Skip to content
MDO Documentation

Deploying apps

MDO deploys Windows apps to Intune as Win32 apps, and Microsoft Store apps through Intune’s Store app type. Packaging runs on MDO’s Linux servers, so you don’t need a Windows machine to build packages.

Open Quick Deploy under Apps, with the target tenant selected in the tenant switcher, or click Deploy an app on the Apps page. The wizard has four steps: Search, Configure, Assignments and Confirm.

Search: pick a source

Section titled “Search: pick a source”
  • Quick Deploy: MDO’s catalog of common apps with PSADT presets. 157 can be deployed: 46 marked Core and 111 marked Catalog. Microsoft 365 Apps opens its own wizard (see below). Click Show unavailable to see the other 38 and why each one is listed as unavailable. Some install as Microsoft Store apps instead.
  • Winget: the community Winget index, about 11,900 apps.
  • Microsoft Store: Store apps, installed from the Store under the user’s context. Store apps have no package, PSADT or scripts.

Catalog apps that passed MDO’s lab test show Verified with the tested version and date on the Apps page once deployed. The test builds the same package, then installs, detects and uninstalls it on a clean Windows 11 VM.

Configure

Section titled “Configure”
  • Version: the latest version Winget lists, or any earlier one.
  • Wrap with PSADT is on by default. MDO wraps the installer in PSAppDeployToolkit 4.1.8 and applies your tenant’s branding if you uploaded it. Turn PSADT off to install the app directly. Without PSADT, only MSIs can be uninstalled.
  • Architecture and Max run time (min).
  • Device restart: No restart (default), or When the installer asks (3010, 1641).
  • Remove desktop shortcuts the install creates: on by default. It covers the Public Desktop.
  • Pre and post scripts: PowerShell that runs before and after the install, inside the PSADT package, up to 50 KB each.

How MDO builds the package

Section titled “How MDO builds the package”

MDO picks the installer from the Winget manifest, preferring machine-scope installers in this order: MSI, WiX, Burn, Inno, NSIS, then other EXEs.

  • Detection: MSIs are detected by their product code in the right registry view. Other installers get a detection script that checks both registry views.
  • Uninstall: every app gets a real uninstall command from the manifest.

MDO refuses what it can’t deploy properly, and says why:

  • per-user installers, which can’t run as SYSTEM;
  • MSIX outside the Microsoft Store;
  • portable and zip-only packages;
  • apps with no working uninstall, unless you tick Deploy without uninstall.

Assignments

Section titled “Assignments”

Choose groups for Required for, Available for and Uninstall for. Required and Available also offer All Users and All Devices, and each assignment can take an assignment filter. Nothing is assigned by default. With no groups, the app is uploaded without assignments.

Groups for each app

Section titled “Groups for each app”

If Create groups for each app is on in Settings › Apps (the default), the wizard shows Create groups for this app. MDO creates three Entra security groups named from the tenant’s pattern, by default App - {App} - {Intent}, for example App - 7-Zip - Required. It nests the groups you picked inside them, and assigns the app to the three groups. All Users and All Devices stay assigned directly.

Creating groups needs the Group.Create permission. Until the tenant has granted it, Settings › Connection shows it as Missing with a Re-consent button, and the wizard assigns your groups directly.

Confirm

Section titled “Confirm”

What MDO will build shows the installer and file, the install and uninstall commands and the detection rule before anything is downloaded. Anything MDO refuses shows in red, and Confirm and deploy stays disabled.

Microsoft 365 Apps

Section titled “Microsoft 365 Apps”

Microsoft 365 Apps in the Search step (or Deploy an app › Microsoft 365 Apps) opens its own wizard, with four steps:

  1. Office: the edition (preselected from the tenant’s licences), the update channel (Monthly Enterprise, Current or Semi-Annual), languages and the Office apps to include. Advanced has 32-bit, a fixed version, the company name, file formats and keeping MSI Visio or Project.
  2. Add-ons: Visio, Project and language packs, each built as its own Intune app. Advanced has proofing tools.
  3. Assign: for Core and each add-on, the same Required for, Available for and Uninstall for as any app, with groups or All users / All devices, exclusions and a filter, and per-app groups if they’re on. Core starts Required to All devices; add-ons start unassigned.
  4. Review and deploy: what MDO will install and remove, If Office is open on a device (close it without asking, try again later, or ask the user first with 3 deferrals), and each app’s configuration XML, read-only. Deploy queues one job.

MDO builds Office as a Win32 app. Before installing, it removes consumer and OEM Office that came with the device; next to a business Office (Microsoft 365 Apps, a paid Visio or Project, volume-licensed Office) only the consumer products are removed. Change the setup later on the app’s Configuration tab: MDO creates a new Intune app that supersedes the current one. When Core has Uninstall assignments, MDO warns that the add-ons stay on devices and offers to uninstall them for the same groups.

Following a deployment

Section titled “Following a deployment”

Open Deployments under Apps. Each deployment is a job with one of these statuses: queued, running, completed, failed, scheduled or cancelled. Click a job to follow its log live. When the job ends, it shows the duration and any error. A failed deployment removes the half-created app from Intune.

A completed job means the app is in Intune. Devices install it at their next Intune check-in, which can take from minutes to hours.

Next steps

Section titled “Next steps”