Custom Apps Overview

Custom App Library Items are available for Mac computers and Windows computers

Iru Endpoint lets you upload and deploy custom applications to your enrolled devices. Use the Mac Custom App Library Item for Mac computers or the Windows Custom App Library Item for Windows computers. Both let you choose whether to install once per device or continuously enforce the app.

What Are Custom Apps?

Custom Apps are installer-based Library Items that you upload and configure in the Library. You assign them to Blueprints to deploy to Mac or Windows computers. Options include install once per device, continuous enforcement, or (on Mac) offering the app in Self Service.

By Platform

Select your platform below for installer types, configuration options, and step-by-step guidance.

Mac
Windows

The Mac Custom App Library Item lets you deploy custom applications (PKG, DMG, ZIP) to Mac computers. Upload installers, configure audit and install options (including pre- and post-install scripts), and assign the Library Item to Blueprints. You can offer apps via Self Service or enforce them automatically at check-in. The sections below cover supported installer types, execution options, scripts, Self Service, and troubleshooting.

Installers

Iru Endpoint supports several different installer types for Mac:

.PKG: Iru Endpoint supports compressed PKG and MPKG files.
.ZIP: With ZIP files, you can specify where the contents should be decompressed.
.DMG: DMG files are extracted to the /Applications folder. If your DMG contains a PKG, extract the PKG first and upload that instead.

The maximum file upload size for a Mac Custom App is 30 GB. A file larger than 30 GB is rejected before the upload starts.

You cannot save the Library Item until the file finishes uploading. If the upload stalls, it fails. Select Retry to try the upload again or Cancel to remove it.

Downloads 5 GB or larger

When a Mac gets an assigned Custom App that is 5 GB or larger during a check-in, the Iru Agent downloads it in the background. Other Library Items keep running. The app installs at the next check-in after the download finishes. If the network drops, the Mac sleeps, or the agent updates, the download resumes where it left off.This doesn’t apply to installs started from Self Service, apps installed during Liftoff, or priority installs. Those download and install in the same session, regardless of file size.If you remove the Mac from the Library Item’s scope while a download is in progress, the change takes effect at the Iru Agent’s next check-in.

Installation Options

Execution Frequency

Depending on the app you want to deploy, you can specify whether Iru Endpoint should install it once or continuously monitor and ensure it’s installed.

Install once per device: Iru Endpoint installs the Custom App once. If the app is removed from the Mac, it won’t be reinstalled automatically. Use this for software patches that shouldn’t run continuously.
- If a pre-install script fails, the Iru Agent won’t attempt to install the Custom App, and it will run this Custom App Library Item again on the next check-in.
- If a post-install script fails, the Iru Agent will run this Custom App Library Item again on the next check-in, regardless of whether the Custom App was successfully installed.
Audit and enforce: Iru Endpoint runs the audit script and ensures it passes (exits 0) at each check-in, including before the first install. If the audit script exits anything other than 0, Iru Endpoint reinstalls the application automatically.
Install on demand from Self Service: The item is only offered as an optional install from Self Service. After execution, the Install button becomes Reinstall.

Audit Script Considerations

Audit scripts give you control over what qualifies as a pass. Does the app need to be in a specific location? Have a particular checksum? Be on a certain version? You can check all of these with an audit script.Example: This audit script checks for the presence of an app; if it’s not present, the script prompts Iru to reinstall it.

audit-app-presence.sh

#!/bin/bash
APPPATH="/Applications/zoom.us.app"
if [ -e "$APPPATH" ]; then
exit 0
else
exit 1
fi

To enforce a specific version of an installed app, use the Minimum Enforced Version script available on our Iru Support GitHub.

Pre- and Post-Install Scripts

Pre- and post-install scripts let you customize the install process for Custom Apps. Use a pre-install script to remove another app that’s being replaced. A post-install script can configure the Custom App that was just installed.

Self Service Considerations

There are important considerations when using Custom Apps with Self Service.

When a Custom App’s enforcement option is set to Install and continuously enforce or Install once per device, you can still show this item in Self Service. This is useful if users need to reinstall the software.
When a Custom App’s Enforcement option is set to Install on demand from Self Service, the app won’t be installed until the user installs it from Self Service.
- When installing via Self Service, the latest version of the app is installed.
- Iru Endpoint automatically takes over management of non-App Store licensed apps if set to Install on demand from Self Service (as long as the bundle ID matches the Apps and Books version). Your global or per-app update settings are respected.

