Add macOS applications from the Enterprise App Repository

The Enterprise App Repository (EAR) enables administrators to conveniently add and manage frequently used, publicly accessible enterprise applications. By importing applications from the EAR, administrators can seamlessly integrate them into their environment as internal applications. Once added, these applications can be distributed and installed on devices directly from the console.

Deploying macOS applications from the Enterprise App Repository

The Enterprise App Repository acts as a centralized repository for applications from trusted third-party providers. By automating the retrieval of application metadata and deployment configurations, the repository significantly reduces manual effort and simplifies application management across your organization. This streamlined approach not only simplifies packaging but also facilitates easy scaling across various environments.

Automatically generated application information

When an application is added from the Enterprise App Repository, the system generates the application information, such as application name, icon, package identifier, and version. This information is automatically populated on the UEM Application Configuration page.

Automatically generated Install Scripts

When an application is added to the repository, the system automatically generates, if necessary, a pre-install script and a post-install script based on the metadata in the application’s PLIST file. However, not all applications require these scripts. Administrators have the flexibility to modify the existing scripts or create custom scripts as required before deployment to ensure compatibility with specific application requirements.

Automatically generated Uninstall Scripts

For each application, the repository also generates pre-uninstall and post-uninstall scripts automatically, if required. This allows Workspace ONE to cleanly remove applications without requiring administrators to build or test their own uninstallation logic.

As with install scripts, administrators can customize the uninstall scripts as needed.

Administrators can also modify the preferred Uninstall Method. The default value for this setting is Remove Copied Items.

Automatically generated Install Check Scripts

The Enterprise App Repository automatically generates necessary detection methods and/or Install Check Scripts to verify whether an application is already installed or was successfully installed on a device. Not all applications will require an Install Check Script.

The repository automatically provides a default detection method for each supported application, helping administrators avoid the manual process of installing applications locally just to collect detection data (for example, file paths, bundleIDs, or version details).

In most cases, the generated detection logic works without modification. However, some applications may require an Install Check Script to accurately detect installation status or handle unique edge cases. Administrators can modify the Install Check Script and the Uninstall Check Script as required.

Additional Deployment Options

Administrators can set additional deployment options for applications imported from the Enterprise App Repository.

Blocking Applications – When set to Yes, the Blocking Applications option allows administrators to define specific applications that, if found running on the device at the time of installation, will block the deployment of the new application. Blocking applications are defined by app name and path. If the app is in the /Applications/ folder, it can be defined as just the file name and the path will be automatically discovered.

Restart Action – Administrators can define a specific restart action for the application installation if required.

Condition – Additional conditions can be created to determine if the application can be installed on the device. Conditions are defined using NSPredicate format and must evaluate true for the application to be considered “installable” on the device. Although most conditional requirements can be handled using Smart Groups, there might be scenarios that require specific conditions not available with Smart Groups. For instance, you might have an application with two versions for different device configuration, such as one for desktop and one for laptop.

Configure applications from the Enterprise App Repository for macOS

Administrators can browse, select, and import applications into Workspace ONE UEM for streamlined deployment using the Enterprise App Repository. The process of configuring any application and assigning it to the desired devices is outlined in the following steps.

Procedure

1. Navigate to Resources > Apps > Native Apps > Internal and then select Add > From Enterprise App Repository. Select macOS.

2. On the Enterprise App Repository page, under Search Application use the search bar to search and select the internal application. In this example, Firefox is the application being searched for.

3. Select the Firefox application from the results, choose the appropriate Version details to configure the application.

4. Click Next to review your selected application and edit the application configuration as required.

5. If required, enter a Pre-Install Script in the Pre-Install Script text box. If present, this script will run before attempting the application installation.

6. If required, enter a Post-Install Script in the Post-Install Script text box. If present, this script will run after a successful application installation.

7. If required, enter a Pre-Uninstall Script in the Pre-Uninstall Script text box. If present, this script will run before attempting the application uninstallation.

8. If required, select the preferred Uninstall Method from the Uninstall Method dropdown menu. The following options are available.

   • Remove Packages – Select this option to remove any installed packages.

   • Remove Copied Files – Select this option to remove any files copied during the original app installation.

   • Remove App – Select this option to remove the App file from its installed location.

   • Uninstall Script - When selected, a textbox will be provied into which an uninstall script can be entered.

9. If required, enter a Post-Uninstall Script in the Post-Uninstall Script text box. If present, this script will run after the application uninstallation completes.

10. If required, enter an Install Check Script in the Install Check Script text box.

11. If required, enter a Uninstall Check Script in the Uninstall Check Script text box.

12. To configure any potential applications that might block the installation, select the Yes button for Blocking Applications. If set to Yes, enter the file name of one or more applications in the field provided. You can click the + to add additional applications.

13. Select a Restart Action from the Restart Action dropdown if required. The following options are available.

    • Require Shutdown

    • Require Restart

    • Recommend Restart

    • Require Logout

14. If needed, enter a condition which can be used to determine if the application can be installed on the device.

15. Click Save to upload the application and assign the app to the targeted devices.

Updating applications from the Enterprise App Repository

After the application configuration is complete and the application is assigned to an assignment group, administrators can navigate to Resources > Apps > Native > Internal to view the configured application in the List View page.

When the application list view is loaded, Workspace ONE UEM performs a live query against the Enterprise App Repository to determine if any newer versions of the listed applications are available.

This live update check ensures that administrators always see the most current application version information without needing to perform a manual synchronization.

If a newer version is found, the system displays an Update Now button, allowing administrators to update the application from the Enterprise App Repository.

Enterprise App Repository security and validation

The Enterprise App Repository follows a multi-layered validation and security vetting process to ensure that all submitted applications are safe, trusted, and compliant before becoming available in the public repository.

This process is managed by the repository owner and integrates both automated and manual validation steps to maintain the highest security standards.

Validation and security review stages

1. URL reputation and integrity checks

   All external URLs associated with the submission-such as installer download links, publisher websites, and licensing references—are evaluated using reputation and integrity validation services.

   This ensures that no installer is hosted on a compromised or untrusted domain.

2. File identity and integrity

   A checksum is generated for every submitted binary and validated against the vendor supplied checksum value. If the vendor checksum is not available, the generated checksum is validated against the PLIST file.

3. Code signing and platform trust

   This three-step process ensures the signing and trust status of the binaries. First, the binary is validated to ensure that it is code signed and that the signing authority matches the vendor’s name. Then, a macOS Gatekeeper validation ensures the binary source matches the developer ID. And a notarization check verifies the code is notarized by Apple.

4. Malware screening

   Every submitted binary is scanned using an independent security engine to detect malware, trojans, or other suspicious patterns.

5. Installer and package inspection

   The contents of the installer are unpacked and reviewed to ensure there are no obfuscated or hidden files.

6. Installer scripts review

   A review is made of the pre-install and post-install scripts used by the package to ensure there are no dangerous commands, permission tampering, security disablement, unexpected downloads from the Internet, hidden post-install scripts, or unexpected root-level changes.

7. Vulnerability awareness

   The version is extracted from the metadata and used in a review of vendor security advisories. An additional review of critical CVEs for this version is performed.

8. Documentation and approval

   A final review is made of the documented results from the above listed steps. An approval or rejection decision is made based on the findings of the validation and security review.

This multi-stage validation and verification process ensures complete integrity of application packages—from repository submission, through admin upload, to device-level installation—creating a fully secured, end-to-end application deployment flow.