Provisioning

Application deployment

Ship a whole list of apps during provisioning, installed straight from the vendor, signature-verified, with no images and no re-hosting. Plus the ready-to-deploy catalogue.

2 min readUpdated Jul 31, 2026

Apps, as part of the setup

A device isn't ready to hand over until it has the software people actually use. StageReady installs applications as an ordinary provisioning step: add an Install applications step to a template, pick apps from the catalogue, and they install in order during setup, reported live and recorded permanently. One step, a whole list.

How it installs, and why that's cheap and safe

What happens to one app, on the device

Download

Straight from the vendor's own official URL, at install time.

Verify

Authenticode signature checked and matched to the expected publisher.

Install silently

Machine-wide, as SYSTEM, before anyone has signed in.

Report

Success or failure recorded against the job, per app.

  • Straight from the vendor. MSI/EXE apps download from the vendor's own official URL at install time (Google, Mozilla, Microsoft, and so on). Nothing is re-hosted or mirrored, so you're never shipping (or paying to store and serve) gigabytes of installers. The device pulls the latest version directly from the source.
  • Signature-verified. Every downloaded MSI/EXE has its Authenticode signature checked before it runs. A tampered or invalid signature is a hard stop; a valid signature is matched against the expected publisher. That's the trust evidence shown against each app in the catalogue.
  • Silent and machine-wide. Apps install unattended, for all users, as part of the automated pass, with no clicking through installers.
  • Winget too. Where an MSI/EXE isn't available, catalogue entries can install from Winget (these run once a user has signed in).

The ready-to-deploy catalogue

A curated, pre-tested set ships out of the box, installed machine-wide from the vendor and signature-verified:

  • Browsers: Google Chrome, Mozilla Firefox
  • Communication: Zoom, Microsoft Teams (machine-wide), Mozilla Thunderbird
  • Productivity & storage: Google Drive, Dropbox
  • Utilities & dev: Visual Studio Code, PuTTY

…plus a broader set available via Winget (Adobe Acrobat Reader, Slack, 7-Zip, VLC, Notepad++, LibreOffice, TeamViewer, AnyDesk, and more).

More apps are added continuously, and platform-curated additions appear for every client automatically.

Your own apps, your own catalogue

  • Add your own. Any organisation can add its own applications, whether that's a line-of-business MSI/EXE on an official HTTPS URL or a Winget package, and they sit alongside the curated defaults.
  • One catalogue, every template. Apps you add are reusable across every template and client; you never paste an installer or a hash by hand.

What can't be a machine-wide install

Some consumer apps (WhatsApp, Company Portal, and similar) are Microsoft Store (MSIX) or per-user installers by design, so they can't be installed machine-wide before someone signs in.

These aren't ours to install

Company Portal is best delivered through Intune/Autopilot, and Store apps arrive after first sign-in. We say so here rather than shipping a default that quietly fails on every build.