DecollaDecolla
Home › Setup guides › Upload your own app (MSI/EXE) - install it via Intune, the USB stick, or both
Setup guide · from scratch

Upload your own app (MSI/EXE) - install it via Intune, the USB stick, or both

For apps not in the store - your RMM agent, a VPN client, a line-of-business installer. Point the cockpit at your MSI/EXE: an MSI's name, publisher and silent install are read from the file itself, the binary uploads straight to your organisation's private Decolla storage, and you choose whether it installs via Intune, from the USB stick, or both. Any token stays private to your build.

Decolla cockpit (App store > Add your own app)
≈ 8 min
Windows — Autopilot & USB provisioning · step 7 of 12 · ≈ 8 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
  • A Decolla cockpit account.
The Decolla way — skip the clicks.

Every step below can be done by hand. Or connect your Microsoft tenant to Decolla once, and Decolla performs this for you over Microsoft Graph in your own tenant — then hands back a verified result you can see and roll back per item. It also puts the fundamentals this step depends on in place — the target group, the licence allocation — so a build is never blocked half-way by a missing dependency.

⏱ By hand: about 8 min of clicking, every build. The Decolla way: part of one tenant connect, then automatic.
Before you start
  • The installer itself - the MSI, EXE or MSIX file, or the whole folder holding the MSI plus its config files and scripts (or a direct vendor download URL if you have no file to upload).
  • For an EXE, the vendor's silent-install switch (e.g. /S or /VERYSILENT) - an EXE will not install unattended without it.
  • Any install-time values the installer needs, ready to paste as KEY=VALUE, one per line - for example an RMM site token.
  • A signed-in cockpit session - the upload will not run signed out.
The steps
  1. In the cockpit open the App store step and click '+ Add your own app (MSI / EXE /…
  2. Fastest route: use 'Auto-fill from your installer folder' and pick the folder…
  3. Or pick the installer file directly (MSI/EXE/MSIX) with the file chooser - an MSI…
  4. No file to upload? Set Type to 'Download from a URL' and paste the vendor's direct…
  5. If the installer needs install-time values (e.g. an RMM site token), add them under…
  6. For a .exe, enter the vendor's silent switch (e.g. /S or /VERYSILENT) - EXEs do not…
  7. Choose where it installs: 'Cloud (Intune)' pushes it to every device through…
  8. Click 'Add app'. The app's details register first, then the installer uploads…
  9. If the upload fails, the app's details are still saved - the status says so and you…
  10. On the stick, your app joins the same offline install manifest as the standard…
0 of 10 done
Step 1. In the cockpit open the App store step and click '+ Add your own app (MSI / EXE / installer)'.
Screenshot: The App store screen with the '+ Add your own app' button (captured during a live customer build — coming to this page)
Why: This is the way in for anything the curated store does not carry - your RMM agent, a VPN client, a line-of-business installer. Everything else on this page is for apps Decolla already knows.
Step 2. Fastest route: use 'Auto-fill from your installer folder' and pick the folder holding your .msi (plus any config files or scripts). Decolla reads the MSI's OWN details - name and publisher fill themselves in, and any config/scripts found in the folder are listed for you.
Screenshot: The auto-fill folder picker + the 'name + publisher auto-filled from the MSI' note (captured during a live customer build — coming to this page)
Why: An MSI carries its own name, publisher and silent-install rule inside it, so pointing at the folder means you type almost nothing and the details match the file exactly.
Watch for: It lists every config file and script it finds in the folder - point it at a clean folder holding only this installer's own files, or a cluttered Downloads folder drags in strays.
Step 3. Or pick the installer file directly (MSI/EXE/MSIX) with the file chooser - an MSI still auto-fills its name and publisher.
Screenshot: The direct installer file field with a file selected (captured during a live customer build — coming to this page)
Why: When you have just the one file and no supporting folder, the direct picker still reads an MSI's name and publisher straight from it.
Watch for: Only an MSI describes itself - an EXE does not, so you supply its name here and its silent switch (step 6) by hand.
Step 4. No file to upload? Set Type to 'Download from a URL' and paste the vendor's direct download link instead.
Screenshot: Type = 'Download from a URL' with a vendor link pasted (captured during a live customer build — coming to this page)
Why: Registers an app whose installer you would rather Decolla fetch than upload - the vendor hosts the file, you just hand over the link.
Watch for: It must be a direct link to the installer itself, not a landing page or a 'your download will start shortly' redirect.