Restart

Some applications require a reboot after installation to operate correctly. Iru Endpoint can trigger the restart to ensure proper functionality. Check the Restart after successful install box to have Iru Endpoint restart the computer after the Custom App is installed.

Users will be given a 30-minute countdown before the restart occurs.

Liftoff Settings

At the bottom of the Mac Custom App, expand Advanced Settings. In Liftoff Settings, you will find Process this Library Item. This setting chooses when the app is installed relative to Iru Liftoff. It applies to Automated Device Enrollment and manual enrollment.

During Liftoff (default): The Custom App processes during Liftoff, and Liftoff does not complete until it finishes. It appears on the Install screen unless Hide in Liftoff is selected.
- Hide in Liftoff: If selected, this Library Item still processes during Liftoff but is not shown on the Install screen. While it processes, Liftoff shows Processing additional required configurations before proceeding… at the bottom of the screen. This setting does not affect ordering.
- Friendly name (optional): If specified, Liftoff shows this name instead of the Library Item Name. The Iru Agent still orders Library Items by Name during check-in.
After Liftoff: The Custom App does not process during Liftoff and does not appear on the Install screen. It installs on a later agent check-in.

A large Mac Custom App set to During Liftoff holds Liftoff until the download and install finish. To skip that item during Liftoff, select After Liftoff.

If this Custom App is also included in Install Library Items during Setup Assistant on the Automated Device Enrollment Library Item, it still installs during Setup Assistant. Process this Library Item does not change that install.

Status

The status tab in a Custom App Library Item shows which Mac devices are waiting for the app to be installed, which ones have successful installations, and which ones are in Error status after installation problems. Error status generates an alert; see our Global Alerts support article for details.

Step-by-Step Instructions

For step-by-step instructions, see Configure the Mac Custom App Library Item.

Troubleshooting

Upload fails or a file is rejected

A file larger than 30 GB is rejected before the upload starts.If an upload stalls, it fails. Select Retry or Cancel. Save stays unavailable until the upload finishes.

A download continues after the Mac is removed from scope

If you remove the Mac from the Library Item’s scope while a download is in progress, the change takes effect at the Iru Agent’s next check-in.

Gatekeeper warning when installing from a zip

If the zip file contains a package and you see a Gatekeeper notification warning on a Mac during the custom app install process, run this command from a Terminal session on the package to clear the quarantine bit before zipping and uploading the install file to Iru.

clear-quarantine.sh

xattr -dr com.apple.quarantine "/path/to/package.pkg"

The Windows Custom App Library Item lets you deploy and manage Windows applications (MSI, EXE) on Windows computers. Upload a zipped installer, configure install and uninstall commands, define detection logic, and assign the Library Item to Blueprints. The zipped installer can contain single files or directories of files. Enforcement begins within 15 minutes for online devices. All installers run in System context. The sections below cover installers, enforcement and detection settings, commands, architecture, security, and troubleshooting.For what end users see when pending Auto App or Windows Custom App updates are available, including the Iru system tray Updates list and when a running app must close first, see User Experience with Windows Apps.

Installers

Upload a .zip file containing the installer (MSI or EXE) and any supporting files or folders. The installer is downloaded to the device and expanded locally before the install command runs, so the install does not depend on network availability at execution time. Uploads are resumable; if a network interruption occurs, the upload picks up where it left off.

Iru Endpoint’s maximum file upload size is 5 GB.

Installation Options

Controls how Iru enforces the app on targeted devices.

Install once per device: Iru installs the app on devices that do not already have it. Once installed, Iru does not reinstall the app if a user removes it manually.
Install and continuously enforce (default): Iru installs the app and reinstalls it if it is removed or detected as absent at subsequent check-ins.

Enforcement Timeframe

Controls whether this version of the app is enforced immediately or after a grace period. Set Enforcement deadline to one of the following:

Immediately (default): The app is enforced as soon as possible after assignment. New installations begin within 15 minutes for online devices.
By enforcement deadline: The app will try to install by the enforcement deadline if the app is not open. At the deadline, installation becomes required on devices that have not yet installed it.

