Deploy Apps After Operating System Deployment

  • Article

Applies To: Windows 8.1

When you deploy apps in your educational organization after operating system deployment, you can use the Windows Store, sideloading, or a combination of both of these methods.

As part of the planning process, Amy and Mark selected the app deployment method for each app. The next step is for Amy to prepare the IT infrastructure for app deployment, and then deploy the apps to the appropriate users and devices. The changes you must make to your IT infrastructure depend on the app deployment method selected.

You can deploy apps after Windows 8 operating system deployment by using the Windows Store, sideloading, or a combination. Each deployment scenario is discussed in further detail in a subsequent section. For information about deploying apps during operating system deployment, see the section “Deploying apps during operating system deployment” later in this guide.

Use only the Windows Store

In most cases, users (the consumers of the apps) install apps by using the Windows Store. From the IT perspective, the greatest responsibility is ensuring that the IT infrastructure allows proper access to the Windows Store. Table 5 lists the high-level steps for installing apps by using only the Windows Store and the user persona responsible for performing the step.

Table 5. High-Level Steps for Deploying Apps by Using Only the Windows Store

Step Description Performed by

1

Configure the IT infrastructure to support the Windows Store. Ensure that the IT infrastructure allows access to the Windows Store. This step includes the following tasks:

IT pros

2

Ensure that each faculty member and student has a Microsoft account that can be associated with their Windows account. Each user must create a new Microsoft account or use their existing Microsoft account to access the Windows Store. For students under 13 years of age, an approved guardian must assist in creating a Microsoft account because of COPPA regulations. To verify that an adult is giving a child permission to create a new Microsoft account, COPPA requires that a small amount be charged to the adult’s credit card.

Faculty, students, and student guardians

3

Publish the list of apps to be used. The faculty and IT pros will need to publish the list of recommended or required apps. This list can be published on a website, as part of a course syllabus, or as part of list of school supplies sent home to parents. If a specific version of an app is required, ensure that the list indicates the desired version. For example, a faculty member could be designated as the coordinator for the list of recommended and required apps. The faculty member could then publish the list on the institution’s main website.

IT pros and faculty

4

Install apps on devices. Faculty and students must install the apps on their devices by using the Microsoft accounts obtained earlier in the process. Depending on the age or skill level of the student, faculty may need to assist the student in logging on to and installing the app on their device. Apps are installed by using the Store app on the Start screen on the device. Apps can be found by searching the Windows Store (as shown in Figure 2 and Figure 3), by browsing content in the Windows Store, or by a direct hyperlink to the app in the Windows Store (also known as deep links). You can deploy deep linked apps by using System Center 2012 R2 Configuration Manager and Windows Intune.

Faculty, students, and student guardians

5

Manage access to the Windows Store. One aspect of apps in education that must be managed is students browsing in the Windows Store for apps that do not directly relate to the curriculum (such as games or apps that are not age appropriate). Microsoft partners provide solutions that can help IT pros and faculty manage the student accessibility to the Windows Store. Also, educational institutions typically want to control which apps can be installed and run on devices. They can do this by using AppLocker and Group Policy settings in Windows 8.1 Enterprise.

IT pros and faculty

6

Manage apps on devices. Most educational institutions want to control the apps that can run on institution-owned devices. Use Group Policy settings and AppLocker to prevent the installation of unauthorized apps or running unauthorized apps on institution-owned devices.

IT pros

7

Update apps on devices. Updates to apps are published through the Windows Store. Users are notified of app updates on the Store app tile on the Start screen. The Store app tile shows the number of app updates available based on the apps installed for the currently logged-on user. Users can elect to install updates on an app-by-app basis or update all apps at once. As with the installation of apps, faculty might need to assist students in logging on to and installing the app on their device (depending on age or skill level). Each user on a device must install the app updates, regardless if other users have installed the app update or not. Establish a time for app updates to be installed that is acceptable to the faculty. For example, ensure that app updates are always installed prior to the start of a class or event so that time is not wasted on app updates. Also, ensure that students are not distracted during class or events by dynamically restricting access to the Windows Store during class or event periods by using AppLocker (available only in Windows 8.1 Enterprise) and products from Microsoft partners.

Note
You cannot dynamically restrict access to the Windows Store on devices running Windows RT 8.1

Faculty and students

Amy and Mark have divided the tasks in Table 5 based on their job roles. Amy ensures that the IT infrastructure allows access to the Windows Store and performs a series of tests to ensure that all Windows Store features work as expected. Amy also configures Group Policy settings and AppLocker to help prevent the installation of unauthorized apps or starting unauthorized apps on institution-owned devices. For the most part, Amy’s responsibilities are complete.

In contrast, Mark has been busy working with the faculty on deployment. First, he has been helping the faculty identify the apps they want to use in their curriculum. Mark and other faculty members search the Windows Store (illustrated in Figure 2 and Figure 3) to help them find the right apps. They also find out that they can search by app name or other keywords.