Step 5. If the installer needs install-time values (e.g. an RMM site token), add them under 'Install properties', one KEY=VALUE per line. These are treated as secrets - kept private to your build, never shared into the common catalogue.
Screenshot: Install properties box with a redacted TOKEN=... line + the 'token kept private' badge (captured during a live customer build — coming to this page)
Why: Where install-time values such as an RMM site token go, so the app registers itself to the right tenant as it installs. They are held private to your build and never fed into the shared catalogue.
Watch for: One KEY=VALUE per line. If the vendor later rotates that token, update it here - every stick and push keeps using the value you typed until you do.
Step 6. For a .exe, enter the vendor's silent switch (e.g. /S or /VERYSILENT) - EXEs do not describe themselves and guessing is unsafe. MSIs need nothing here: the silent install and detection rule are derived from the MSI itself.
Screenshot: The EXE silent switch field (captured during a live customer build — coming to this page)
Why: The silent switch is how the machine installs the EXE with nobody clicking. Without it the installer sits waiting for a human that never arrives, and the build stalls.
Watch for: The switch is vendor-specific - /S, /silent, /VERYSILENT and /qn are not interchangeable; use the one the vendor documents. An MSI needs nothing here - its silent install and detection come from the file.
Don’t: Do NOT guess a switch or borrow one from another product - the wrong one either pops UI mid-build or installs nothing at all.
Step 7. Choose where it installs: 'Cloud (Intune)' pushes it to every device through Intune, 'USB build only' puts it in the provisioning stick's offline payload, 'Both' does both.
Intune admin center ↗
Screenshot: The 'Install on' selector showing Cloud / USB build only / Both (captured during a live customer build — coming to this page)
Why: This decides delivery. 'Cloud (Intune)' pushes to every enrolled device, 'USB build only' bakes it into the offline stick, 'Both' covers machines you build from the stick and manage in the cloud.
Watch for: 'USB build only' reaches nothing you did not build from that stick - a device that enrols straight into Intune will never see a USB-only app.
If this step errors: Intune Win32 install fails: SYSTEM vs user context
Step 8. Click 'Add app'. The app's details register first, then the installer uploads STRAIGHT to your organisation's private Decolla storage with a live progress percentage - large installers are fine. You must be signed in for the upload.
Screenshot: The upload progress line ('Uploading <file> - 40%...') (captured during a live customer build — coming to this page)
Why: The details register before the bytes move, so the app exists in your catalogue even while a large installer is still uploading.
Don’t: Do NOT sign out or close the tab while the percentage is climbing - the upload needs you signed in, and it goes straight to your organisation's private storage, not a shared bucket.
Step 9. If the upload fails, the app's details are still saved - the status says so and you can re-try the upload; a re-upload simply overwrites.
Screenshot: The 'Added (metadata saved). Installer upload failed... re-try' status (captured during a live customer build — coming to this page)
Why: The metadata is saved separately from the file, so a dropped upload costs you the upload, not the whole entry - you re-try just the installer, and a re-upload overwrites rather than duplicating.
Watch for: Read the status: 'metadata saved, installer upload failed' means the app is registered but has no binary yet, so it cannot actually install anywhere until you re-upload.
Step 10. On the stick, your app joins the same offline install manifest as the standard apps: the machine installs it silently from the USB with no internet, using the MSI's product code (or your EXE switch) for its install and detection.
Screenshot: The stick's Apps folder / apps-manifest.json including the custom app (captured during a live customer build — coming to this page)
Why: On the stick your app is treated exactly like the standard store apps - installed offline from the payload with no internet, the MSI's product code (or your EXE switch) doubling as the detection rule.
Watch for: Detection hangs on that product code or switch being right. If an EXE installs but its detection does not match, the manager can decide it failed and try again - so the switch matters twice: for installing, and for proving it installed.
If this step errors: Intune registry detection rule not working: 32/64-bit fix

If it goes wrong

The failures people actually hit on this process, each with the diagnosis and fix:

‹ How machines get their names (auto serial names + the first-logon rename pop-up)Boot a machine from the Decolla stick, and open a command prompt during Setup ›

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access