Populating the iOS and macOS App Catalogs

You can search for iOS apps on the Apple App Store and add them to the App Catalog. You can also add your own in-house apps for iOS and macOS.

You can add apps to the App Catalog as follows:

Search for and import App Store apps for iOS.
Manually importing iOS apps from the Apple App Store
Use the app wizard to add apps from the iOS and macOS App Store.
Using the wizard to import iOS apps from the Apple App Store
Add in-house apps for iOS and macOS.
See Using the wizard to add an in-house iOS or macOS app to the App Catalog and Using the wizard to add an in-house macOS bundled app to the App Catalog.
Adding new versions of an existing iOS or macOS app

You can also remove iOS and macOS apps from the App Catalog, as described in this section.

Before you begin populating the App Catalog with in-house apps, you may find it useful to understand provisioning profiles, which allow apps to function (see Provisioning profiles for in-house iOS apps).

macOS apps

Currently, Apple does not support managed applications on macOS devices. You can, however, distribute Apple Licenses, macOS apps, in-house macOS apps, and web applications to macOS devices.

Related topics

Provisioning profiles for in-house iOS apps

You can distinguish app-specific provisioning profiles from wildcard provisioning profiles by examining the application identifier key value in the provisioning profile. App-specific provisioning profiles indicate the app in particular, whereas wildcard provisioning profiles have an asterisk, indicating a match with more than one app.

For example, the following application identifier key value indicates the provisioning profile is specific to an app signed by example.com:

<key>application-identifier</key>

<string>A1B2C3D4E5.com.example.webcontainer</string>

Conversely, the following application identifier key value indicates the provisioning profile is a wildcard profile, matching more than one app:

<key>application-identifier</key>

When adding in-house iOS apps to the App Catalog, the UI will indicate if the provisioning profile is expired, and therefore needs replacing.

If you need to update the provisioning profile for an app, keep in mind the following rules:

Table 1. Provisioning profile Types for apps

Provisioning profile type	Action	Result
App-specific	Update expired profile	Profile updated
Wildcard (*)	Update expired profile	New provisioning profile added
App-specific	New profile uploaded to replace expired profile	Ivanti EPMM removes the label from the app used with the expired provisioning profile (using a daily background job configured in the common.properties file).
Wildcard (*)	Profile matches an app name or UUID	Existing provisioning profile is attached to the app, and labels applied to the profile are also applied to the app.
Wildcard (*)	Profile does not match an app name or UUID	Ivanti EPMM adds a new provisioning profile to the app, and applies to the app those labels applied to the profile.

For information about adding iOS app provisioning profiles to Ivanti EPMM using the Ivanti EPMM Admin Portal, see “Provisioning profile settings” in the chapter “Managing Device Settings with Configurations” in the Ivanti EPMM Device Management Guide for iOS and macOS devices.

Manually importing iOS apps from the Apple App Store

You can manually import iOS from the Apple App Store directly into the App Catalog on Ivanti EPMM using Quick Import. This import configures the app with default app settings. You can later edit the app settings.

Procedure

In the Ivanti EPMM Admin Portal, go to Apps > App Catalog.
Click the Quick Import button.
Select iOS from the drop-down.
In the Application Name field, enter search text.
iTunes matches the text against app names, app IDs, app authors, and app descriptions.
From the App Store drop-down list, select the country for the App Store you want to search.
In the Limit field, enter the number of entries you want to retrieve.
To improve search performance, the default is set to 50. You can enter a number between 0 and 200.
Click Search.
The matching apps displays.

Figure 1. Search Results in App Store Search

Click the Import or Re-import link for an app to import the relevant information.
Import indicates an app that does not yet exist in the App Catalog.
Re-import indicates an app that exists in the App Catalog, which can be re-imported. A newer version may, or may not be available from the Apple App store.

You can import or update more than one app from the search results. Alternatively, you can run another search in the same dialog and import additional apps that way.

Close the dialog box by clicking OK.
The app displays in the App Catalog.
Click the application name to view the app details.
Click Edit to change the app settings.
Make any necessary changes to the default settings. The settings are described in detail in Using the wizard to import iOS apps from the Apple App Store.