When By enforcement deadline is selected, two additional fields appear:

Enforcement after version is saved: How long after the Library Item is saved before enforcement begins. Default: 2 weeks.
Enforcement deadline time: The time of day when enforcement takes effect on the deadline date. Default: 12:00 PM (Noon).

Application Details

Publisher: The organization or individual that produced the application.
Name: The display name for the application. Shown in the Library and in device status views.
Version: A version string for this release of the app. Free-form text; not validated against semantic versioning.
App icon: Upload a .png image to represent the app in the Library. Drag the file into the upload area or select choose file.
Upload app: Upload a .zip file containing the installer and any supporting files or folders. Drag the file into the upload area or select choose file.
- The zip must contain the installer (MSI, EXE) along with any files your install command references.
- Structure the zip so that relative paths in your install command resolve correctly once the contents are expanded on the device.

Detection Logic

Detection logic tells Iru whether the application is present on a device. At least one detection method is required. Iru runs detection when the agent checks in to determine whether the app needs to be installed or is already present.Select a detection type from the Detection logic rules dropdown. Options appear top to bottom as MSI, File, Folder, then Registry.

MSI

Detects whether a specific MSI package is installed by its Product Code.

MSI product code: The package Product Code as a braced GUID, {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}. The Web App validates the format. Find the code from MSI properties or documentation for the product.
Check MSI product version: When No, only the Product Code is evaluated. When Yes, also compare the installed product version using an operator equals or is greater than or equal to and the version string you enter.

File

Detects using a file at a path you specify.

Path to file: Full path to the file, including the file name (for example, C:\Program Files\YourApp\YourApp.exe).
Detection method: Choose how the file is evaluated:
- File exists: Passes if the file is found at the specified path.
- File does not exist: Passes if the file is not found. Use for uninstall detection.
- Version: Passes if the file’s version meets the comparison. Set the operator to equals or is greater than or equal to, then enter the version string.
- Size in MB: Passes if the file size in megabytes meets the comparison. Set the operator to equals or is greater than or equal to, then enter the size.

Folder

Detects using a folder at a path you specify.

Path to folder: Full directory path where the folder is expected (for example, C:\Program Files\YourApp).
Detection method:
- Folder exists: Passes if the folder is found at the specified path.
- Folder does not exist: Passes if the folder is not found.

Registry

Detects the app based on a registry key or value.

Key path: Required. Full registry path to check (for example, HKLM\SOFTWARE\YourApp). Paths are not case-sensitive.
Value: Optional registry value name within the key.
Detection method:
- Key exists: Passes if the key exists. If you supplied a Value, the value must exist under that key.
- String comparison: Passes if the value at the key matches the string you supply.

Executables for Open App Detection

Enter one executable name per field (for example, yourapp.exe). Iru checks these processes when install or uninstall runs so users can be prompted to close them.
Use Add for more rows and remove rows with the delete control when needed.
Up to 100 executables can be entered.

Commands

The Web App labels these Install command line parameters and Uninstall command line parameters. Enter silent install and silent uninstall command lines.Install commandThe full command line used to install the application silently. For MSI packages, a standard silent install looks like:

msiexec /i yourapp.msi /qn

If your installer includes supporting files or folders inside the zip, reference them using relative paths. For example:

msiexec /i lance.msi TRANSFORMS=".\mytransforms\transform.mst" /qn

You can run a PowerShell script from inside the zip instead of calling msiexec directly. The script must run the installer silently.

.\installapp.ps1

Uninstall commandThe full command line used to remove the application. For MSI packages:

msiexec /x {ProductCode} /qn

If the path to the installer, uninstaller, or script in your install or uninstall command contains spaces, enclose that path in double quotes (for example, "my installer.exe").

Architecture

In Architecture, choose x64 or arm64 for the installer. When MSI metadata is available, Iru attempts to auto-detect the correct value. Confirm or override the selection before saving.

Enforcement Behavior

Enforcement begins within 15 minutes of assignment for online devices. For new installs, this means the download process starts within that window; installation time depends on file size and device performance.
If an install or uninstall fails, Iru retries every 15 minutes.
The installer is not re-downloaded on retry unless the file on the server has changed.
Removing the Library Item or removing the Blueprint assignment does not uninstall the app from devices. The app remains on the device; enforcement simply stops.

When install or uninstall failures generate alerts in Iru Endpoint, see our Global Alerts support article for details.

