Sideload Windows Store Apps in Windows 8

Sideload Windows Store Apps in Windows 8 1. Introduction Windows Store apps bring a new dimension to the user experience, supporting multitouch and traditional keyboard and mouse user input. Organizations can create or purchase line-ofbusiness (LOB) apps for Windows 8 that use the new user interface (UI). But how do you deploy these apps? Do they need to be published in the Windows Store? Can you use existing deployment technologies and processes to deploy them? This guide shows how to deploy Windows 8 apps without using the Windows Store a technique called sideloading. Sideloading makes deploying and managing your own LOB apps easy. You can use deployment technologies that you are likely already familiar with to sideload apps, such as Windows PowerShell, the Microsoft Deployment Toolkit (MDT), System Center Configuration Manager, and Windows Intune. And you can select the level of automation that best fits your business and technical needs. You can deploy your apps to one individual on a device or to all users on a device. You can also deploy apps during the Windows 8 deployment process or after Windows 8 deployment to new or existing devices. The ultimate goal of this guide is to help you create an enterprise app store. An enterprise app store provides similar features to the Windows Store but is exclusive to your organization. You create such a store by using an electronic distribution system, such as Microsoft System Center Configuration Manager and Windows Intune. An enterprise app store allows you to manage the app through the entire software life cycle, including deployment, updates, supersedence, and uninstallation. Understanding Windows Store apps A Windows Store app is a new type of application that runs on Windows 8 devices, including devices running the Windows 8, Windows 8 Pro, and Windows RT operating systems. By default, a Windows Store app fills the entire screen to reduce distractions and simplify the user experience. As shown in Figure 1, Windows Store apps can support different layouts and views, such as landscape, portrait, and snapped. Figure 1. Windows Store app layouts and views Of course, you can obtain apps through the Windows Store. But what if you have an LOB app for Windows 8 that you have developed internally or purchased from an independent software vendor? How can you deploy the LOB app to users? Sideloading Windows Store Apps Page 1

You can use any combination of the following methods to deploy your Windows 8 apps to users: Through the Windows Store. If you want to target a broad set of users both inside and outside your organization, list your app in the Windows Store. Apps that you distribute through the Windows Store get all of the benefits of any other app in the store, including technical and content certification of the app, discoverability of the app on the Web, easy app updates to users, and telemetry and reporting on app acquisition. Sideloading. If you want to target users within your organization, you can sideload your apps. Sideloading allows you to distribute directly to the users in your organization. For apps that you distribute through sideloading, you will be responsible for validating and signing them, because sideloading bypasses the validation and signing requirements of the Windows Store. Also, you are responsible for deploying any app updates to your users. This guide focuses on sideloading Windows 8 apps. For more information about distributing apps through the Windows Store, see Windows Store apps. You can sideload your LOB apps by: Provisioning apps. This method allows you to deploy the app to all users on targeted devices and allows you to include one or more apps as a standard part of the user experience on the device. Only users who have administrative privileges can provision apps. Conceptually, these apps are similar to the Windows 8 built-in apps. Installing apps. This method allows you to deploy the app to individual users on targeted devices. Any user can install apps. Conceptually, these apps are similar to apps obtained through the Windows Store.. Sideloading Windows Store Apps Page 2

2. Prepare to Sideload Apps Before you start sideloading apps to your Windows 8 devices, make certain that your Windows 8 app is developed within the app guidelines, using the approved tools and methods. Also, ensure that your IT infrastructure and Windows 8 devices are configured to support app sideloading. App Evaluation Using a developer s license for Windows 8, you can install, develop, test, and evaluate your app. Sideload your app in your development environment by using the developer license on your development computer. The developer license is valid for only one computer for 30 days. When the developer license expires, you will not be able to run uncertified apps, but you can continue to run desktop apps or apps that were sideloaded onto your development computer. For more information about running and testing apps by using a developer license, see Get a developer license. App Sideloading Prerequisites Before you can sideload an app, make certain your app and Windows 8 devices are ready for sideloading by check for the following prerequisites: Installing or provisioning a sideloaded app. Before you can install or provision a sideloaded app, you must meet the prerequisites in Table 1. Prerequisite Description Ensure that the The devices that will run the app must trust the root certification certificate used for authority (CA) for the certificate you use for app signing. This is app signing is trusted. typically accomplished by signing the application with a certificate from a trusted CA or by adding the root CA to the trusted root in the certificate store on the targeted devices. You can deploy the certificate can be deployed by using Group Policy or through scripted methods, such as by using the certutil.exe tool. Enable the Allow all trusted applications to install Group Policy setting. This Group Policy setting must be enabled. For more information how to enable this setting, see the section, To set Group Policy for sideloading, in How to Add and Remove Apps. Table 1. Prerequisites for installing or provisioning a sideloaded app< Running a sideloaded app. After you install a sideloaded app on a device, the app tile on the Start screen will show an X in the bottom right corner of the tile until the device meets all sideloading requirements for running the app. The X indicates a problem that is preventing the app from running. Table 2lists the methods for running a sideloaded app. Sideloading Windows Store Apps Page 3

