Setup guide · from scratch
Add a free iOS App Store app by URL (no VPP)
For genuinely free apps where an Apple ID on the device is acceptable, add straight from the App Store — no token needed. Not silent and no licence tracking; paid apps must use VPP.
≈ 5 min
Apple — iPhone, iPad & Mac · step 10 of 12 · ≈ 5 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — skip the clicks.
Every step below can be done by hand. Or connect your Microsoft tenant to Decolla once, and Decolla performs this for you over Microsoft Graph in your own tenant — then hands back a verified result you can see and roll back per item. It also puts the fundamentals this step depends on in place — the target group, the licence allocation — so a build is never blocked half-way by a missing dependency.
⏱ By hand: about 5 min of clicking, every build. The Decolla way: part of one tenant connect, then automatic.
Before you start
- Intune Administrator (or Application Manager) sign-in for the Intune admin center.
- The exact app name as it appears in the App Store - close matches pull the wrong listing.
- The correct App Store country/region for your users, which pins the app's store URL.
- The Entra ID group(s) you'll target in the Assignments step.
The steps
- Go to Apps > All Apps > Create.
- Under 'Store app' select 'iOS store app', then click Select.
- Click 'Search the App Store'.
- Choose the App Store country/region, type the app name, pick it from results, then…
- Confirm the auto-filled Name, Publisher, Appstore URL, minimum OS and device type,…
- Scope tags (optional) > Next; Assignments (add Entra groups) > Next.
- Review + create > Create.
0 of 7 done
Step 1. Go to Apps > All Apps > Create.
Screenshot: Create app pane (captured during a live customer build — coming to this page)
Why: 'Create' is the one entry point for every app type Intune deploys - at this stage you're only building a catalogue entry, nothing installs yet.
If this step errors: Duplicate apps in Intune after VPP token renewal
Step 2. Under 'Store app' select 'iOS store app', then click Select.
Screenshot: Select app type with 'iOS store app' highlighted (captured during a live customer build — coming to this page)
Why: 'iOS store app' pulls the listing straight from the public App Store by URL - that's precisely why it needs no Apple token.
Don’t: Do NOT use this route for a paid app - it can only add free titles; anything paid must come through a VPP/location token.
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 3. Click 'Search the App Store'.
Screenshot: 'Search the App Store' button (captured during a live customer build — coming to this page)
Why: Searching from here lets Intune fetch the store metadata for you, so the name, publisher and Appstore URL on the next page arrive auto-filled rather than typed by hand.
Step 4. Choose the App Store country/region, type the app name, pick it from results, then Select.
Screenshot: App Store search results pane (captured during a live customer build — coming to this page)
Watch for: The country/region pins the app to that one storefront's URL - pick the store your users actually use, as availability and even the app's name differ region to region.
Don’t: Do NOT assume the default region is yours - it follows the console, which often isn't where your fleet's App Store lives.
Step 5. Confirm the auto-filled Name, Publisher, Appstore URL, minimum OS and device type, then Next.
Screenshot: App information page with auto-filled Appstore URL (captured during a live customer build — coming to this page)
Why: Minimum OS and device type become silent install filters - a device below the minimum or of the wrong type simply never receives the app, with no error.
Don’t: Do NOT push the minimum OS higher than the app truly needs - you'll quietly exclude older but perfectly supported devices.
Step 6. Scope tags (optional) > Next; Assignments (add Entra groups) > Next.
Screenshot: Assignments step (captured during a live customer build — coming to this page)
Why: The assignment is what actually deploys the app - add no group and it just sits in the catalogue, reaching no device.
Watch for: This route is never silent: even an assigned device prompts for an Apple ID to finish the install - it asks, it doesn't push.
If this step errors: Renew or recreate the Apple MDM push certificate in Intune?
Step 7. Review + create > Create.
Screenshot: Review + create summary (captured during a live customer build — coming to this page)
Watch for: There's no licence count to monitor afterwards - unlike VPP this app reports no consumption, so adoption is visible only through per-device install status.
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Apple tokens in Intune: APNs, ADE and VPP renewal explained — The APNs certificate, ADE enrolment token and VPP token all expire yearly and each breaks something different. A one-page matrix and the renewal rules.
- Duplicate apps in Intune after VPP token renewal — Renewing an Apple VPP token as a new entry duplicates every app in Intune. How to renew in place, recover from duplicates, and catch early expiry.
- Renew or recreate the Apple MDM push certificate in Intune? — Renew — never recreate — your Intune APNs certificate. Why device trust follows the push topic, what the Apple ID actually controls, and the safe path.
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access