Stop hand-packaging apps for Intune.
PatchBee keeps 6,300+ Windows and macOS apps ready to deploy. Pick one and it does the packaging for you: it writes the install and detection logic, builds the .intunewin, then publishes and assigns it to your Entra groups, the same way on both platforms.
Free forever under 50 devices, or a 30-day trial of Pro. No card, either way.
6,300+ apps and counting, synced from winget & Homebrew.
How it works
Sign up and connect once, then every app follows the same three steps.
- 1
Sign in and pick a plan
Sign in with your Microsoft work account, answer a couple of questions, and choose Free or a 30-day trial. No card.
- 2
Connect your Intune tenant
A one-time Entra sign-in with encrypted, least-privilege credentials.
- 3
Pick an app from the catalog
Search 6,300+ Windows and macOS apps by name, publisher, or type.
- 4
Read the generated plan
Check the install commands and detection rules, and change anything before you package.
- 5
Publish and assign
PatchBee builds the .intunewin, publishes it, and assigns it to your groups.
What PatchBee handles
Everything Intune makes you do by hand, automated
The tedious, error-prone parts of getting apps onto Intune, handled the same way across Windows and macOS.
Curated catalog
4,551 Windows apps from winget and 1,321 macOS apps from Homebrew, scoped to what companies actually deploy and ranked by real-world popularity. No more hunting vendor download pages.
One-click packaging
Pick an app and PatchBee generates the whole Intune plan: install and uninstall commands, detection rules, requirements, and a signed .intunewin.
Publish to Entra groups
Connect your tenant once. After that, packaging, publishing, and assigning to Entra groups all happen in one place.
Update automation
PatchBee spots new versions and rolls them out through staged rings, with auto-approve policies, supersedence, and one-click rollback when a build goes wrong.
Multi-tenant and MSP
Manage many customer Intune tenants from one console, with per-customer scoping so a job always lands in the right place.
Secure by design
Entra sign-in, encrypted connection secrets, SSRF-guarded downloads, and a SHA-256 check on every installer before it ships.
The plan engine
See the exact plan before anything ships
PatchBee inspects each app and builds a deployment plan you can read, and change, before it ships. MSI, EXE, pkg, dmg, and native MSIX each get the right handling.
Windows package plan
Generated msiexec install and uninstall commands, with detection rules you can review.
Install command
msiexec /i "GoogleChromeStandalone.msi" /qn /norestartDetection rule
file C:\Program Files\Google\Chrome\Application\chrome.exe
version ≥ 126.0
macOS bundle-identity detection
pkg and dmg installers deploy with bundle-identity detection.
Deployment dashboard
Catalog totals, recent packaging jobs, and the last catalog sync at a glance.
Manual Intune vs PatchBee
The same job, minus the busywork
What it takes to get one app onto Intune by hand, and what it takes with PatchBee.
| Task | Doing it by hand | With PatchBee |
|---|---|---|
| Time per app | 45–90 minutes* | About 2 minutes |
| Detection rules | Written by hand, hoping they match | Auto-generated and shown to you |
| Silent-install switches | Guessed, then tested on a VM | Known and pre-filled per installer |
| Updates | Re-package the app every release | Staged rings, supersedence, one-click rollback |
| macOS | A separate, manual process | Same catalog, same console |
| Installer integrity | Manual checks, or none | SHA-256 verified before packaging |
* 45–90 minutes is the widely cited industry norm for manually packaging a single app for Intune, not a PatchBee measurement.
By the numbers
Every app in the catalog has a working path to Intune.
Packaging one app used to mean chasing an installer, then guessing the right silent-install switches, then writing detection rules by hand, and repeating all of it on the next update.
PatchBee does that work and shows you the result before anything ships, so a package that took an afternoon takes a couple of minutes and behaves the same on Windows and macOS.
- 6,300+
- apps ready to deploy
- 2
- platforms, one console
- SHA-256
- verified before it ships
- 100%
- have a working deploy path
Security
Works with your Intune, on your terms
PatchBee connects to your tenant with least privilege and keeps the sensitive parts locked down. No agents, no surprises.
Your tenant stays the source of truth
PatchBee works with Intune through the Microsoft Graph. There's no agent to install and nothing to run on your endpoints. Your tenant remains the system of record; PatchBee just does the packaging.
Least-privilege Graph permissions
PatchBee requests only the Graph scopes it needs to package, publish, and assign. Nothing more.
Encrypted connection secrets
Tenant connection secrets are encrypted at rest and never shown back to you in the UI.
SSRF-guarded downloads
Installers are fetched through SSRF-guarded requests, so PatchBee only pulls from the real source.
SHA-256 verified installers
Every installer is hashed and checked before packaging, so what ships is what the publisher released.
Pricing
Simple plans, the full catalog on every one
Every plan includes all 6,300+ apps across Windows and macOS. Update automation and MSP mode scale up from there.
Free
Up to 50 devices
The whole packaging workflow for a small fleet, free forever.
Pro
Unlimited devices
Keep a whole fleet current, automatically, across any number of devices.
MSP / Enterprise
Many tenants
For MSPs and large estates spanning many customer tenants.
Free forever for up to 50 devices, or try Pro or MSP for 30 days. No card at any point.
FAQ
Questions, answered
The things IT teams ask before they connect a tenant.
How do I get started, and do I need a card?
Select Start free and sign in with your Microsoft work account. PatchBee asks for your company name, your role, and roughly how many devices you manage, then you pick a plan: Free forever under 50 devices, or a 30-day trial of Pro or MSP. No card, at any point. If you later decide to stay on a paid plan, we email you an invoice.
What Entra permissions does PatchBee need?
PatchBee signs in with Entra and requests least-privilege Microsoft Graph permissions, just enough to publish Win32, MSIX and macOS apps and assign them to the Entra groups you choose. It doesn't ask for scopes it doesn't use.
Where does packaging happen, and what happens to installer data?
PatchBee downloads each installer through SSRF-guarded requests, verifies its SHA-256, and builds the .intunewin or macOS package before handing it to Intune. Installers come straight from the publisher's source, and connection secrets are encrypted at rest.
Does anything reach my tenant without my approval?
No. PatchBee shows you the full generated plan (install and uninstall commands, detection rules, and requirements) and nothing publishes or assigns to your tenant until you approve it.
What happens when a package breaks?
Updates roll out through staged rings, so a bad build is caught before it reaches everyone. Supersedence chains upgrades cleanly, and one-click rollback returns you to the last known-good version.
Do I need to install an agent?
No. PatchBee works with Intune through the Microsoft Graph. There's nothing to deploy to your endpoints. Intune stays the delivery mechanism and your tenant stays the source of truth.
How does macOS packaging work?
macOS pkg and dmg installers are packaged for Intune with bundle-identity based detection, so they deploy and detect the same way your Windows apps do, from the same console.
Can MSPs keep customers separate?
Yes. MSP mode runs many customer tenants from one console with per-customer scoping, so every packaging and assignment job lands in the right tenant and customers stay isolated.
Try PatchBee on your tenant.
Sign in with your Microsoft work account, pick a plan, and connect your tenant. Free forever under 50 devices, or a 30-day trial of Pro or MSP. No card.