Method Description Join a domain. This method is only supported for the Windows 8 Enterprise operating system. Activate a sideloading key. This method is supported for Windows 8 Pro or Windows 8 Enterprise or Windows RT running on a device that is not domain joined. Activate a sideloading product key for each device. For more information about: o o Obtaining a sideloading product key, see the Windows 8 Volume Licensing Guide. Activating a sideloading product key, see Use a sideloading product activation key. Table 2. Methods for Running a Sideloaded App Sideloading Windows Store Apps Page 4

3. Sideload Apps for an Individual User You can install an app package (.appx file) on a per-user basis by using the Add- AppxPackage Windows PowerShell cmdlet. There is no limit to the number of apps you can add for each user by using this cmdlet. The Add-AppxPackage cmdlet and other app package management cmdlets are in the appx module, which must be loaded in Windows PowerShell before you can run any of the cmdlets. Load the appx module by running the following Windows PowerShell command: Import-Module appx When you install an app package, the Add-AppxPackage cmdlet can automatically add any other app packages required for app package installation by using the DependencyPath parameter, as shown in the following example: Add-AppxPackage -Path \\Server01\AppPackages\MyApp.appx DependencyPath \\Server01\AppPackages\winjs.appx You can specify multiple apps by specifying multiple DependencyPath parameters, as shown in the following example: Add-AppxPackage -Path \\Server01\AppPackages\MyApp.appx -DependencyPath \\Server01\AppPackages\Framework-x64.appx -DependencyPath \\Server01\AppPackages\Framework-x86.appx The Add-AppxPackage cmdlet displays the installation process. When installation is complete, go to the Start screen and click the app tile to start the app. You must run the Add-AppxPackage cmdlet for each user the first time they log on to a Window 8 device. If two users use the same device, you will need to run the Add- AppxPackage cmdlet for both users. You would typically run the Add-AppxPackage cmdlet as part of an automated software-distribution system or systems management product. Sideloading Windows Store Apps Page 5

4. Sideload Apps for All Users on a Device Apps installed in a Windows 8 image are called provisioned apps. Provisioned apps are injected in the image and are installed for every user the first time the user logs on. This is the preferred method for making an app available to all users on a device. Provisioned apps are specific to a device and do not roam with the user. You can only install 24 provisioned apps in an image. You can provision an app into any of the Windows 8 images image scenarios listed in Table 3. Scenario Description Online Use this scenario when modifying an installed Windows 8 image running on the target device. For this method, all users must be logged off of the targeted device before provisioning an app. Offline Use this scenario when modifying a Windows 8 image while running another operating system on the device, such as Windows Preinstallation Environment. Use this method to: Create custom images that can later be deployed by using any image-based deployment method Help ensure that no users are actively logged on to the image on the targeted device Table 3. Windows 8 Image Scenarios You can use either of the following methods to provision an app: Add apps to an online or offline Windows image by using the Deployment Image Servicing and Management (DISM) command-line tool or DISM Windows PowerShell cmdlets. Customize a deployed (online) Windows image by booting into audit mode and using the DISM app provisioning commands before you give the device to the user. For more information about audit mode, see Audit Mode Overview. For Windows images that have already been deployed, use the Add-AppxPackage cmdlet to deploy apps, as described in Sideloading an App for an Individual User. If you do use the DISM app provisioning commands on a deployed Windows image with active users, ensure that all users are logged off prior to using the DISM commands. Note: A device does not have to be joined to a domain or have an activated sideloading product key to install or provision LOB apps, but the apps will not run until the device meets the sideloading requirement. For more information, see Prepare to Sideload Apps. Sideloading Windows Store Apps Page 6

