# App distribution > How to distribute the Ironchip mobile app and desktop agents (Windows, Linux, macOS, and RFID): stores, MDM, GPO, custom app, and USB allowlist. URL: https://docs.ironchip.com/en/identidad/administracion/distribucion-de-la-app/ The Ironchip mobile app is distributed publicly, privately, or as a custom-branded app. Desktop agents are deployed at scale with GPO, MDM, or other management tools. ## Mobile app ### Public distribution Download the app from your device's store. **Google Play (Android):** 1. Open the **Play Store** app on your device. 2. Search for **Ironchip**. 3. **Download** the app. **App Store (iOS):** 1. Open the **App Store** app on your device. 2. Search for **Ironchip**. 3. **Download** the app. ### Private distribution Ironchip has a private app repository for organizations that need one, such as those that centrally manage their corporate mobile devices. There are two options: - **MDM**: on-demand private distribution, integrated into the corporate MDM platform (for example, Microsoft Intune, VMware Workspace ONE, JAMF for iOS, or Kandji). Ironchip provides the app package so you can distribute it silently. - **Private link**: Ironchip provides a private link for direct download within the organization, without going through the public stores. :::tip MDM distribution is the recommended method in corporate environments with active EMM (Enterprise Mobility Management). Contact the Ironchip team to get the private distribution package. ::: ### Custom app Ironchip offers a custom app that matches your company's look: logo, colors, and application name. You can deploy it publicly (stores) or privately (MDM or link). Contact the Ironchip team so that all your requirements are included. ### Supported devices - Android 6.0 or later. Electromagnetic signals are available from Android 8.0. - iOS 10.0 or later. ## Desktop agent for Windows The desktop agent (Ironchip Desktop App) for Windows is distributed as an `.msi` installer. You can download it from the **Plugins** section of the console or from [GitHub (Ironchip-Windows-Logon)](https://github.com/Ironchip-Security/Ironchip-Windows-Logon/releases). There are three deployment methods. ### Mass deployment with GPO This is the recommended method for on-premises AD. 1. Download the `.msi` installer from the **Plugins** section of the console. 2. On the domain server, open the Group Policy Management Console (GPMC). 3. Create or edit a GPO and link it to the organizational unit (OU) that contains the target computers. 4. Go to **Computer Configuration > Policies > Software Settings > Software installation** and add the `.msi` package. 5. The software installs automatically on all domain computers at the next restart or when policies refresh (`gpupdate /force`). You can preconfigure the Ironchip company API key in the GPO so the installation is fully silent, with no user interaction. :::note With GPO you can turn on **Exclude other providers** through an installation parameter. This makes Ironchip the only Windows credential provider on every computer in the OU, with no manual intervention. ::: ### Deployment with MDM or Intune This is the recommended method for cloud or hybrid environments. 1. Upload the `.msi` installer to Microsoft Intune (or an equivalent MDM tool). 2. Create an app deployment policy assigned to the target device group. 3. Configure the silent installation parameters (API key and production environment). 4. Intune deploys the app to the assigned devices at the next sync cycle. It is compatible with Microsoft Intune, SCCM / Microsoft Endpoint Configuration Manager, Jamf (macOS), Kandji (macOS), and ManageEngine MDM. ### Manual installation For pilots or small groups: run the `.msi` installer directly on the computer and enter the API key in the installation wizard. This isn't recommended for deployments of more than 20 computers. For more information about the agent, see [Windows logon](https://docs.ironchip.com/en/identidad/integraciones/puestos/windows-logon/). ## Desktop agent for Linux and macOS ### Linux The Ironchip PAM module for Linux (`pam_ironchip_auth.so`) is distributed from the **Plugins** section of the console. To deploy it across a fleet of Linux servers, use Ansible, Puppet, or Chef to automate copying the module and editing the files in `/etc/pam.d/` on all target servers. Example with Ansible: ```bash ansible-playbook ironchip_pam.yml -i inventario.ini ``` ### macOS The PAM module for macOS is distributed with JAMF Pro or Kandji. The flow is: 1. Upload the `.pkg` of the PAM module to JAMF. 2. Create a deployment policy assigned to the corporate Macs. 3. Run a post-installation script that automatically edits the file in `/etc/pam.d/` with the company API key. For more information, see [macOS logon](https://docs.ironchip.com/en/identidad/integraciones/puestos/macos-logon/). ## RFID agent The `IronchipRFID.exe` agent is distributed from the **Plugins** section of the console. To deploy it on several computers with RFID readers: 1. Distribute the executable with GPO or with a software deployment tool. 2. Configure the API key with a PowerShell script that runs as a logon task or as a GPO script. The configuration command is: ```powershell .\IronchipRFID.exe c --api_key ``` You can fully automate this process on domain computers, with no user intervention. For more information, see [RFID](https://docs.ironchip.com/en/identidad/usuarios/rfid/). ## USB allowlist with GPO To allow only specific USB devices on domain computers: ### Get the hardware ID of the USB device 1. Open Device Manager. 2. Find the USB device and open its properties. 3. Go to the **Details** tab and select **Hardware Ids** in the drop-down menu. Write down the hardware ID. ### Allow specific devices 1. Open the Group Policy Editor (`gpedit.msc`). 2. Go to **Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions**. 3. Open the policy **Allow installation of devices that match any of these device IDs**. 4. Set it to **Enabled**. 5. Click **Show**. 6. Enter the hardware ID of the USB device you wrote down. [Image: Policy to allow installation of devices with specific IDs] ### Block unapproved devices 1. In the Group Policy Editor, go to **Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions**. 2. Open the policy **Prevent installation of devices not described by other policy settings**. 3. Set it to **Enabled**. [Image: Policy to prevent installation of unapproved devices]