> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Custom Apps Overview
> Overview of custom apps in Iru Endpoint for Mac and Windows. Learn about supported package formats, install scripts, deployment options, and versioning.
Custom App Library Items are available for Mac computers and Windows devices
Iru Endpoint lets you upload and deploy custom applications to your enrolled devices. Use the **Mac Custom App** Library Item for Mac computers or the **Windows Custom App** Library Item for Windows devices. Both let you choose whether to install once per device or continuously enforce the app, and both support a maximum upload size of **5 GB**.
### What Are Custom Apps?
Custom Apps are installer-based Library Items that you upload and configure in the Library. You assign them to Blueprints to deploy to Mac or Windows devices. Options include install once per device, continuous enforcement, or (on Mac) offering the app in Self Service.
### By Platform
Select your platform below for installer types, configuration options, and step-by-step guidance.
The **Mac Custom App** Library Item lets you deploy custom applications (PKG, DMG, ZIP) to Mac computers. Upload installers, configure audit and install options (including pre- and post-install scripts), and assign the Library Item to Blueprints. You can offer apps via Self Service or enforce them automatically at check-in. The sections below cover supported installer types, execution options, scripts, Self Service, and troubleshooting.
### Installers
Iru Endpoint supports several different installer types for Mac:
* **.PKG**: Iru Endpoint supports compressed PKG and MPKG files.
* **.ZIP**: With ZIP files, you can specify where the contents should be decompressed.
* **.DMG**: DMG files are extracted to the /Applications folder. If your DMG contains a PKG, extract the PKG first and upload that instead.
Iru Endpoint's maximum file upload size is 5 GB.
### Installation Options
#### Execution Frequency
Depending on the app you want to deploy, you can specify whether Iru Endpoint should install it once or continuously monitor and ensure it's installed.
* **Install once per device**: Iru Endpoint installs the Custom App once. If the app is removed from the Mac, it won't be reinstalled automatically. Use this for software patches that shouldn't run continuously.
* If a pre-install script fails, the Iru Agent won't attempt to install the Custom App, and it will run this Custom App Library Item again on the next check-in.
* If a post-install script fails, the Iru Agent will run this Custom App Library Item again on the next check-in, regardless of whether the Custom App was successfully installed.
* **Audit and enforce**: Iru Endpoint runs the audit script and ensures it passes (exits 0) at each check-in, including before the first install. If the audit script exits anything other than 0, Iru Endpoint reinstalls the application automatically.
* **Install on demand from Self Service**: The item is only offered as an optional install from Self Service. After execution, the **Install** button becomes **Reinstall**.
#### Audit Script Considerations
Audit scripts give you control over what qualifies as a pass. Does the app need to be in a specific location? Have a particular checksum? Be on a certain version? You can check all of these with an audit script.
Example: This audit script checks for the presence of an app; if it's not present, the script prompts Iru to reinstall it.
```bash audit-app-presence.sh icon="terminal" lines theme={null}
#!/bin/bash
APPPATH="/Applications/zoom.us.app"
if [ -e "$APPPATH" ]; then
exit 0
else
exit 1
fi
```
To enforce a specific version of an installed app, use the [Minimum Enforced Version script](https://github.com/kandji-inc/support/blob/main/Scripts/audit-enforce-scripts/minimum_enforced_version.zsh) available on our [Iru Support GitHub](https://github.com/kandji-inc/support/).
#### Pre- and Post-Install Scripts
Pre- and post-install scripts let you customize the install process for Custom Apps. Use a pre-install script to remove another app that's being replaced. A post-install script can configure the Custom App that was just installed.
#### Self Service Considerations
There are important considerations when using Custom Apps with Self Service.
* When a Custom App's enforcement option is set to **Install and continuously enforce** or **Install once per device**, you can still show this item in Self Service. This is useful if users need to reinstall the software.
* When a Custom App's **Enforcement** option is set to **Install on demand from Self Service**, the app won't be installed until the user installs it from Self Service.
* When installing via Self Service, the latest version of the app is installed.
* Iru Endpoint automatically takes over management of non-App Store licensed apps if set to **Install on demand from Self Service** (as long as the bundle ID matches the Apps and Books version). Your global or per-app update settings are respected.
#### Restart
Some applications require a reboot after installation to operate correctly. Iru Endpoint can trigger the restart to ensure proper functionality. Check the **Restart after successful install** box to have Iru Endpoint restart the computer after the Custom App is installed.
Users will be given a 30-minute countdown before the restart occurs.
#### Status
The status tab in a Custom App Library Item shows which Mac devices are waiting for the app to be installed, which ones have successful installations, and which ones are in **Error** status after installation problems. **Error** status generates an alert; see our [Global Alerts](/en/endpoint/devices/global-alerts) support article for details.
### Step-by-Step Instructions
For step-by-step instructions, see [Configure the Mac Custom App Library Item](/en/endpoint/library/library-items-profiles/configure-the-custom-apps-library-item).
