apple_device-management/mdm/commands/application.install.enterprise.yaml

title: Install Enterprise Application Command
description: Install an enterprise app on a device.
payload:
  requesttype: InstallEnterpriseApplication
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: 10.13.6
      accessrights: AllowAppInstallation
      devicechannel: true
      userchannel: false
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
payloadkeys:
- key: Manifest
  type: <dictionary>
  presence: optional
  content: A dictionary that specifies where to download the app. This value uses
    the `ManifestURL` format.
  subkeys:
  - key: ANY
    type: <any>
    presence: optional
    content: A dictionary that specifies where to download the app. This value uses
      the `ManifestURL` format.
- key: ManifestURL
  type: <string>
  presence: optional
  content: The URL of the app manifest, which needs to begin with `https:`. The manifest
    is returned as a property list that uses the `ManifestURL` format.
- key: ManifestURLPinningCerts
  type: <array>
  presence: optional
  content: An array of DER-encoded certificates to pin the connection when fetching
    the `ManifestURL`.
  subkeys:
  - key: ManifestURLPinningCertsItem
    type: <data>
    presence: required
    content: A certificate in DER-encoded format.
- key: PinningRevocationCheckRequired
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, certificate revocation checks require a positive response when
    using certificate pinning with `ManifestURLPinningCerts`.
- key: InstallAsManaged
  supportedOS:
    macOS:
      introduced: '11.0'
      userenrollment:
        mode: forbidden
  type: <boolean>
  presence: optional
  default: false
  content: |-
    If `true`, install the app as a managed app. Otherwise, the system installs the app as unmanaged. If you reinstall a manged app and omit this value or set it to `false`, the app becomes unmanaged.

    For manifest-based installs, if `true`, the system only considers apps installed in `/Applications` as managed. In macOS 11 through 13, the system requires that the `pkg` only contains a single signed app.
- key: ManagementFlags
  supportedOS:
    macOS:
      introduced: '11.0'
      userenrollment:
        mode: forbidden
  type: <integer>
  presence: optional
  rangelist:
  - 1
  content: |-
    The management flags. The possible values are:

    * `1`: If `InstallAsManaged` is `true`, remove the app upon removal of the MDM profile.
- key: Configuration
  supportedOS:
    macOS:
      introduced: '11.0'
  type: <dictionary>
  presence: optional
  content: A dictionary that contains the initial configuration of the app, if you
    choose to provide it.
  subkeys:
  - key: ANY
    type: <any>
    presence: optional
    content: An app configuration.
- key: ChangeManagementState
  supportedOS:
    macOS:
      introduced: '11.0'
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  rangelist:
  - Managed
  content: |-
    The change management state. This value doesn't work with the user enrollments. The only possible value is:

    * `Managed`: Take management of the app if the user installed it already and `InstallAsManaged` is `true`.
- key: iOSApp
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: '11.0'
    tvOS:
      introduced: n/a
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the app is an iOS app that can run on a Mac with Apple silicon
    in macOS 11 and later.
notes:
- title: ''
  content: |-
    This command provides a more secure version of the `InstallApplication` command when that uses a `ManifestURL`. The request must contain either `Manifest` or `ManifestURL`. Using `Manifest` ignores the pinning options. When using `ManifestURL`, specify the pinning options to increase security. In macOS, the device returns an `Acknowledged` response after validating the parameters, but before downloading and installing the app. However, it doesn't notify the MDM server about errors that occur during the installation process.

    This command fails if Declarative Device Management is managing the app.

    Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
  files:
  - request-file: examples/mdm/commands/application.install.enterprise/example1.plist
    response-file: examples/mdm/commands/application.install.enterprise/example2.plist