Pro edition. Connections let you send packages straight to Microsoft Intune, Azure Storage or Microsoft Configuration Manager (MECM).
The Connections page #
Open Connections in the sidebar. The table shows Name, Type, Target, Authentication and Last test (Passed / Failed / Not tested). Each row has Test connection, Edit and Delete. Click New Connection to add one.
All connection details stay on your computer:
- Secrets are encrypted with Windows DPAPI for your user account.
- Secrets are never shown again after you save them.
Microsoft Intune #
Before you start, you need:
- An app registration in Microsoft Entra ID.
- The API permission
DeviceManagementApps.ReadWrite.All, with admin consent granted. - For interactive sign-in: the redirect URI
http://localhost(platform Mobile and desktop applications). - For app-only sign-in: a client secret.
Fields:
| Field | Description |
|---|---|
| Connection name | For example Contoso Intune (Prod) |
| Tenant ID | Your Entra tenant ID |
| Application (client) ID | Your app registration’s client ID |
| Authentication | Sign in as me (interactive): your browser opens for sign-in. App-only (client secret): enter the client secret. |
Azure Storage #
| Field | Description |
|---|---|
| Storage service | Blob container or File share (Azure Files, e.g. App Attach) |
| Authentication | Connection string, SAS URL or Service principal (Entra ID) |
| Container / File share name | The target container or share. For a SAS URL it is only needed with account-level SAS URLs. |
| Tenant ID, Application (client) ID, Storage account name, Client secret | For a service principal. The app registration needs a data role on the storage account, for example Storage Blob Data Contributor. |
MECM / Configuration Manager #
Before you start, you need:
- The Configuration Manager console installed on this computer.
- A Windows account with ConfigMgr administrative rights. The app always connects as the signed-in Windows user, so no password is stored.
- A content share where:
- your account has write access
- the site server’s computer account has read access
| Field | Description |
|---|---|
| SMS Provider server | Usually the primary site server, for example cm01.contoso.com |
| Site code | Three characters, for example PS1 |
| Content share | UNC path, for example \\fs01\Sources$\Applications |
Testing a connection #
Click Test connection, either in the editor before you save or on a saved row. The test checks:
- Intune: that sign-in works and the permission is granted
- Azure Storage: that the container or share can be accessed
- MECM: that the console and module are present, the content share is writable and the site responds. The result shows the site name and version. The first test takes about 20 seconds.
Uploading a package #
- On a PSADT, MSIX or IntuneWin package card, click the upload (cloud) icon.
- Choose the Destination and a Connection:DestinationPackage typesWhat happensMicrosoft IntunePSADT, IntuneWinPublished as a Win32 app. A PSADT package is wrapped as
.intunewinautomatically.Azure StoragePSADT, MSIX, IntuneWinThe package file is uploaded to the container or file shareMECMPSADTOpens the Deploy to MECM panel (see below) - Click Start Upload. You can click Hide (upload continues) and keep working. A notification appears when the upload finishes, even if you have moved to another page.
After an Intune upload, review assignments and details in the Intune admin center. It can take a few minutes until the app is fully available there.
Uploading several packages #
Select packages on the workspace and click the toolbar upload icon. Choose Microsoft Intune or Azure Storage. Each package shows its own status (Waiting / Building / Published / Uploaded), and a summary appears at the end. MECM is not available for bulk uploads.
Deploying to MECM #
The Deploy to MECM panel walks you through the following:
- MECM connection. Collections and distribution points are loaded from the site. The first load takes about 20 seconds; the list is kept for 5 minutes, and Refresh reloads it.
- Application. Name, publisher, version and description are pre-filled from the package.
- Detection rules. Choose MSI product code, file exists, registry key exists, or a PowerShell script.
- If the package contains an MSI, its product code is filled in for you.
- A script rule must be the only rule.
- Target collection. Pick an existing device collection, or create a new one:
- Give it a name and a limiting collection.
- The new collection is created empty. Add members in the console.
- Content distribution. Choose distribution point groups and/or individual distribution points.
- Deployment. Choose the purpose:
- Available (self-service in Software Center)
- Required (installs automatically, with an optional deadline)
- Optionally open Preview the deployment script.
- Click Deploy.
The package content is copied to {content share}\Applications\{Publisher}\{Name}\{Version}. The application, the PSADT deployment type, the collection, the content distribution and the deployment are created, and progress is shown live. Content distribution to the distribution points then finishes in the background.
Possible conflicts:
- An application with the same name already exists. The deploy stops before anything is created.
- The content folder already exists. Turn on Overwrite the content folder, or increase the version.