Deploy your own installers

The PowerShell tool can upload installers from your own machine or file share, for example an in-house app or a vendor package you are not allowed to redistribute. There are three ways, from most to least automated.

Option 1: app manifests in a folder

Write a JSON manifest per app, in the same format as the catalog, and point IntuneBrew at the folder with -LocalJsonDirectory. Each file is merged into the catalog under its file name, so corporate_app.json becomes the app corporate_app, and you can update it with -Upload and -UpdateAll like any catalog app.

{
  "name": "Corporate App",
  "description": "Internal tools for employees",
  "version": "2.4.1",
  "bundleId": "com.example.corporateapp",
  "fileName": "CorporateApp-2.4.1.pkg",
  "url": "file:///Users/Shared/Installers/CorporateApp-2.4.1.pkg",
  "sha": "<SHA256 of the installer>"
}

IntuneBrew -LocalJsonDirectory ./manifests -Upload corporate_app -ConfigFile ./certificate.json

• url is an absolute file URI, such as file:///C:/Packages/App.pkg on Windows. Encode spaces as %20.
• A relative URI such as file://./installers/App.pkg is resolved from the manifest's folder. .. is not allowed.
• A network path such as file://server/share/App.pkg needs -AllowNetworkPaths. On macOS you can use the mounted share's local path instead.
• sha, name, version, bundleId and a .pkg or .dmg fileName are required. Calculate the checksum with Get-FileHash ./CorporateApp-2.4.1.pkg -Algorithm SHA256.
• A manifest with the same name as a catalog app replaces that catalog app for the run.

Option 2: one installer without dialogs

./IntuneBrew.ps1 -LocalFilePath './Company VPN.pkg' `
  -LocalFileAppName 'Company VPN' -LocalFileVersion '1.2.3' `
  -LocalFileBundleID 'com.example.vpn' `
  -ConfigFile ./certificate.json -NonInteractive

Instead of the three app parameters you can pass -LocalFileConfig ./app.json with name, version, bundleId, description and an optional sha. Parameters you pass explicitly override the file.

If an app with the same display name exists in Intune, it is updated only when your version is newer. Add -UseExistingIntuneApp to upload into that app instead of creating a new one.

Option 3: pick a file interactively

On Windows, IntuneBrew -LocalFile opens a file picker and asks for the display name, version, bundle ID, description and an optional PNG logo. It always creates a new app.

Good to know

• IntuneBrew copies the installer to a temporary folder, checks the copy's checksum, and uploads the copy. Your original file is never changed or deleted.
• The bundle ID and version must match the app inside the installer, or Intune reports the app as not installed after a successful installation.
• New apps are not assigned to anyone. Assign them in Intune afterwards.
• IntuneBrew still needs internet access for sign-in, the catalog, and the upload to Intune.