Overview of custom apps in Iru Endpoint for Mac and Windows. Learn about supported package formats, install scripts, deployment options, and versioning.
Use this file to discover all available pages before exploring further.
Custom App Library Items are available for Mac and Windows devices
Iru Endpoint lets you upload and deploy custom applications to your enrolled devices. Use the Mac Custom App Library Item for Mac computers or the Windows Custom App Library Item for Windows devices. Both let you choose whether to install once per device or continuously enforce the app, and both support a maximum upload size of 5 GB.
Custom Apps are installer-based Library Items that you upload and configure in the Library. You assign them to Blueprints to deploy to Mac or Windows devices. Options include install once per device, continuous enforcement, or (on Mac) offering the app in Self Service.
Select your platform below for installer types, configuration options, and step-by-step guidance.
Mac
Windows
The Mac Custom App Library Item lets you deploy custom applications (PKG, DMG, ZIP) to Mac computers. Upload installers, configure audit and install options (including pre- and post-install scripts), and assign the Library Item to Blueprints. You can offer apps via Self Service or enforce them automatically at check-in. The sections below cover supported installer types, execution options, scripts, Self Service, and troubleshooting.
Depending on the app you want to deploy, you can specify whether Iru Endpoint should install it once or continuously monitor and ensure it’s installed.
Install once per device: Iru Endpoint installs the Custom App once. If the app is removed from the Mac, it won’t be reinstalled automatically. Use this for software patches that shouldn’t run continuously.
If a pre-install script fails, the Iru Agent won’t attempt to install the Custom App, and it will run this Custom App Library Item again on the next check-in.
If a post-install script fails, the Iru Agent will run this Custom App Library Item again on the next check-in, regardless of whether the Custom App was successfully installed.
Audit and enforce: Iru Endpoint runs the audit script and ensures it passes (exits 0) at each check-in, including before the first install. If the audit script exits anything other than 0, Iru Endpoint reinstalls the application automatically.
Install on demand from Self Service: The item is only offered as an optional install from Self Service. After execution, the Install button becomes Reinstall.
Audit scripts give you control over what qualifies as a pass. Does the app need to be in a specific location? Have a particular checksum? Be on a certain version? You can check all of these with an audit script.Example: This audit script checks for the presence of an app; if it’s not present, the script prompts Iru to reinstall it.
Pre- and post-install scripts let you customize the install process for Custom Apps. Use a pre-install script to remove another app that’s being replaced. A post-install script can configure the Custom App that was just installed.
There are important considerations when using Custom Apps with Self Service.
When a Custom App’s enforcement option is set to Install and continuously enforce or Install once per device, you can still show this item in Self Service. This is useful if users need to reinstall the software.
When a Custom App’s Enforcement option is set to Install on demand from Self Service, the app won’t be installed until the user installs it from Self Service.
When installing via Self Service, the latest version of the app is installed.
Iru Endpoint automatically takes over management of non-App Store licensed apps if set to Install on demand from Self Service (as long as the bundle ID matches the Apps and Books version). Your global or per-app update settings are respected.
Some applications require a reboot after installation to operate correctly. Iru Endpoint can trigger the restart to ensure proper functionality. Check the Restart after successful install box to have Iru Endpoint restart the computer after the Custom App is installed.
Users will be given a 30-minute countdown before the restart occurs.
The status tab in a Custom App Library Item shows which Mac devices are waiting for the app to be installed, which ones have successful installations, and which ones are in Error status after installation problems. Error status generates an alert; see our Global Alerts support article for details.
If the zip file contains a package and you see a Gatekeeper notification warning on a Mac during the custom app install process, run this command from a Terminal session on the package to clear the quarantine bit before zipping and uploading the install file to Iru.
The Windows Custom App Library Item lets you deploy and manage Windows applications (MSI, EXE) on Windows devices. Upload a zipped installer, configure install and uninstall commands, define detection logic, and assign the Library Item to Blueprints. The zipped installer can contain single files or directories of files. Enforcement begins within 15 minutes for online devices. All installers run in System context. The sections below cover installers, enforcement and detection settings, commands, architecture, security, and troubleshooting.For what end users see when a Windows Custom App or Auto App install waits on running apps, including the tray close-app prompt, see User Experience with Windows Apps.
Upload a .zip file containing the installer (MSI or EXE) and any supporting files or folders. The installer is downloaded to the device and expanded locally before the install command runs, so the install does not depend on network availability at execution time. Uploads are resumable; if a network interruption occurs, the upload picks up where it left off.