When you import recommended apps from the Apple App Store that use licenses, clear the This App Store App is Free check box. This allows the device user to successfully download the app user licenses.

To apply a category, see Creating or changing a category for iOS and macOS apps.
To set per app VPN priority, see Setting per app VPN priority for iOS and macOS apps.

Per app VPN settings are not supported for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

To set managed app configurations, modify the default configuration settings as required by your environment. This section displays only for apps which support managed app configuration. Optionally, click Add+ to create alternative configuration settings with different values to apply to different devices based on labels.
See Managed App Configuration settings for iOS apps in the App Catalog.

Managed app configuration settings are not supported for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

Click Save.
Click the Back to list link to return to the App Catalog.
Select the app.
Click Actions > Apply To Label to set a label to the app in Apps@Work for devices associated with the label you select.

You can use the Add App Wizard to import and configure iOS App Store apps in the App Catalog (rather than accept the default app settings). When the wizard finishes running, the apps are ready to be applied to labels and sent to Apps@Work as necessary.

Although some settings listed here are supported by macOS apps, you cannot import public macOS apps directly into the App Catalog. Instead, use Apple Licenses to import macOS-licensed apps into Ivanti EPMM. You can also import in-house apps for macOS. However, you can still edit certain settings for macOS apps in Ivanti EPMM that are managed by Apple Licenses. These settings are noted in the following procedure.

Procedure

In the Ivanti EPMM Admin Portal, go to Apps > App Catalog.
Select iOS from the Platform list.
Click Add+.
Click iTunes.
To search for an app to import:
1. Enter the name of the app or its iTunes ID. See Getting the iTunes app ID for detailed instructions for getting the ID.
2. From the App Store drop-down list, select the App Store country.
3. Enter a limit for the number of search results (50 by default).
4. Click Search.
Select the app from the search results list.
Click Next. The Describe page displays.

Use the following guidelines to complete this screen:

Item	Description
Application Name	Required. Shows the name of the app. You can edit this field only if you opted to manually provide all app details. The app name can be up to 255 characters long.
Min. OS Version	Indicates the minimum version of iOS the app can support. This field is only displayed if the .ipa file of the app you are importing includes a minimum OS version number. Required. This field is not displayed for macOS apps.
Display Version	Displays the version number defined by the app developer. This is the version that displays to device users. This field is not editable.
Code Version	Displays the version defined for the package. This item is not editable.
Developer	Shows the name of the app developer. You can edit this field only if you opted to manually provide all app details.
Description	Enter any additional text that helps describe what the app is for. Device users can see this text in Apps@Work.
iPad Only	Indicates whether the app is designed only for iPad devices. This ensures that the app is not displayed in Apps@Work for other iOS devices. You can edit this field only if you opted to manually provide all app details. This field is not displayed for macOS apps.
Provisioning Profile	Auto-populated. A provisioning profile is a file containing verification information for an app. Apps are not usable on iOS without a current provisioning profile. There are two types of provisioning profile: app-specific, and wildcard, which works for more than one app. Provisioning profiles are required for distributing in-house apps through the Ivanti EPMM Admin Portal. For more information, see "Provisioning Profile settings" in the Ivanti EPMM Device Management Guide for iOS and macOS devices.
Category	Select one or more categories to display this app in a category tab in Apps@Work or add a new category. Click Add New Category to define new categories. Enter a category Name (up to 64 characters). Enter a Description (up to 255 characters). In the Category Icon section, click the Replace Icon button. Browse and select an icon that will represent this Category. Click Save.

Click Next.

Use the following guidelines to complete this screen:

Item	Description
Use Global App Config Settings Policy	Selecting the check box makes the policy settings take priority over the app settings if and only if the global policy is created and available for a particular device. Leaving the check box empty means the app's configuration settings will be used. For more information, see "Global App Config Settings policy" in the Ivanti EPMM Device Management Guide for iOS and macOS devices.
Apps@Work Catalog
This is a Free App	Selected by default, this indicates free recommended Apple App Store apps. iOS allows Managed App features to be applied to free apps and apps purchased with Apple License credits, but not to apps paid for by the user. Specifying whether the app is free ensures successful download of apps that require user payment. When importing recommended apps that use licenses, uncheck the This App Store App is Free option. This allows the device user to successfully download the app using licenses.
Hide this App from the Apps@Work catalog	Select to prevent this app from being displayed in Apps@Work. For example, you might want to hide apps that will be installed upon registration anyway. Hiding a mandatory app reduces clutter in Apps@Work, leaving device users with a concise menu of the approved apps they might find useful.
Feature this App in the Apps@Work Catalog	Select if you want to highlight this app in the Featured apps list.
Featured Banner	Select to add the app to the featured banner at the top of the Apps@Work home screen on devices. Additional options display: Short Description - Enter a short description that will display in the banner. The Preview will display what it will look like on the client. Banner Style - Select the Light Banner Style option. You can see what your banner will look like in the Preview. The Dark, Blue, Green and Orange options will work in a later release. Allow app downloads over insecure networks - Select the check box if you are providing an Override URL (next field) that uses the HTTP URL scheme instead of HTTPS. Override URLs are intended for use behind a firewall, using a trusted and secure internal network. Before you use an HTTP URL, make sure you understand the risks of using an insecure connection Override URL - If you are using an alternate source for downloading in-house apps, enter that URL here. The URL must point to the in-house app in its alternate location. Override URLs are intended for use behind a firewall, using a trusted and secure internal network. Manual synchronization is required with the alternate HTTP server on which app are stored. See Override for in-house app URLs for the requirements for this configuration before using it. When tapping the banner, device users see the details of the featured app. Add as many apps as you like to the featured banner, but the featured banner will only display the five most recent apps added to the featured banner. Apps in the featured banner are rotated every five seconds.
Disable App Delivery Network for this App	Selected by default, this field only displays when administrators have enabled CDN in Ivanti EPMM. Applicable to in-house apps only.
App Icon	Required. The app icon is automatically extracted from the IPA file. The file must be in PNG format. Click Replace Icon to replace the icon.
iPhone Screenshots	Click Upload to add a an iPhone screenshot. Select up to twelve optional screenshots to display for the app. Screenshots must be in JPG, PNG, or GIF format, with a minimum size of 320x480 pixels or 480x320 pixels, and a maximum size of 4096x4096 pixels. Click Remove to delete a screenshot. The display of rotated screenshots in the Ivanti EPMM Admin Portal might not be consistent with the display on devices.
iPad Screenshots	Click Upload to add a screenshot. Select up to twelve optional screenshots to display for the app. Screenshots must be in JPG, PNG, or GIF format. Each file must have a minimum size of 1024x768 or 768x1024 pixels, and a maximum size of 4096x4096 pixels. Click Remove to delete a screenshot. For macOS apps, follow the instructions for iPad Screenshots.

Click Next.

Use the following guidelines to complete this screen:

Item

Description

Data Protection Required

Be aware that if Data Protection Required is enabled, users on devices with no passcode set will not see this or any other lower versions of this app on Apps@Work. Devices with no passcode sest will not get this app installed on registration or converted from unmanaged to managed, if applicable.

Per App VPN Settings

Per App VPN by Label Only

To apply a Per-App VPN by Label Only for this application, keep this option checked and then select one of the pre-configured Per-App VPNs listed in the VPN Selection section below. Ivanti does not recommend de-selecting Per-App VPN by Label Only, as this field will be deprecated in future Ivanti EPMM releases and become selected by default.

Ivanti does not recommend using Per App VPN with apps that utilize device spaces.

This feature is not currently supported on macOS devices.

VPN selection

In the left-hand column, select the VPN setting you created for per app VPN, and click the right arrow to move it to the set of selected VPNs in the right-hand column. If the app will use Tunnel, select the Tunnel VPN setting you created. You can select multiple per app VPN settings.

To reorder the selected per app VPN configurations in the right-hand column, use the up and down arrows to sort the names in the list.

See VPN settings in the Ivanti EPMM Device Management Guide for iOS and macOS devices for information on creating a per app VPN or Tunnel VPN setting.

This feature is not currently supported on macOS devices.

Per app VPN settings are not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

License Required

Per-App VPN is supported only in iOS 7.0 and later and macOS 10.9 and later.

