Scenario D: App Delivery / App-Centric (Hidden Windows)

Who this fits

Organizations that want to deliver a single Windows application to users without exposing Parallels Desktop or Windows at all.

Architecture at a glance

This scenario doesn't use the Management Portal, Golden Images, or Policies — those apply to Scenarios A–C, not this one. Instead: an admin builds a single Windows VM manually in Parallels Desktop's Control Center, shuts it down completely, exports it via Prepare for Transfer into a .pvmp file, and uploads it to a secure storage location where it is available via a direct link that requires no authentication. Configure the Autodeploy Package by editing the deploy.cfg configuration file and a Windows Application stub for the Dock, then build it into a .pkg using the package's Prepare script. Your MDM (Jamf Pro, Intune, Munki, Workspace ONE, or similar) distributes that .pkg directly to end-user Macs — there's no Portal-side provisioning step.

Deployment method and why

VM image (required). Single Application Mode needs exactly one VM packed as a .pvmp inside an Autodeploy Package — Declarative deployment and the Management Portal's Golden Image/Policy system aren't part of this path today.

Building the Autodeploy Package

1. Build the VM. In Parallels Desktop's Control Center, create and configure the Windows VM: enable auto-logon, apply the Productivity profile, remove the Sound and Camera devices, enable Always ready in background (under Options → Startup and Shutdown), and enable Share Mac applications with Windows (under Options → Applications).

2. Export it. Shut the VM down completely (not suspended), then use Prepare for Transfer to produce a .pvmp file. You can only add one virtual machine when using Single Application Mode. Upload it to a secure storage location where it is available via a direct link that requires no authentication.

3. Configure deploy.cfg:

   1. In the User Experience (optional) section, set enable_single_application_mode="yes".

   2. In the License section, either set license_key to your license, or comment out that line to use SSO instead.

   3. Include the direct virtual machine download link in the respective section of the file.

4. Add the Windows Application stub. This is mandatory for Single Application Mode — it's what registers the Windows app's icon and file associations on the Mac.

5. Run ./prepare --dest {destination_folder} to produce the final .pkg.

6. Distribute the .pkg through your MDM.

Prerequisites

A Business or Enterprise edition of Parallels Desktop for Mac; a device management solution that supports Mac (Jamf Pro, Intune, Munki, Workspace ONE, or similar); a Microsoft Windows license and a KMS server. Single Application Mode isn't supported for Linux or macOS machines. Once deployed, Single Application Mode can't be turned off by redeploying with the setting changed — removing it requires a full uninstall.

Role handoffs

This scenario's roles differ from Scenarios A–C, since there's no Portal Admin step:

• Mac Admin — builds and configures the VM, exports it, and builds the Autodeploy Package.

• License Admin — decides license-key vs. SSO activation for the package.

• MDM Admin — distributes the finished .pkg through Jamf Pro, Intune, or the equivalent.

Verification

Confirm the .pkg shows as installed in your MDM's reporting. On a test Mac, confirm only the Windows application's icon appears in the Dock — no Parallels Desktop icon, UI, or VM window — and that the application opens and functions normally.

Where to go next

See the Single Application Mode guide and the Autodeploy Package preparation pages for the full walkthrough.