### Troubleshooting
If the zip file contains a package and you see a Gatekeeper notification warning on a Mac during the custom app install process, run this command from a Terminal session on the package to clear the quarantine bit before zipping and uploading the install file to Iru.
```bash clear-quarantine.sh icon="terminal" theme={null}
xattr -dr com.apple.quarantine "/path/to/package.pkg"
```
The **Windows Custom App** Library Item lets you deploy and manage Windows applications (MSI, EXE) on Windows devices. Upload a zipped installer, configure install and uninstall commands, define detection logic, and assign the Library Item to Blueprints. The zipped installer can contain single files or directories of files. Enforcement begins within 15 minutes for online devices. All installers run in System context. The sections below cover installers, enforcement and detection settings, commands, architecture, security, and troubleshooting.
For what end users see when a **Windows Custom App** or **Auto App** install waits on running apps, including the tray close-app prompt, see [User Experience with Windows Apps](/en/endpoint/library/library-items-profiles/user-experience-with-windows-apps).
### Installers
Upload a **.zip** file containing the installer (MSI or EXE) and any supporting files or folders. The installer is downloaded to the device and expanded locally before the install command runs, so the install does not depend on network availability at execution time. Uploads are resumable; if a network interruption occurs, the upload picks up where it left off.
Iru Endpoint's maximum file upload size is 5 GB.
### Installation Options
Controls how Iru enforces the app on targeted devices.
* **Install once per device**: Iru installs the app on devices that do not already have it. Once installed, Iru does not reinstall the app if a user removes it manually.
* **Install and continuously enforce** (default): Iru installs the app and reinstalls it if it is removed or detected as absent at subsequent check-ins.
### Enforcement Timeframe
Controls whether this version of the app is enforced immediately or after a grace period. Set **Enforcement deadline** to one of the following:
* **Immediately** (default): The app is enforced as soon as possible after assignment. New installations begin within 15 minutes for online devices.
* **By enforcement deadline**: The app will try to install by the enforcement deadline if the app is not open. At the deadline, installation becomes required on devices that have not yet installed it.
When **By enforcement deadline** is selected, two additional fields appear:
* **Enforcement after version is saved**: How long after the Library Item is saved before enforcement begins. Default: **2 weeks**.
* **Enforcement deadline time**: The time of day when enforcement takes effect on the deadline date. Default: **12:00 PM (Noon)**.
### Application Details
* **Publisher**: The organization or individual that produced the application.
* **Name**: The display name for the application. Shown in the Library and in device status views.
* **Version**: A version string for this release of the app. Free-form text; not validated against semantic versioning.
* **App icon**: Upload a `.png` image to represent the app in the Library. Drag the file into the upload area or select **choose file**.
* **Upload app**: Upload a `.zip` file containing the installer and any supporting files or folders. Drag the file into the upload area or select **choose file**.
* The zip must contain the installer (MSI, EXE) along with any files your install command references.
* Structure the zip so that relative paths in your install command resolve correctly once the contents are expanded on the device.
### Detection Logic
Detection logic tells Iru whether the application is present on a device. At least one detection method is required. Iru runs detection when the agent checks in to determine whether the app needs to be installed or is already present.
Select a detection type from the **Detection logic rules** dropdown. Options appear top to bottom as **MSI**, **File**, **Folder**, then **Registry**.
#### MSI
Detects whether a specific MSI package is installed by its Product Code.
* **MSI product code**: The package Product Code as a braced GUID, `{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}`. The Web App validates the format. Find the code from MSI properties or documentation for the product.
* **Check MSI product version**: When **No**, only the Product Code is evaluated. When **Yes**, also compare the installed product version using an operator **equals** or **is greater than or equal to** and the version string you enter.
#### File
Detects using a file at a path you specify.
* **Path to file**: Full path to the file, including the file name (for example, `C:\Program Files\YourApp\YourApp.exe`).
* **Detection method**: Choose how the file is evaluated:
* **File exists**: Passes if the file is found at the specified path.
* **File does not exist**: Passes if the file is not found. Use for uninstall detection.
* **Version**: Passes if the file's version meets the comparison. Set the operator to **equals** or **is greater than or equal to**, then enter the version string.
* **Size in MB**: Passes if the file size in megabytes meets the comparison. Set the operator to **equals** or **is greater than or equal to**, then enter the size.
#### Folder
Detects using a folder at a path you specify.
* **Path to folder**: Full directory path where the folder is expected (for example, `C:\Program Files\YourApp`).
* **Detection method**:
* **Folder exists**: Passes if the folder is found at the specified path.
* **Folder does not exist**: Passes if the folder is not found.
#### Registry
Detects the app based on a registry key or value.
* **Key path**: Required. Full registry path to check (for example, `HKLM\SOFTWARE\YourApp`). Paths are not case-sensitive.
* **Value**: Optional registry value name within the key.