Use DISM Command Line to Provision an App for All Users You can provision an app for all users on a device by using the DISM command line (dism.exe). The DISM tool is included in Windows 8 and the Windows Server 2012 operating system and can provision apps in an offline or online Windows image. Use Windows PowerShell Cmdlets to Provision an App for All Users You can provision an app for all users on a device by using the Add- ProvisionedAppxPackage cmdlet. This and other DISM cmdlets are in the dism Windows PowerShell module, which must be loaded in Windows PowerShell before you can run any of the DISM cmdlets. The dism module is included in Windows 8 and Windows Server 2012. Load the dism module by running the following Windows PowerShell command: Import-Module dism Sideloading Windows Store Apps Page 7

5. Use a Sideloading Product Activation Key So, what do you do for computers that are not domain joined, such as in bring-your-owndevice scenarios? Or, what about Windows RT devices that cannot be joined to a domain? How do you sideload apps to those devices? The answer is to use a sideloading product activation key. A sideloading product activation key is a special type of volume license key assigned to a specific device. Sideloading product activation keys are necessary when either of the following scenarios is true: Devices running Windows 8 Pro or Windows 8 Enterprise are not domain joined. Devices running Windows RT cannot be domain joined. Note: If you sideload any apps before activating a sideloading product activation key, the app tile on the Start screen will show an X in the bottom right corner of the tile, and the app will not run You can enable sideloading for these scenarios by using the Windows Software Licensing Management Tool (Slmgr.vbs) and performing the following steps for each targeted device: 1. Obtain a sideloading product activation key for the device. For more information about how to obtain a sideloading product activation key, see the Windows 8 Volume Licensing Guide. 2. Add the sideloading product activation key to the device by running the following command from an elevated command prompt (where <sideloading product key> is the 25-digit sideloading product activation key): Slmgr /ipk <sideloading product key> 3. Activate the sideloading product activation key by running the following command from an elevated command prompt: Slmgr /ato ec67814b-30e6-4a50-bf7b-d55daf729d1e Note: The activation globally unique ID (GUID) is not the same as the sideloading product key. The activation GUID will always be ec67814b-30e6-4a50-bf7b-d55daf729d1e. Sideloading Windows Store Apps Page 8

6. Sideload Apps with System Center 2012 Configuration Manager Microsoft System Center 2012 Configuration Manager helps automate app sideloading after operating system deployment. You can only sideload apps during operating system deployment by using System Center 2012 Configuration Manager with Service Pack (SP) 1. Note: The prerequisites for using System Center Configuration Manger to sideload an app are the same for all other sideloading methods. For more information, see the app sideloading prerequisites section of Prepare to Sideload Apps earlier in this guide. You sideload apps during operating system deployment by using the application model and the operating system deployment features in System Center 2012 Configuration Manager with SP1. The application model in System Center 2012 Configuration Manager with SP1 is the preferred method for deploying apps. Step 1: Create a System Center 2012 Configuration Manager Application for the App Create a System Center 2012 Configuration Manager application by using the Create Application Wizard in the Configuration Manager console. On the General wizard page (shown in Figure 1), specify the type of application (in this case, a Windows app package) and the location of the application. Figure 1. General page in the Create Application Wizard The Create Application Wizard automatically knows how to deploy this application based on the type selected. Depending on the app, you can accept the default values on the remainder of the wizard pages, but the wizard also allows you to customize app configuration. You could also make these changes by selecting the Manually specify the application Sideloading Windows Store Apps Page 9