Per-App VPN type IKEv2 (for iOS) is only supported in iOS 9.0 and above.

DNS Proxy Filter Setting

As the Ivanti EPMM administrator, you can configure DNS Proxy settings using the DNS Proxy Configuration for users of iPhone and iPad devices. You can use the DNS Proxy payload to specify the application that provides the DNS proxy network extension and other vendor-specific values.

See Setting DNS proxy for iOS and macOS apps.

See also: Creating DNS Proxy Configurations in the Ivanti EPMM Device Management Guide for iOS and macOS devices

Associated Domains (Associated Domains (iOS 13 and later)

Applicable to MDM devices only. Connections to servers within one of these domains are associated with the per-app VPN.

Associated Domain

Description

Add+

Managed App Settings

Prevent backup of the app data

Select to ensure that iTunes will not attempt to back up possibly sensitive data associated with the given app.

This setting is not displayed for macOS apps. It is also not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

Remove app when device is quarantined or signed out

Select to enable configured compliance actions to remove the app if a policy violation results in a quarantined device or the device signs out in multi-user mode.

To enable this feature, you must also configure a corresponding compliance action, and security policy with that compliance action selected. Once the device is no longer quarantined, the app can be downloaded again.

If you change the setting after the app is added, the changed setting will not be applied to the app.
This setting is not displayed for macOS apps. It is also not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

For more information, see "Using Secure Sign-In and Sign-Out" in theIvanti EPMM Device Management Guide for iOS and macOS devices.

Send installation request on device registration or sign in

Select to send a installation request upon device registration or sign-in. If the app is already installed on the device, Ivanti EPMM will do nothing. Deselected by default.

If you selected Await device configuration during Apple device enrollment in the Enrollment profile, then Select installation request on device registration or sign in must also be selected.

For User Enrollment and Shared iPad devices for Apple Business Manager, this field will only send installation request on device registration or sign-in. Only Apple-licensed apps are sent to Shared iPad devices through registration. For more information, see theIvanti EPMM Device Management Guide for iOS and macOS devices.

Send installation request to quarantine devices

Select to send an installation request to quarantine devices. Deselected by default.

Send convert unmanaged to managed app request on device registration or sign-in (iOS 9 or later)

Select this option to allow administrators to specify if app can be converted during installation request sent on device registration or sign-in, or check-in. Also allows device users to convert app in Apps@Work from unmanaged to managed without having to uninstall and reinstall the app. Prompts unsupervised devices to accept the conversion, and silently updates supervised iOS 9 or later devices.

If the app is already installed as an unmanaged app, the app will be converted to an iOS managed app.

This setting is not selected by default.

This setting is not displayed for macOS apps. It is also not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.
With this setting selected, a MDM profile re-push will cause apps to be re-installed.

•

User Enrollment cannot convert unmanaged to managed apps. See Ivanti EPMM Device Management Guide for iOS and macOS devicesfor more information.

Send convert unmanaged to managed app request to quarantine devices (iOS 9 or later)

Select this option to enable the following on quarantined devices (for iOS apps only):

Prompt the device user to install the app.
If the app is already installed as an unmanaged app, convert the app to an iOS managed app.
These settings are applied even if a compliance action blocks new app downloads for a quarantined device.
This setting is not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

Enforce conversion from unmanaged to managed app (iOS 9 or later)

Every hour, Ivanti EPMM reviews the all the devices that had last checked-in for any unmanaged apps and, if applicable, sends the unmanaged to managed app conversion request to that device. If there is an unmanaged app installed on the device, device users will not immediately get the prompt for change management.

Also applicable if the app is unmanaged on an iOS 9 and later device and the app is enabled to allow conversion.

Advanced Settings

Remove app when MDM profile is removed

Select this option to remove this app from the device when the MDM profile is removed from the device.

This setting is not displayed for macOS apps. It is also not displayed for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

Prevent user from removing and offloading app

Select this option to prevent device users from removing and uninstalling the managed app (for example, Ivanti Mobile@Work.) It also prevents the OS from automatically offloading apps that are not being used. When the device user tries to uninstall the app, a pop-up will state: "Uninstall Not Allowed - It is not possible to uninstall this app at this time."

