in order to manage Android Enterprise work profile, dedicated, or fully managed devices, you do not need to do it again.
  2. Add apps from managed Google Play to your Intune console.
  3. Target managed Google Play apps as Available with or without enrollment to the desired user group. Required and Uninstall app targeting are not supported for non-enrolled devices.
  4. Assign an App Protection Policy to the user group.
  5. The next time the end user opens the Company Portal app, they will see a message indicating that there are apps available for them in the Play Store app. The user can tap this notification to be brought directly to the Play app to see corporate apps, or they can navigate to the Play Store app separately.
  6. The end user can expand the context menu within the Play Store app and switch between their personal Google account (where they see their personal apps), and their work account (where they will see store and LOB apps targeted to them). End users install the apps by tapping Install in the Play Store app.
Apps

When an APP selective wipe is issued in the Intune console, the work account will be automatically removed from the Play Store app and the end user will from that point no longer see work apps in the Play Store app catalog. When the work account is removed from a device, apps installed from the Play Store will remain installed on the device and will not uninstall.

Mac

App uninstall setting for iOS managed apps

For iOS/iPadOS devices, you can choose what happens to managed apps on unenrolling the device from Intune or removing the management profile using Uninstall on device removal setting. This setting only applies to apps after the device is enrolled and apps are installed as managed. The setting cannot be configured for web apps or web links. Only data protected by Mobile Application Management (MAM) is removed after retirement by an App Selective Wipe.

Applescript tutorial. Default values for the setting are prepopulated for new assignments as follows:

Deploy Software To Mac Intune

iOS app typeDefault setting for 'Uninstall on device removal'
Line-of-business appYes
Store appNo
VPP appNo
Built-in appNo

Note

'Available' assignment types: If you're updating this setting for 'available for enrolled devices' or 'available with or without enrollment' groups, users who already have the managed app won't get the updated setting until they sync the device with Intune and re-install the app.

Pre-existing assignments: Assignments that existed prior to the introduction of this setting are unmodified and all managed apps will be removed on device removal from management.

Intune App Install

Next steps

Deploy Apps To Mac Intune

Accounting software for macs. To learn more about monitoring app assignments, see How to monitor apps.