information option on the General wizard page. For more information on how to create an application in the Create Application Wizard automatically, see How to Create Applications in Configuration Manager. Step 2: Distribute the New Configuration Manager Application to the Distribution Points The newly created Configuration Manager application must be distributed to the distribution points so that clients are able to access the app. Distribute the new application as you would any other application by using the Distribute Content Wizard in the Configuration Manager console. Start the wizard by clicking Distribute Content on the Ribbon (shown in Figure 2). Ensure that you distribute the app to all the distribution point users and devices that will install the application use. This can also be done as part of the Deploy Software Wizard, which is discussed in the following step. Figure 2. Distribute Content button on the Ribbon in the Configuration Manager console Step 3: Deploy the App to Users and Devices After you distribute the application, deploy it to the desired user and device collection. Deploy the new Configuration Manager application as you would any other application by using the Deploy Software Wizard in the Configuration Manager console. Start the wizard by clicking Deploy on the Ribbon (as shown in Figure 3). Figure 3. Deploy button on the Ribbon in the Configuration Manager console You can deploy an app to any combination of user collections. Configuration Manager is not intended for use in deploying an app to a device collection. Note: Ensure that the application has been successfully copied to the desired distribution points before deploying the app to users and devices as a part of operating system deployment. Otherwise, the deployment will fail, because clients will be unable to access the app on the distribution points. Sideloading Windows Store Apps Page 10

For more information on how to create an application by using the Deploy Software Wizard automatically, see How to Deploy Applications in Configuration Manager. When these steps are complete, the application appears in the Application Catalog (as shown in Figure 4). The application will also be available for installation through Software Center. If the application is made mandatory, the Configuration Manager client can automatically initiate application installation. Figure 4. Sample application in the Application Catalog Sideloading Windows Store Apps Page 11

7. Sideload Apps with Windows Intune Sideloading an app by using Windows Intune is similar to doing so through System Center Configuration Manager. The biggest difference is that the deployment services are cloud based and available to any device that has Internet access. Note: Windows Intune can only deploy apps after operating system deployment. Currently, Windows Intune does not support operating system deployment scenarios. The prerequisites for using Windows Intune to sideload an app are the same as for all other sideloading methods for Windows 8. For Windows RT, Windows Intune also supports the ability to manage certificates and sideloading keys. For more information, see Prepare to Sideload Apps earlier in this guide. You can use Windows Intune only or integrate Windows Intune with System Center 2012 Configuration Manager with SP1 by using the Windows Intune connector, which allows you to manage your apps by using the Configuration Manager console. For more information on integrating Windows Intune with System Center 2012 Configuration Manager with SP1, see How to Manage Mobile Devices by Using Configuration Manager and Windows Intune. Step 1: Upload the App to Windows Intune Before you can deploy (sideload) your app to Windows Intune managed devices, upload the app into Windows Intune. Click the Step 1: Add software hyperlink in the Windows Intune Software workspace to upload software into Windows Intune (as show in Figure 1), which starts the Add Software Wizard. Figure 1. The Software workspace in Windows Intune On the Software setup wizard page, select the Windows app package software installer type and the local or Universal Naming Convention (UNC) path to the application (as shown in Figure 2). This process is similar to creating an application in System Center Configuration Manager. Sideloading Windows Store Apps Page 12

Figure 2. Software setup wizard page in the Add Software Wizard On the Software description wizard page (shown in Figure 3), specify the publisher, userfriendly name, and description of the app. You can optionally specify a URL for more information about the app and select a category for the app. Figure 3. Software description wizard page in the Add Software Wizard When the Add Software Wizard is complete, the app is listed in the Managed Software node in the Software workspace (shown in Figure 4). Now, the app is ready for deployment to users and devices that Windows Intune manages. Sideloading Windows Store Apps Page 13

Figure 4. Uploaded app in the Managed Software node in the Software workspace Step 2: Deploy the App to Windows Intune groups After the app is uploaded into Windows Intune, you can deploy it to Windows Intune groups. Windows Intune groups are similar to System Center Configuration Manager user and device collections: They can contain users or devices that Windows Intune manages. Click Manage Deployment in the Managed Software node in the Software workspace (as show in Figure 5), which starts the Deploy Software Wizard. Windows Intune supports deployment of Windows Store apps to users only, not to devices. Figure 5. The Manage Deployment button in the Windows Intune Managed Software node The Select Groups wizard page (illustrated in Figure 4) allows you to select the Windows Intune groups to which you want to deploy your app. You can base Windows Intune groups on a list of users and devices that Windows Intune manages or on security groups. In the example in Figure 6, the Marketing Windows Intune group was created based on a security group with the same name. This means that the app will be deployed to all members of the Marketing security group. Sideloading Windows Store Apps Page 14