Figure 2. Searching the Windows Store

Figure 3. Search results in the Windows Store

Mark and other faculty members also browse content in the Windows Store by category, such as education (shown in Figure 4). They can use different categories of apps to find the right app quickly.

Figure 4. Browsing content by category in the Windows Store

During the deployment process, Mark receives an email from a teacher who is having trouble installing an app on the 30 devices in her classroom. After meeting with the teacher, Mark tells her to have each student log on to a device using their assigned Microsoft account, and then have each student install the app. Mark also points out that each student should log on to the same device each day in class to avoid spending the time required to log on to a device for the first time while in class.

Use only sideloading

IT pros must perform the majority of the steps to deploy apps by using sideloading: Users are responsible for installing only optional apps. Table 6 lists the high-level steps for using sideloading to deploy apps and the user persona responsible for performing each step.

Table 6. High-Level Steps for Deploying Apps by Using Only Sideloading

Step Description Performed by

1

Obtain the app package files. IT pros and faculty can work together to obtain the app package files from the app developer.

IT pros and faculty

2

Configure the appropriate method for performing sideloading. For each sideloading deployment method selected in the section “Plan for app sideloading” earlier in this guide, configure the method for performing app sideloading. This choice includes activities such as creating System Center 2012 R2 Configuration Manager applications and deployment types, uploading apps into Windows Intune, or configuring logon scripts.

IT pros

3

Ensure that devices are properly configured for sideloading. Configure devices for sideloading based on the sideloading prerequisites discussed in the section “Plan for app sideloading” earlier in this section. Preparation for sideloading depends on device ownership.

IT pros

4

Manage access to the Windows Store. If all apps are to be sideloaded, disable access to the Windows Store by using the Turn off the Store application Group Policy setting. The Turn off the Store application Group Policy setting also disables the ability to automatically install updates from the Windows Store. If deploying apps by using both the Windows Store and sideloading, see the “Use Both the Windows Store and Sideloading” section later in this guide.

Note
This step only applies to institution-owned devices, not personally owned devices.

IT pros

5

Manage apps on devices. Most educational institutions want to control the apps that can be run on institution-owned devices. Prevent users from installing and running unauthorized apps on institution-owned devices by using Group Policy settings and AppLocker with Windows 8 Enterprise.

Note

This step only applies to institution-owned devices, not personally owned devices.

IT pros

6

Update apps on devices. The IT pro or faculty member designated as the primary point of contact for the app developer obtains an updated version of the .appx installation package directly from the developer. Use System Center 2012 R2 Configuration Manager or Windows Intune to deploy updates automatically. Other methods must follow the same process as installing the app. App updates can also be pushed or made available in a self-service model. For the push model, no user interaction is required. For the self-service model, users must install the app updates on their device. When you update an app, you do not need to uninstall the older version first. The new version of the app will automatically remove the older version before installing the newer version. Also, when you update an app any existing app data is typically retained. However, this could vary between apps and you should contact the app developer prior to updating the app.

IT pros, faculty, and students

During the planning phase, Amy and Mark decided to use System Center 2012 R2 Configuration Manager and Windows Intune to perform sideloading. Amy and Mark work with the faculty to obtain the app packages for all the apps to be sideloaded. Amy and Mark also work with the faculty to determine which apps need to deploy by using the push model and which can be deployed by using the self-service model.

Then, Amy configures System Center 2012 R2 Configuration Manager and Windows Intune to sideload the apps. For System Center 2012 R2 Configuration Manager, Amy creates a Configuration Manager application and deployment type by using the Create Application Wizard (as illustrated in Figure 5).

Figure 5. General page in the Create Application Wizard

Amy also uploads the apps into the Software workspace in Windows Intune (as illustrated in Figure 6). Then, she deploys the apps to the user groups previously defined in Windows Intune.

Figure 6. The Software workspace in Windows Intune

Amy also uses Group Policy, System Center 2012 R2 Configuration Manager, and Windows Intune to prepare the devices for sideloading:

  • Enable the Allow all trusted applications to install Group Policy setting for domain-joined devices running Windows 8 Enterprise.

  • Activate sideloading keys for all other devices.

When Amy is finished, Mark works with other faculty members and students to install apps that are deployed by using a self-service model. Mark also works with faculty members and students to help them deploy app updates to their devices.

Use both the Windows Store and sideloading

Most educational institutions deploy apps by using a combination of the Windows Store and sideloading to provide additional flexibility in app deployment. For example, using a combination of both methods allows an institution to deploy some apps as a part of operating system deployment by using sideloading while allowing faculty and students the flexibility to purchase apps as they desire from the Windows Store. In addition, you can use Microsoft partner products to make AppLocker and other app management tools more dynamic and automated.

If you decide to deploy apps by using both the Windows Store and sideloading, follow the steps provided in the sections “Use only the Windows Store” and “Use only sideloading” earlier in this guide, with the exception that you should not use the Turn off the Store application Group Policy setting to disable access to the Windows Store. Otherwise, perform all steps when using both the Windows Store and sideloading.

Additional resources

See also