Secure Contacts Intune Deployment and Configuration

Secure Contacts App (SCA) is an enterprise contact management solution that lets organizations securely manage, synchronize, and distribute business contacts across managed devices. Learn more at secure-contacts.com.

This repository is the deployment and configuration companion for the official SCA Desktop releases. The signed Windows MSI and macOS PKG release assets are published in the SCA Desktop Releases repository; this repository provides the documentation, configuration templates, validation tools, and Intune update automation used to manage those releases.

The SCA application source code is maintained separately and is not published in this repository.

It supports two related responsibilities for Secure Contacts desktop apps in Microsoft Intune:

1. App deployment and updates: validate releases and update existing Windows and macOS Intune apps through manual, script-assisted, or pipeline-based workflows.
2. App configuration: configure the Secure Contacts policies that the applications consume on managed Windows and macOS devices.

The repository is update-only for application lifecycle operations. The target Intune apps, assignments, and device-side detection rules must be created and configured manually in the tenant before automation is used. Publishing never creates a new app, changes assignments, or creates supersedence relationships. Windows publishing replaces the existing MSI detection rule when the MSI ProductCode changes, preserves unrelated rules, and never appends a second MSI rule.

For first-time deployment and pilot validation, follow the SCA Desktop Admin Quickstart.

It covers:

• Enterprise application consent
• Windows and macOS App Configuration
• Manual Intune application creation
• Pilot deployment and validation
• Optional update automation

Choose the operating system, then select the execution method:

The script-assisted guide contains platform-specific prerequisites, validation commands, authentication settings, What-If behavior, output artifacts, and cleanup operations. The CI guides add workflow triggers, secret handling, artifacts, and approval controls.

Use the platform-specific configuration assets and guides:

Configuration is separate from application publishing. The files under config/Windows and config/MacOS are policy templates and configuration references; they do not install the application or create the Intune app. Configure production values in the tenant or approved profile payloads, assign profiles to the intended device groups, and validate them on pilot devices.

Prebuilt SCA Desktop packages are published through GitHub Releases in the SCA Desktop Releases repository.

Supported package types are:

• Windows: .msi and .exe
• macOS: .pkg and .dmg

The scripts in this repository resolve the approved release assets, verify their checksums and platform identity, and use them for validation or updates. Keep the release repository as the source of truth for package binaries and this repository as the source of truth for deployment, configuration, and operational documentation.

All supported update paths compare a release with the existing Intune app before making changes.

Use this path when an administrator wants to control every step without using the repository scripts or either pipeline:

1. Select a published release from Provectus-Software-GmbH/SCA_Desktop_Releases.
2. Download the platform installer and its matching checksum file.
3. Verify the checksum and package signature or identity using the platform's approved tools.
4. Prepare the installer using the organization's approved Intune packaging process.
5. Compare the release with the existing Intune app version.
6. Update the existing app through Intune administration tools and retain the release, verification, and update records.

This repository does not provide a separate manual packaging command. Follow your organization's Intune packaging and change-control procedures for the exact administrative steps.

Run the PowerShell or Bash scripts on an administrator workstation. Start with the script-assisted README, which contains the detailed guide and links to the scripts and validator.

Use the existing CI integrations when you need repeatable execution, centralized secret handling, artifacts, cleanup, or approval controls:

• GitHub Actions
• Azure DevOps

Those documents contain platform-specific pipeline triggers, secret configuration, artifact handling, environment approvals, and CI cleanup details.

Each CI integration is portable. An administrator can copy the complete .github folder into a GitHub repository or the complete .azure-pipelines folder into an Azure DevOps repository without cloning this repository. Each folder includes its own workflow or pipeline definitions and script copies; the duplication with script-assisted is intentional.

The configuration guides explain which template to use, where production values belong, how to assign the resulting profile, and how to validate managed settings on a pilot device.

Application deployment and configuration have different ownership boundaries:

• Intune administrators create the initial apps, configure assignments and detection rules, enter production policy values, and approve rollout.
• This repository validates release artifacts, packages and updates existing apps when requested, provides configuration templates, and documents operational workflows.
• The release repository remains the source of published Windows MSI and macOS PKG assets.

Test every application update and configuration profile on a pilot device before broad assignment. Keep credentials, certificates, private keys, and production policy values out of source control.