* **Detection method**:
* **Key exists**: Passes if the key exists. If you supplied a **Value**, the value must exist under that key.
* **String comparison**: Passes if the value at the key matches the string you supply.
### Executables for Open App Detection
* Enter one executable name per field (for example, `yourapp.exe`). Iru checks these processes when install or uninstall runs so users can be prompted to close them.
* Use **Add** for more rows and remove rows with the delete control when needed.
* Up to 100 executables can be entered.
### Commands
The Web App labels these **Install command line parameters** and **Uninstall command line parameters**. Enter silent install and silent uninstall command lines.
**Install command**
The full command line used to install the application silently. For MSI packages, a standard silent install looks like:
```powershell icon="terminal" theme={null}
msiexec /i yourapp.msi /qn
```
If your installer includes supporting files or folders inside the zip, reference them using relative paths. For example:
```powershell icon="terminal" theme={null}
msiexec /i lance.msi TRANSFORMS=".\mytransforms\transform.mst" /qn
```
You can run a PowerShell script from inside the zip instead of calling msiexec directly. The script must run the installer silently.
```powershell icon="terminal" theme={null}
.\installapp.ps1
```
**Uninstall command**
The full command line used to remove the application. For MSI packages:
```powershell icon="terminal" theme={null}
msiexec /x {ProductCode} /qn
```
If the path to the installer, uninstaller, or script in your install or uninstall command contains spaces, enclose that path in double quotes (for example, `"my installer.exe"`).
### Architecture
In **Architecture**, choose **x64** or **arm64** for the installer. When MSI metadata is available, Iru attempts to auto-detect the correct value. Confirm or override the selection before saving.
### Enforcement Behavior
* Enforcement begins within **15 minutes** of assignment for online devices. For new installs, this means the download process starts within that window; installation time depends on file size and device performance.
* If an install or uninstall fails, Iru retries every 15 minutes.
* The installer is not re-downloaded on retry unless the file on the server has changed.
* Removing the Library Item or removing the Blueprint assignment does **not** uninstall the app from devices. The app remains on the device; enforcement simply stops.
When install or uninstall failures generate alerts in Iru Endpoint, see our [Global Alerts](/en/endpoint/devices/global-alerts) support article for details.
### Security
* **Hash verification**: Iru verifies the SHA-256 hash of the installer before executing the install command. If the hash does not match, installation fails immediately.
* **Encrypted delivery**: Installer files are delivered over HTTPS. Only devices that are targeted by the Library Item can download the installer.
### Considerations
* Removing a Library Item or removing a Blueprint assignment does not uninstall the app. Apps remain on the device and are no longer enforced.
* The installer zip is expanded on the device before execution. Make sure relative paths in your install command match the folder structure inside your zip.
* If multiple apps are targeted to a device simultaneously, enforcement is queued. The 15-minute SLO applies to the first app in the queue beginning to download.
### Best Practices
For MSI-based installers, Product Code identifies the installed package regardless of install path.
Run your install and uninstall commands manually on a test device before uploading to Iru. Silent flags that work on one installer type may not work on another; validate before deploying to the fleet.
If your install command references supporting files using relative paths, make sure the zip folder structure matches those paths exactly. A mismatch causes the install to fail.
Assign the Library Item to a small Blueprint containing test devices before expanding to your full fleet. Verify installation, detection, and reporting all behave as expected.
Overly broad detection rules (for example, checking for a folder that multiple apps share) can lead to false positives. Use the most specific method available for detection.
### Step-by-Step Instructions
For step-by-step instructions, see [Configure the Windows Custom App Library Item](/en/endpoint/library/library-items-profiles/configure-the-windows-custom-app-library-item).
### Troubleshooting
**Possible causes:**
* Library Item not assigned to the device's Blueprint
* Target devices have not checked in recently
**Solutions:**
* Verify the Library Item is assigned to the correct Blueprint and that the target devices have checked in within the last 15 minutes
* Check the per-device status view for exit codes or error messages
Review the exit code in the per-device status view. Common MSI exit codes include:
* **1603**: Generic failure, often caused by the app already running, insufficient disk space, or a permissions issue.
* **1618**: Another installation is already in progress. The agent will retry.
* **1638**: A newer version of the app is already installed. Review your detection logic and upgrade path.
**Possible causes:**
* Detection rule does not match the actual installed state
* Incorrect Product Code, path, or registry value
**Solutions:**
* For MSI packages, verify the Product Code is correct
* For file or registry detection, confirm the path and value exactly as they appear after installation
### Related Articles
Step-by-step setup for Mac Custom Apps (PKG, DMG, ZIP)
Step-by-step setup for Windows Custom Apps (MSI, EXE)
Curate, create, and manage Library Items and add them to Blueprints
Configure Library Items for Self Service (macOS)
Configure how Iru Endpoint surfaces alerts when Custom Apps or other Library Items report issues