De-select to allow the device users to remove and uninstall the app.

Applicable to iOS 14.0 or newer versions.

Managed App Configurations

This section displays only for apps that support managed app configuration.

Modify the default configuration settings as required by your environment. Optionally, click Add+ to create alternative configuration settings with different values to apply to different devices based on labels.

See Managed App Configuration settings for iOS apps in the App Catalog.

Managed app configurations are not supported for iOS apps when Ivanti EPMM is configured for MAM-only iOS devices.

Click Finish.
The app displays in the App Catalog.
Associate the app with a label to list the app on iOS devices.

Related topics

Next steps

Continue on to Making iOS and macOS apps available to users in Apps@Work.

Getting the iTunes app ID

To manually configure a managed app in the Add App Wizard, you must supply the ID for the app as defined in iTunes. However, IDs are not always readily available.

Procedure

Open iTunes.
Navigate to the iTunes Store.
Navigate to the App Store.

Locate the app you want to configure.

Open a text editor.
Right-click the app icon, and select Copy Link.
For example, using Firefox, you can right-click on the icon and select Copy Link.
Paste the link into the text editor.
In the below example, the URL was pasted into Notepad. The application ID (selected) comprises the digits following “id” and before “?mt=8”.

Using the wizard to add an in-house iOS or macOS app to the App Catalog

You can use the Add App Wizard to import into the App Catalog in-house iOS and macOS apps developed by your organization. An enterprise-level Apple Developer account is required for developing in-house iOS and macOS apps.

Each in-house app for iOS must be no larger than 5 GB. Individual downloads of iOS in-house apps over 3G are generally limited to 20 MB per device. Use Wi-Fi to download larger in-house apps.

IMPORTANT: When developing an in-house iOS app to be used with Ivanti EPMM, you must include the following keys in the info .plist file for the in-house app:

CFBundleName or CFBundleDisplayName
CFBundleIdentifier
CFBundleExecutable
CFBundleVersion
CFBundleShortVersionString

If you are adding a new version of an existing app, see Adding new versions of an existing iOS or macOS app .

Procedure

Follow the steps listed in Using the wizard to import iOS apps from the Apple App Store.

Next steps

Making iOS and macOS apps available to users in Apps@Work

Related topics

Developing in-house iOS apps, see the Apple enterprise developer site at
Apple Developer Enterprise https://developer.apple.com/enterprise/
Building, signing, uploading, installing, and launching in-house apps, see this knowledge base article:
AppSanity: Troubleshooting In-House iOS App Build, Signing, Upload, Install, and Launch Issues

Using the wizard to add an in-house macOS bundled app to the App Catalog

You can use the Add App Wizard to import into the App Catalog signed, in-house, bundled macOS apps. An enterprise-level Apple Developer account is required for developing in-house macOS apps.

If you are adding a new version of an existing app, see Adding new versions of an existing iOS or macOS app .

Procedure

In the Ivanti EPMM Admin Portal, go to Apps > App Catalog.
Select macOS from the Platform list.
Click Add+.
The Add App Wizard opens.
Click In-House.
Click Browse and navigate to the in-house bundled macOS app you want to upload.

Click Next.

Item	Description
Application Name	Displays the app name defined for the app bundle (up to 255 characters long). App names longer than 255 characters will be truncated when displayed on the device. A macOS app is packaged as a bundle. A bundle is a directory in the file system that groups related resources together in one place. A macOS app bundle contains the app executable file and supporting resource files such as app icons, image files, and localized content.
Display Version	Shows the version number displayed to users. The value of this field is a number with or without a period. This value cannot be edited.
Developer	Enter the name of the app developer.
Description	Enter any additional text that describes the app.
Category	Select one or more categories if you would like this app to be displayed in a specific group of apps on the device. Click Add New Category to define new categories. Enter a category Name (up to 64 characters). Enter a Description (up to 255 characters). In the Category Icon section, click the Replace Icon button. Browse and select an icon that will represent this Category. Click Save. See Creating or changing a category for iOS and macOS apps for more information.

Click Next.