Figure 6. The Select Groups wizard page in the Deploy Software Wizard On the Deployment Action wizard page (illustrated in Figure 7), select the appropriate installation approval for the app. To install the app, you can select Available Install or Required Install from the Approval list. The Available Install option makes the app available to the user, who can then elect to install the app. Note: Windows Intune supports the self-service model of deploying apps. It does not support pushing apps to users. Figure 7. The Deployment Action page in the Deploy Software Wizard When the Deploy Software Wizard is complete, the app appears in the Windows Intune Company Store. Users will be able to deploy the app to their devices directly from there. Sideloading Windows Store Apps Page 15

8. Sideload Apps with the Microsoft Deployment Toolkit The Microsoft Deployment Toolkit (MDT) allows you to sideload apps during operating system deployment. MDT supports the deployment technologies listed in Table 1, which you can use for different deployment infrastructures and scenarios. Note: In this guide, MDT refers to MDT 2012 Update 1 unless otherwise stated. Technology Description Lite Touch Installation (LTI) Zero Touch Installation User-Driven Installation (UDI) Requires minimal infrastructure and uses a wizard-driven UI to manage and perform deployments Allows you to specify configuration settings in advance or at the time of deployment Requires a System Center 2012 Configuration Manager with SP1 infrastructure to deploy and manage Windows 8 Requires that you specify all configuration settings in advance of deployment Requires a System Center 2012 Configuration Manager with SP1 infrastructure to deploy and manage Windows 8 Allows you to specify configuration settings in advance or at the time of deployment Table 1. MDT Deployment Technologies Note: LTI provides app provisioning capability only, while System Center 2012 Configuration Manager with SP1 and Windows Intune provide app installation capabilities. Provisioning is useful for operating system creation, while installation is part of an ongoing app management process. Sideload Apps in LTI Deployments LTI can sideload apps during operating system deployment by creating LTI applications, and then deploying those apps as a part of an LTI task sequence. You can make some apps mandatory while allowing users perming the deployment to select others by using the Deployment Wizard in LTI. Step 1: Create an LTI Application for the App Create an LTI application by using the New Application Wizard in the Deployment Workbench. On the Application Type wizard page (illustrated in Figure 1), specify the type of application (in this case, an application that has source files). Sideloading Windows Store Apps Page 16

Figure 1. The Application Type page in the New Application Wizard On the Details wizard page (illustrated in Figure 2), you enter the user-friendly name of the app and other, optional information. This name is what appears in the Deployment Workbench and the Deployment Wizard UIs. Figure 2. The Details page in the New Application Wizard On the Source wizard page (illustrated in Figure 3), enter the local or UNC path to the folder that contains the.appx file. This folder will be copied to the deployment share and accessible to the Deployment Wizard during Windows 8 deployment. Sideloading Windows Store Apps Page 17

Figure 3. The Source page in the New Application Wizard On the Destination wizard page (illustrated in Figure 4), specify the name of the folder in the deployment share where the app will stored. In most instances, you can simply accept the default value, which is the name you provided on the Details wizard page. Figure 4. The Destination page in the New Application Wizard The Command Details wizard page (illustrated in Figure 5) is where you specify the name of the.appx file. LTI automatically knows how to deploy the.appx file (based on the file extension) and uses DISM to inject (provision) the app into the deployed image. LTI will automatically set the Allow all trusted apps policy so that apps can be provisioned. LTI will also import any certificates (.cer files) found in the same folder as the app. The certificates must be trusted by the targeted devices. Figure 5. The Command Details page in the New Application Wizard Sideloading Windows Store Apps Page 18

Complete the wizard by accepting the default values. When you are done, the LTI application containing the app appears in the Deployment Workbench. If you want all users to interactively select the app from the Deployment Wizard while deploying Windows 8, no further configuration is necessary. If you want to automatically install the app without requiring users to select the app, you must select the Hide this application in the Deployment Wizard check box in the LTI application Properties dialog box (shown in Figure 6). Figure 6. The Hide this application in the Deployment Wizard check box Step 2: Deploy the LTI Application Two methods are available for deploying the app you created in step 1. The first lets users select the app on the Applications page in the Deployment Wizard during Windows 8 operating system deployment (as shown in Figure 7). This method is useful when the app is optional and you want the user deploying Windows 8 to be able to decide whether the targeted device requires the app. Sideloading Windows Store Apps Page 19