Security

Hash verification: Iru verifies the SHA-256 hash of the installer before executing the install command. If the hash does not match, installation fails immediately.
Encrypted delivery: Installer files are delivered over HTTPS. Only devices that are targeted by the Library Item can download the installer.

Considerations

Removing a Library Item or removing a Blueprint assignment does not uninstall the app. Apps remain on the device and are no longer enforced.
The installer zip is expanded on the device before execution. Make sure relative paths in your install command match the folder structure inside your zip.
If multiple apps are targeted to a device simultaneously, enforcement is queued. The 15-minute SLO applies to the first app in the queue beginning to download.

Best Practices

Use MSI detection for MSI packages

For MSI-based installers, Product Code identifies the installed package regardless of install path.

Test your install and uninstall commands before deploying

Run your install and uninstall commands manually on a test device before uploading to Iru. Silent flags that work on one installer type may not work on another; validate before deploying to the fleet.

Structure your zip to match your command

If your install command references supporting files using relative paths, make sure the zip folder structure matches those paths exactly. A mismatch causes the install to fail.

Test on a pilot group first

Assign the Library Item to a small Blueprint containing test devices before expanding to your full fleet. Verify installation, detection, and reporting all behave as expected.

Keep detection specific

Overly broad detection rules (for example, checking for a folder that multiple apps share) can lead to false positives. Use the most specific method available for detection.

Step-by-Step Instructions

For step-by-step instructions, see Configure the Windows Custom App Library Item.

Troubleshooting

App is not installing on targeted devices

Possible causes:

Library Item not assigned to the device’s Blueprint
Target devices have not checked in recently

Solutions:

Verify the Library Item is assigned to the correct Blueprint and that the target devices have checked in within the last 15 minutes
Check the per-device status view for exit codes or error messages

Installation fails with an error code

Review the exit code in the per-device status view. Common MSI exit codes include:

1603: Generic failure, often caused by the app already running, insufficient disk space, or a permissions issue.
1618: Another installation is already in progress. The agent will retry.
1638: A newer version of the app is already installed. Review your detection logic and upgrade path.

Detection is not matching after a successful install

Possible causes:

Detection rule does not match the actual installed state
Incorrect Product Code, path, or registry value

Solutions:

For MSI packages, verify the Product Code is correct
For file or registry detection, confirm the path and value exactly as they appear after installation

Configure the Mac Custom App Library Item

Step-by-step setup for Mac Custom Apps (PKG, DMG, ZIP)

Configure the Windows Custom App Library Item

Step-by-step setup for Windows Custom Apps (MSI, EXE)

Library Overview

Curate, create, and manage Library Items and add them to Blueprints

Self Service: Library Items

Configure Library Items for Self Service (macOS)

Global Alerts

Configure how Iru Endpoint surfaces alerts when Custom Apps or other Library Items report issues

​What Are Custom Apps?

​By Platform

​Installers

​Downloads 5 GB or larger

​Installation Options

​Execution Frequency

​Audit Script Considerations

​Pre- and Post-Install Scripts

​Self Service Considerations

​Restart

​Liftoff Settings

​Status

​Step-by-Step Instructions

​Troubleshooting

​Installers

​Installation Options

​Enforcement Timeframe

​Application Details

​Detection Logic

​MSI

​File

​Folder

​Registry

​Executables for Open App Detection

​Commands

​Architecture

​Enforcement Behavior

​Security

​Considerations

​Best Practices

Use MSI detection for MSI packages

Test your install and uninstall commands before deploying

Structure your zip to match your command

Test on a pilot group first

Keep detection specific

​Step-by-Step Instructions

​Troubleshooting

​Related Articles

Configure the Mac Custom App Library Item

Configure the Windows Custom App Library Item

Library Overview

Self Service: Library Items

Global Alerts

What Are Custom Apps?

By Platform

Installers

Downloads 5 GB or larger

Installation Options

Execution Frequency

Audit Script Considerations

Pre- and Post-Install Scripts

Self Service Considerations

Restart

Liftoff Settings

Status

Step-by-Step Instructions

Troubleshooting

Installers

Installation Options

Enforcement Timeframe

Application Details

Detection Logic

MSI

File

Folder

Registry

Executables for Open App Detection

Commands

Architecture

Enforcement Behavior

Security

Considerations

Best Practices

Step-by-Step Instructions

Troubleshooting

Related Articles