Intune · Windows app · Version 1 (beta)
Package a Windows app and publish it for Intune, in one flow
AKC AppDeploy builds the .intunewin, fills in the install commands, detection, icon and Company Portal listing, uploads it and assigns it to your groups. It signs in with a least-privilege account and shows you every value before anything is sent.
Version 1, still in beta: every step works end to end, including new versions by supersedence. Updates install themselves when you next open the app. Talk to Andy about using it in your tenant.
How it works
From installer to Company Portal
The portal form, done for you. Every setting is filled in from the installer and stays editable.
- 1
Package
Choose an MSI or EXE, or a folder and its setup file. The .intunewin is built and checked for you, no command-line packager.
- 2
Install
The installer recognised (MSI, Inno, NSIS, WiX and more) with its silent switches, and a local test run that works out the uninstall.
- 3
Detection
MSI product code, file, registry or script, suggested from what the test install recorded.
- 4
Requirements
Processor, minimum Windows version, disk space and memory.
- 5
Listing
The Company Portal name, version, category, featured, links and the logo from the installer's own icon.
- 6
Assign
Type to search for groups, then Required, Available or Uninstall, with exclusions and deadlines.
- 7
Review and upload
Every value on one screen. Nothing goes to Intune until you upload.
What you get
Win32 apps in Intune, without the long form
No command-line packager, no hand-typed detection rules, and no app in Company Portal without its icon.
Least privilege
Built for the Intune Application Manager role. It checks the role and permissions you signed in with and says what's missing, rather than asking for Intune or Global Administrator.
Nothing hidden
Every value sent to Intune is on a review screen first: commands, detection, requirements, listing and assignments.
Native .intunewin
Zipped, encrypted and described exactly as the Microsoft packager does it, with a test that compares the two. A copy is kept locally.
Tested before it uploads
Run the install on a test PC or VM: AppDeploy reads what Windows recorded and fills in the uninstall command and detection, then tests the uninstall too.
Ready for Company Portal
The name, version, publisher, category and logo filled in from the installer, and assigned to your groups in the same upload.
New versions, superseded
Drop in the next installer and AppDeploy supersedes the previous version in Intune, with its assignments and auto-update for Company Portal installs. Or update in place, or change just a setting.
Repeatable
Save each app as a project: every setting carries over to the next version, and the project remembers the app in Intune.
No administrator rights on your PC
AppDeploy runs with your normal rights, so drag and drop works. It updates itself from downloads.andykemp.com, checked against a published SHA-256.
Get started
Download and run
Download AKC-AppDeploy.exe from downloads.andykemp.com and run it. There is nothing to install, and it doesn't need administrator rights. Keep it somewhere you can write to, such as a tools folder, and it updates itself.
- Windows 10 or 11 (x64)
- An Intune role that can create, update and assign apps (Application Manager)
- A Cloud Application Administrator, once per tenant, to set it up from the Tools menu
Questions
Frequently asked
What does version 1 do, and why is it still beta?
The full life of an app: packaging, installer recognition and a local test run, detection, requirements, the Company Portal listing, assignments, the upload, and new versions by supersedence or update in place. It stays labelled beta while it's proven on more tenants and the EXE gets code signing. Still to come: assignment filters, dependencies and PSADT wrapping. Each update installs itself when you next open the app.
Which permissions does it need?
An Intune role that can create, update and assign apps: Application Manager, or a custom role with those rights. A Cloud Application Administrator sets it up once per tenant from the Tools menu: AppDeploy creates its own app registration in your tenant, with consent to manage apps and read groups. Global Administrator isn't needed, and nothing depends on Andy Kemp Consulting's tenant. Sign-in is delegated, so AppDeploy can only do what your own account can.
Where do my sign-in tokens go?
Nowhere but your PC. Sign-in uses Microsoft's own sign-in library and its token cache. Tokens, upload addresses and encryption keys are never written to AppDeploy's logs. Nothing is sent to Andy Kemp Consulting.
Does it need administrator rights on my PC?
No. It runs with your normal rights. Only the optional local test run asks Windows for administrator rights, for the installer it runs. If you put the EXE in Program Files, updating it asks for administrator approval, because only administrators can write there.
Can our organisation turn the self-update off?
Yes. Set ManagedUpdates = 1 (a DWORD) under HKLM\SOFTWARE\Policies\Andy Kemp Consulting\AppDeploy and it never checks for or installs updates, so you can deploy new versions yourselves.
Is it free?
Yes. Download the single EXE and run it: there's nothing to install and no sign-up.
Related tools
Use it with
- Win11 Image PrepA Windows app that builds Windows 11 install media with your driver packs already in it: only the editions you deploy, built-in apps removed, unattended or Autopilot setup, and a bootable USB at the end. Try the live demo.
- Exchange Certificate ManagerA Windows app for Exchange Server certificates, URLs and domains: every certificate on every server, requests with the names read from Exchange, PFX import and deployment, every virtual directory URL set in one go, accepted domains and address policy changed in the right order, health checks with one-click fixes, and Let's Encrypt (HTTP or Cloudflare DNS) renewed by a gMSA. MSI installer, ready for Intune. Tour the screens.