Jan 22, 2019 A tool to wrap Windows Classic App and then it can be uploaded to Intune - microsoft/Intune-Win32-App-Packaging-Tool. Start your free week with CBT Nuggets. This video, Anthony Sequeira covers Microsoft Intune and how you can use it to deploy apps.

-->

Use the Microsoft Intune App Wrapping Tool for iOS to enable Intune app protection policies for in-house iOS apps without changing the code of the app itself.

The tool is a macOS command-line application that creates a wrapper around an app. Once an app is processed, you can change the app's functionality by deploying app protection policies to it.

To download the tool, see Microsoft Intune App Wrapping Tool for iOS on GitHub.

Note

If you have issues with using the Intune App Wrapping Tool with your apps, submit a request for assistance on GitHub.

General prerequisites for the App Wrapping Tool

Before you run the App Wrapping Tool, you need to fulfill some general prerequisites:

Download the Microsoft Intune App Wrapping Tool for iOS from GitHub.
A macOS computer that has the Xcode toolset version 11 or later installed.
The input iOS app must be developed and signed by your company or an independent software vendor (ISV).
- The input app file must have the extension .ipa or .app.
- The input app must be compiled for iOS 12.2 or later.
- The input app cannot be encrypted.
- The input app cannot have extended file attributes.
- The input app must have entitlements set before being processed by the Intune App Wrapping Tool. Entitlements give the app additional permissions and capabilities beyond those typically granted. See Setting app entitlements for instructions.

Apple Developer prerequisites for the App Wrapping Tool

To distribute wrapped apps exclusively to your organization's users, you need an account with the Apple Developer Enterprise Program and several entities for app signing that are linked to your Apple Developer account.

To learn more about distributing iOS apps internally to your organization's users, read the official guide to Distributing Apple Developer Enterprise Program Apps.

You will need the following to distribute apps wrapped by Intune:

A developer account with the Apple Developer Enterprise Program.
In-house and ad-hoc distribution signing certificate with valid Team Identifier.
- You will need the SHA1 hash of the signing certificate as a parameter to the Intune App Wrapping Tool.
In-house distribution provisioning profile.

Steps to create an Apple Developer Enterprise account

Go to the Apple Developer Enterprise Program site.
In the top right of the page, click Enroll.
Read the checklist of what you need to enroll. Click Start Your Enrollment at the bottom of the page.
Sign in with the Apple ID of your organization. If you don't have one, click Create Apple ID.
Select your Entity Type and click Continue.
Fill out the form with your organization's information. Click Continue. At this point, Apple contacts you to verify that you are authorized to enroll your organization.
After verification, click Agree to License.
After agreeing to license, finish by purchasing and activating the program.
If you are the team agent (the person who joins the Apple Developer Enterprise Program on behalf of your organization), build your team first by inviting team members and assigning roles. To learn how to manage your team, read the Apple documentation on Managing Your Developer Account Team.

Steps to create an Apple signing certificate

Go to the Apple Developer portal.
In the top right of the page, click Account.
Sign in with your organizational Apple ID.
Click Certificates, IDs & Profiles.
Click the in the top right corner to add an iOS certificate.
Choose to create an In-House and Ad Hoc certificate under Production.
Note
If do not plan to distribute the app, and only want to test it internally, you can use an iOS App Development certificate instead of a certificate for Production. If you use a development certificate, make sure the mobile provisioning profile references the devices on which the app will be installed.
Click Next at the bottom of the page.
Read the instructions on creating a Certificate Signing Request (CSR) using the Keychain Access application on your macOS computer.
Follow the instructions above to create a Certificate Signing Request. On your macOS computer, launch the Keychain Access application.
On the macOS menu at the top of the screen, go to Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority.
Follow the instructions from the Apple developer site above on how to create a CSR file. Save the CSR file to your macOS computer.
Return to the Apple developer site. Click Continue. Then upload the CSR file.
Apple generates your signing certificate. Download and save it to a memorable location on your macOS computer.
Double-click the certificate file you just downloaded to add the certificate to a keychain.
Open Keychain Access again. Locate your certificate by searching for its name in the top right search bar. Right-click on the item to bring up the menu and click Get Info. In the example screens, we are using a development certificate instead of a production certificate.
An informational window appears. Scroll to the bottom and look under the Fingerprints label. Copy the SHA1 string (blurred out) to use as the argument for '-c' for the App Wrapping Tool.

Steps to create an In-House Distribution Provisioning profile

Go back to the Apple Developer account portal and sign in with your organizational Apple ID.
Click Certificates, IDs & Profiles.
Click the in the top right corner to add an iOS provisioning profile.
Choose to create an In House provisioning profile under Distribution.
Click Continue. Make sure to link the previously generated signing certificate to the provisioning profile.
Follow the steps to download your profile (with extension .mobileprovision) to your macOS computer.
Save the file in a memorable location. This file will be used for the -p parameter while using the App Wrapping Tool.

Download the App Wrapping Tool

Download the files for the App Wrapping Tool from GitHub to a macOS computer.
Double-click Microsoft Intune App Wrapping Tool for iOS.dmg. A window with the End User License Agreement (EULA) will appear. Read the document carefully.
Choose Agree to accept EULA, which mounts the package to your computer.

Intune App Wrapping Tool For Ios

Run the App Wrapping Tool

Important

Intune regularly releases updates to the Intune App Wrapping Tool. Regularly check the Intune App Wrapping Tool for iOS for updates and incorporate into your software development release cycle to ensure your apps support the latest App Protection Policy settings.

Use terminal

Open the macOS Terminal and run the following command:

Note

Some parameters are optional as shown in the following table.

Example: The following example command r