Use the following guidelines to complete this screen:

Item	Description
Apps@Work Catalog
Hide this App from the Apps@Work catalog	Select to prevent this app from being displayed in Apps@Work. For example, you might want to hide apps that will be installed upon registration anyway. Hiding a mandatory app reduces clutter in Apps@Work, leaving device users with a concise menu of the approved apps they might find useful.
Feature this App in the Apps@Work Catalog	Select if you want to highlight this app in the Featured apps list.
Featured Banner	Select to add the app to the featured banner at the top of the Apps@Work home screen on devices. When clicking the banner, device users see the details of the featured app. Add as many apps as you like to the featured banner, but the featured banner will only display the five most recent apps added to the featured banner. Apps in the featured banner are rotated every five seconds.
Allow app downloads over insecure networks	Select this if you are providing an Override URL (next field) that uses the HTTP URL scheme instead of HTTPS. Override URLs are intended for use behind a firewall, using a trusted and secure internal network. Before you use an HTTP URL, make sure you understand the risks of using an insecure connection.
Override URL	If you are using an alternate source for downloading in-house apps, enter that URL here. The URL must point to the in-house app in its alternate location. Override URLs are intended for use behind a firewall, using a trusted and secure internal network. Manual synchronization is required with the alternate HTTP server on which app are stored. See Override for in-house app URLs for the requirements for this configuration before using it.
Disable App Delivery Network for this App	Selected by default, this field only displays when administrators have enabled CDN in Ivanti EPMM. Applicable to in-house apps only.
Icon and Screenshots
App Icon	Required. The app icon is automatically extracted from the IPA file. The file must be in PNG format. Click Replace Icon to replace the icon.
Screenshots	Select up to twelve optional screenshots to display for the app. Screenshots must be in JPG, PNG, or GIF format. Each file must have a minimum size of 1024x768 or 768x1024 pixels, and a maximum size of 4096x4096 pixels. Click Upload to add a screenshot.

Click Next.

Use the following guidelines to complete this page:

Item	Description
Send installation request on device registration	Select this option to prompt macOS device users to install this app after device registration is complete. If you selected Await device configuration during Apple device enrollment in the Enrollment profile, then Select installation request on device registration or sign in must also be selected. If using Ivanti Mobile@Work 1.4 for macOS, it is recommended you select this check box.
Per App VPN Settings
Per App VPN by Label Only	To apply a Per-App VPN by Label Only for this application, keep this option checked and then select one of the pre-configured Per-App VPNs listed in the VPN Selection section below. Ivanti does not recommended de-selecting Per-App VPN by Label Only, as this field will be deprecated in future Ivanti EPMM releases and become selected by default. Ivanti does not recommend using Per App VPN with apps that utilize device spaces. See VPN settings in the Ivanti EPMM Device Management Guide for iOS and macOS devices for information on creating a per app VPN or Tunnel VPN setting.

Click Finish.
The app bundle displays in the App Catalog.
Associate the app with a label to list the app on macOS devices.
In the Apply to Labels dialog box, select the check box next to the app's name. Click in the Mandatory field, a drop-down displays. Selecting Yes makes the selected app mandatory; leaving it to the default No makes the app optional.

Next steps

Adding new versions of an existing iOS or macOS app

When uploading a newer version of an app, an extra page opens to allow you to select whether to keep the app's old version information or to adopt the information from the app's new version. This feature is applicable to iOS and macOS in-house / private / self-hosted apps.

Procedure

In the App Catalog, click the Add+ button.
The Add App Wizard opens.
Click In-House.
Click Browse and navigate to the in-house iOS or bundled macOS app you want to upload.
Click Next.
The An earlier version of this App exists page opens.
Select an option:
- Another version of this App was previously uploaded. Reuse its description, icon and screenshot(s). If the Description, Icon or Screenshot fields of the new app are empty, then the system will populate those fields with information from the previous app version (default).
- Upload a new description, icon or screen shot. Information related to the Description, Icon or Screenshot fields of the new App will be utilized. If those fields are empty, nothing will be copied from the previous app version.
Click Next and finish configuring the new version of your app (see Using the wizard to add an in-house iOS or macOS app to the App Catalog.)

Once finished, the new version displays in the App Catalog.