Deploy apps to mobile devices

This page adds apps to the client’s app catalog and assigns them to devices enrolled in Outpost mobile device management. When you finish, the devices install, offer, or remove the apps you chose, and each device’s delivery timeline shows the result.

Before you begin

• The mdm:manage permission to manage the app catalog, and profile:manage to assign apps through a profile. See Roles and permissions.
• The devices are enrolled. See Enrollment methods.
• For Apple apps, the client’s Apps and Books content token, from Apple Business Manager. See Apple devices.
• For Android apps, the client is connected to Android Enterprise. See Android Enterprise.

App sources

One app catalog per client holds apps from every source:

Source	Platforms	How apps get into the catalog
Apple Apps and Books	iOS, iPadOS, macOS, tvOS	Import the apps the client has licenses for. Outpost assigns a license to each device that installs the app.
Managed Google Play	Android	Approve the app in Managed Google Play.
Microsoft Store	Windows	Add the app by its Store ID.
MSI package	Windows	Add the package’s download address and its SHA-256 hash. The package is checked against the hash before it installs.

Add apps to the catalog

1. Add the client’s apps from the sources you use:
   • Apple. Import the apps from the client’s Apps and Books token. Outpost syncs the token every hour.
   • Android. Approve apps in Managed Google Play from the console.
   • Windows. Add a Microsoft Store app or an MSI package.
2. Check the catalog. Each app appears once per source and platform.

Renew an Apps and Books token

A content token expires after a year, and each location needs its own. To renew one, download the new token for the same location from Apple Business Manager and upload it on Device management > Apple apps and books. Apple stops accepting the old token as soon as you download the new one. After the new token’s first sync, Outpost removes the old token for that location and moves the location’s apps to the new one.

Assign apps through a profile

Apps reach devices through the same profiles as every other setting, in the apps.managed setting.

1. Open or create a profile and add the apps.managed setting. See Create and assign a profile.

2. Add each app and choose its intent:

   Intent	What the device does
   required	Installs the app and keeps it installed.
   available	Offers the app for the user to install.
   uninstall	Removes the app.

3. Add managed configuration for the app, if it supports it.

4. Assign the profile to the devices.

When several profiles assign apps to the same device, Outpost combines their lists by app. When two profiles assign the same app, the higher-ranked profile’s entry wins.

Withdraw an app’s approval

Each app in Device management > App catalog is Approved or Not approved. Only approved apps are installed. To stop an app from reaching devices, open it and select Withdraw approval. Select Approve to allow it again.

Withdrawing approval always stops new installs. What happens on devices that already have the app depends on one setting:

Choice	What devices that have the app do
Stop new installs and leave it on devices that have it (default)	Keep the app.
Stop new installs and remove it from devices	Remove the app where the platform allows it: always on Android, and on Apple and Windows devices when Outpost installed it.

Your practice’s choice is under Device management > Approval settings, on the App approval card, in When an app’s approval is withdrawn. Changing it needs mdm:manage.

To make a different choice for one client, set mdm.unapproved_app_action in a profile for that client: hold keeps the app, remove removes it, and practice_default, the default, uses the practice’s choice. When profiles disagree, remove wins over hold, and either wins over practice_default.

An Android kiosk app, set with kiosk.app_id, follows the same rules as its entry in apps.managed. When an unapproved app is not installed on a device, or is removed from it, the device does not get it as its kiosk app either. A device that keeps the app under the keep choice keeps it as its kiosk app.

A device’s delivery timeline shows when an app was not installed because it is not approved, or could not be removed from that device.

Verify

Open the delivery timeline for a device in the profile’s scope. Each app shows its stages from queued through acknowledged. An app that failed to install shows a plain explanation and a suggested fix.

Next steps

• Profiles and policies
• What IT can see on enrolled devices