---
title: "Deploy apps to mobile devices"
description: "Add Apple Apps and Books, Managed Google Play, and Windows apps to one app catalog and assign them to MDM devices through profiles. In preview."
url: "https://support.outpostplatform.com/mdm/apps/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "MDM app deployment (preview). One app catalog per client holds Apple Apps and Books, Managed Google Play, Microsoft Store, and MSI apps, assigned through apps.managed as required, available, or uninstall. Only approved apps install; a withdrawn approval keeps or removes the app per Approval settings or mdm.unapproved_app_action. A renewed Apps and Books token replaces the old one."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "mdm:manage"
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/mdm/apps.md"
license: "CC BY 4.0"
---

# Deploy apps to mobile devices

This page adds apps to the client's app catalog and assigns them to devices
enrolled in Outpost [mobile device management](/mdm/). When you finish, the
devices install, offer, or remove the apps you chose, and each device's
delivery timeline shows the result.

## Before you begin

- The `mdm:manage` permission to manage the app catalog, and `profile:manage`
  to assign apps through a profile. See
  [Roles and permissions](/depot/roles-and-permissions/).
- The devices are enrolled. See [Enrollment methods](/mdm/enrollment/).
- For Apple apps, the client's Apps and Books content token, from Apple
  Business Manager. See [Apple devices](/mdm/apple/).
- For Android apps, the client is connected to Android Enterprise. See
  [Android Enterprise](/mdm/android/).

## App sources

One app catalog per client holds apps from every source:

| Source | Platforms | How apps get into the catalog |
| --- | --- | --- |
| Apple Apps and Books | iOS, iPadOS, macOS, tvOS | Import the apps the client has licenses for. Outpost assigns a license to each device that installs the app. |
| Managed Google Play | Android | Approve the app in Managed Google Play. |
| Microsoft Store | Windows | Add the app by its Store ID. |
| MSI package | Windows | Add the package's download address and its SHA-256 hash. The package is checked against the hash before it installs. |

## Add apps to the catalog

1. Add the client's apps from the sources you use:
   - **Apple.** Import the apps from the client's Apps and Books token.
     Outpost syncs the token every hour.
   - **Android.** Approve apps in Managed Google Play from the console.
   - **Windows.** Add a Microsoft Store app or an MSI package.
2. Check the catalog. Each app appears once per source and platform.

### Renew an Apps and Books token

A content token expires after a year, and each location needs its own. To
renew one, download the new token for the same location from Apple Business
Manager and upload it on **Device management** > **Apple apps and books**.
Apple stops accepting the old token as soon as you download the new one. After
the new token's first sync, Outpost removes the old token for that location
and moves the location's apps to the new one.

## Assign apps through a profile

Apps reach devices through the same [profiles](/automation/profiles/) as every
other setting, in the `apps.managed` setting.

1. Open or create a profile and add the `apps.managed` setting. See
   [Create and assign a profile](/automation/create-a-profile/).
2. Add each app and choose its intent:

   | Intent | What the device does |
   | --- | --- |
   | `required` | Installs the app and keeps it installed. |
   | `available` | Offers the app for the user to install. |
   | `uninstall` | Removes the app. |

3. Add managed configuration for the app, if it supports it.
4. Assign the profile to the devices.

When several profiles assign apps to the same device, Outpost combines their
lists by app. When two profiles assign the same app, the higher-ranked
profile's entry wins.

## Withdraw an app's approval

Each app in **Device management** > **App catalog** is **Approved** or **Not
approved**. Only approved apps are installed. To stop an app from reaching
devices, open it and select **Withdraw approval**. Select **Approve** to allow
it again.

Withdrawing approval always stops new installs. What happens on devices that
already have the app depends on one setting:

| Choice | What devices that have the app do |
| --- | --- |
| **Stop new installs and leave it on devices that have it (default)** | Keep the app. |
| **Stop new installs and remove it from devices** | Remove the app where the platform allows it: always on Android, and on Apple and Windows devices when Outpost installed it. |

Your practice's choice is under **Device management** > **Approval settings**,
on the **App approval** card, in **When an app's approval is withdrawn**.
Changing it needs `mdm:manage`.

To make a different choice for one client, set `mdm.unapproved_app_action` in
a profile for that client: `hold` keeps the app, `remove` removes it, and
`practice_default`, the default, uses the practice's choice. When profiles
disagree, `remove` wins over `hold`, and either wins over `practice_default`.

An Android kiosk app, set with `kiosk.app_id`, follows the same rules as its
entry in `apps.managed`. When an unapproved app is not installed on a device,
or is removed from it, the device does not get it as its kiosk app either. A
device that keeps the app under the keep choice keeps it as its kiosk app.

A device's delivery timeline shows when an app was not installed because it is
not approved, or could not be removed from that device.

## Verify

Open the delivery timeline for a device in the profile's scope. Each app shows
its stages from queued through acknowledged. An app that failed to install
shows a plain explanation and a suggested fix.

## Next steps

- [Profiles and policies](/automation/profiles/)
- [What IT can see on enrolled devices](/mdm/privacy/)