Controls how Iru enforces the app on targeted devices.
Install once per device: Iru installs the app on devices that do not already have it. Once installed, Iru does not reinstall the app if a user removes it manually.
Install and continuously enforce (default): Iru installs the app and reinstalls it if it is removed or detected as absent at subsequent check-ins.
Controls whether this version of the app is enforced immediately or after a grace period. Set Enforcement deadline to one of the following:
Immediately (default): The app is enforced as soon as possible after assignment. New installations begin within 15 minutes for online devices.
By enforcement deadline: The app will try to install by the enforcement deadline if the app is not open. At the deadline, installation becomes required on devices that have not yet installed it.
When By enforcement deadline is selected, two additional fields appear:
Enforcement after version is saved: How long after the Library Item is saved before enforcement begins. Default: 2 weeks.
Enforcement deadline time: The time of day when enforcement takes effect on the deadline date. Default: 12:00 PM (Noon).
Detection logic tells Iru whether the application is present on a device. At least one detection method is required. Iru runs detection when the agent checks in to determine whether the app needs to be installed or is already present.Select a detection type from the Detection logic rules dropdown. Options appear top to bottom as MSI, File, Folder, then Registry.
Detects whether a specific MSI package is installed by its Product Code.
MSI product code: The package Product Code as a braced GUID, {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}. The Web App validates the format. Find the code from MSI properties or documentation for the product.
Check MSI product version: When No, only the Product Code is evaluated. When Yes, also compare the installed product version using an operator equals or is greater than or equal to and the version string you enter.
Enter one executable name per field (for example, yourapp.exe). Iru checks these processes when install or uninstall runs so users can be prompted to close them.
Use Add for more rows and remove rows with the delete control when needed.
The Web App labels these Install command line parameters and Uninstall command line parameters. Enter silent install and silent uninstall command lines.Install commandThe full command line used to install the application silently. For MSI packages, a standard silent install looks like:
msiexec /i yourapp.msi /qn
If your installer includes supporting files or folders inside the zip, reference them using relative paths. For example:
You can run a PowerShell script from inside the zip instead of calling msiexec directly. The script must run the installer silently.
.\installapp.ps1
Uninstall commandThe full command line used to remove the application. For MSI packages:
msiexec /x {ProductCode} /qn
If the path to the installer, uninstaller, or script in your install or uninstall command contains spaces, enclose that path in double quotes (for example, "my installer.exe").
In Architecture, choose x64 or arm64 for the installer. When MSI metadata is available, Iru attempts to auto-detect the correct value. Confirm or override the selection before saving.
Enforcement begins within 15 minutes of assignment for online devices. For new installs, this means the download process starts within that window; installation time depends on file size and device performance.
If an install or uninstall fails, Iru retries every 15 minutes.
The installer is not re-downloaded on retry unless the file on the server has changed.
Removing the Library Item or removing the Blueprint assignment does not uninstall the app from devices. The app remains on the device; enforcement simply stops.
When install or uninstall failures generate alerts in Iru Endpoint, see our Global Alerts support article for details.
Hash verification: Iru verifies the SHA-256 hash of the installer before executing the install command. If the hash does not match, installation fails immediately.
Encrypted delivery: Installer files are delivered over HTTPS. Only devices that are targeted by the Library Item can download the installer.
Removing a Library Item or removing a Blueprint assignment does not uninstall the app. Apps remain on the device and are no longer enforced.
The installer zip is expanded on the device before execution. Make sure relative paths in your install command match the folder structure inside your zip.
If multiple apps are targeted to a device simultaneously, enforcement is queued. The 15-minute SLO applies to the first app in the queue beginning to download.
For MSI-based installers, Product Code identifies the installed package regardless of install path.
Test your install and uninstall commands before deploying
Run your install and uninstall commands manually on a test device before uploading to Iru. Silent flags that work on one installer type may not work on another; validate before deploying to the fleet.
Structure your zip to match your command
If your install command references supporting files using relative paths, make sure the zip folder structure matches those paths exactly. A mismatch causes the install to fail.
Test on a pilot group first
Assign the Library Item to a small Blueprint containing test devices before expanding to your full fleet. Verify installation, detection, and reporting all behave as expected.
Keep detection specific
Overly broad detection rules (for example, checking for a folder that multiple apps share) can lead to false positives. Use the most specific method available for detection.