Figure 7. The Applications page in the Deploy Software Wizard The second method requires that you add a task sequence step to the LTI task sequence to deploy the app (as shown in Figure 8). You can modify the exiting Install Applications task sequence step or add a new Install Application task sequence step to deploy the app. The benefit of this method is that the app is automatically deployed without intervention from the user performing the deployment. This method is useful when the app is mandatory and you always want it deployed with Windows 8. Sideloading Windows Store Apps Page 20

Figure 8. The Install Application task sequence step in LTI task sequence Sideload Apps in UDI Deployments The UDI deployment technology in MDT uses System Center 2012 Configuration Manager with SP1 to deploy Windows 8 and corresponding apps. Like LTI, UDI provides the ability to manipulate configuration settings at the time of Windows 8 deployment, which means that you can allow users to select the apps to install as a part of the Windows 8 deployment process. UDI installs apps selected in the UDI Wizard that are also advertised to the users in the Application Catalog feature in System Center 2012 Configuration Manager with SP1. The UDI deployment process installs the User-Centric App Installer (AppInstall.exe) on the Windows 8 device during deployment. AppInstall.exe starts automatically when a primary user (configured with user device affinity) logs on. AppInstaller.exe connects to System Center 2012 Configuration Manager with SP1, reads the Application Catalog, and then installs apps as required. For more information on this process, see the section, User-Centric App Installer Reference, in the MDT document Toolkit Reference. In UDI, you configure the apps that can be deployed by customizing the Install Programs page in the UDI Wizard Designer (illustrated in Figure 9). Sideloading Windows Store Apps Page 21

Figure 9. The Install Programs page in the UDI Wizard Designer Before you can add an app to the Install Programs wizard page, create a System Center Configuration Manager application that contains the app. This process is identical to the process for creating a System Center Configuration Manager application described in Sideload Apps with System Center 2012 Configuration Manager. After you have created the System Center Configuration Manager application, add the application to the list of applications available in the UDI Wizard. Do so by searching for the applications available in the Configuration Manger site database (as illustrated in Figure 10). Figure 10. Search the Configuration Manager site database for applications After you add the application to the list of available software to install, select whether you want the application installed by default by selecting the check box next to the application (as shown in Figure 11). If you do not want the application installed by default, clear the check box. Sideloading Windows Store Apps Page 22

Figure 11. App in the list of software available in the UDI Wizard Designer Finally, when you use the UDI task sequence to deploy Windows 8, the UDI Wizard automatically starts. On the Install Programs page in the UDI Wizard, users can select the application for installation (as shown in Figure 12). The applications selected on this page are automatically deployed immediately after Windows 8 deployment is complete. Figure 12. App in the list of software available in the UDI Wizard Sideloading Windows Store Apps Page 23

9. Implement an Enterprise App Store Thus far, this guide has focused on sideloading apps to users and devices. But is that all there is to implementing an enterprise store? Sideloading is the first step in the software life cycle for the app. As with other types of software, there will be updates to the app and newer versions that supersede the older version of the app, and eventually the app will need to be removed from active use. In other words, to build an enterprise app store, you need to be able to manage the app throughout the entire software lifecycle. Of the technologies discussed, only System Center 2012 Configuration Manager with Service Pack 1 (SP1) and Windows Intune have the ability to manage an app after it is initially sideloaded. Both products have the ability to deploy updated versions of the same app, identify a different app that replaces the original app (supersedence), and uninstall the app when it is no longer supported. You can use System Center 2012 Configuration Manager with SP1 by itself or Windows Intune by itself, or you can integrate System Center 2012 Configuration Manager with SP1 with Windows Intune. To do so, use the Windows Intune connector in System Center 2012 Configuration Manager with SP1. This level of integration allows you to centrally manage users and devices in System Center Configuration 2012 Manager and Windows Intune. For more information about integrating System Center 2012 Configuration Manager with SP1 with Windows Intune, see How to Manage Mobile Devices by Using the Windows Intune Connector in Configuration Manager. Sideloading Windows Store Apps Page 24