Stop hand-packaging apps for Intune.
PatchBee keeps 6,300+ Windows and macOS apps ready to deploy. Pick one and it does the packaging for you: it writes the install and detection logic, builds the .intunewin, then publishes and assigns it to your Entra groups, the same way on both platforms.
Free forever under 50 devices, or a 30-day trial of Pro. No card, either way. See how it works
6,300+ apps and counting, synced from winget & Homebrew. Browse the catalog
How it works
Five steps from signing in to an app on your devices. The first two happen once; every app after that takes the last three.
- 1
Sign in and pick a plan
Sign in with your Microsoft work account, answer a couple of questions, and choose Free or a 30-day trial. No card.
- 2
Connect your Intune tenant
A one-time Entra sign-in with encrypted, least-privilege credentials.
- 3
Pick an app from the catalog
Search 6,300+ Windows and macOS apps by name, publisher, or type.
- 4
Read the generated plan
Check the install commands and detection rules, and change anything before you package.
- 5
Publish and assign
PatchBee builds the .intunewin, publishes it, and assigns it to your groups.
Watch it work
One app, start to finish, in a minute
From a vendor shipping a new build to it landing on your fleet in rings. No narration, no edits, just the product doing the job.
Today, 09:14
Chrome shipped again.
So did thirty-nine other apps your fleet runs.
The old way
Download.Repackage.Test.Upload.Assign.
Per app. Per version. Forever.
One search, both platforms
PatchBee writes the plan
Install command
Uninstall command
Detection rule
Return codes
And builds it
Download112 MB
googlechromestandaloneenterprise64.msi
Verifyagainst the publisher manifest
SHA-256 F3B164BA3D3AB9A76B6E93ABAE3DD89E…
Packageintunewin built
GoogleChrome_152.0.7977.65.intunewin
Uploadblock blob committed
Intune content version 1
Publishwin32LobApp created
assigned to 3 Entra groups
Live in your tenant
Assigned to
Next version, hands off
It rolls out in rings, on your schedule
Ring 1 · Pilot
todayRing 2 · Broad
in 2 daysRing 3 · All
in 5 daysTomorrow, Chrome ships again
You do nothing.
PatchBee packages it, verifies it, publishes it, and moves it through your rings while you get on with something else.
Both platforms
Search once. Windows and Mac both answer.
Most catalogs make macOS a separate product, or a separate line on the invoice. Here it is the same search box, the same plan screen, and the same update rings.
Packaging job
Watch it build, step by step
Nothing is a black box. The download is verified against the publisher's own hash before anything is packaged, and every step is logged, so a failure tells you where and why.
Deployed apps
Know what is actually out there
Every app you have published, with the version on your devices beside the version in the catalog. When something falls behind it says so, and it does not wait for you to notice.
What PatchBee handles
Everything Intune makes you do by hand, automated
The tedious, error-prone parts of getting apps onto Intune, handled the same way across Windows and macOS.
Curated catalog
5,000+ Windows apps from winget and 1,300+ macOS apps from Homebrew, scoped to what companies actually deploy and ranked by real-world popularity. No more hunting vendor download pages.
One-click packaging
Pick an app and PatchBee generates the whole Intune plan: install and uninstall commands, detection rules, requirements, and a signed .intunewin.
Publish to Entra groups
Connect your tenant once. After that, packaging, publishing, and assigning to Entra groups all happen in one place.
Update automation
PatchBee spots new versions and rolls them out through staged rings, with auto-approve policies, supersedence, and one-click rollback. Updates that fix known CVEs are flagged, and critical ones can skip the queue.
Multi-tenant and MSP
Manage many customer Intune tenants from one console, with per-customer scoping so a job always lands in the right place.
Secure by design
Entra sign-in, encrypted connection secrets, SSRF-guarded downloads, and a SHA-256 check on every installer before it ships.
Update rings
Patch the brave first, the board last
Define pilot, broad and all, each with its own delay. A new version lands on a handful of machines, and only moves on once it has survived them. Pause, resume or roll back at any ring.
Ring 1 · Pilot
Immediately8 devices
Ring 2 · Broad
After 2 days64 devices
Ring 3 · All
After 5 days420 devices
Security updates
Patch what matters first
Every app and update carries its known CVEs, scored, with a flag on the ones attackers are already using. You see what an update fixes and what your fleet is exposed to before you decide how fast it goes out.
Scored from the public record
CVE records and CVSS scores come from the National Vulnerability Database. A CVE on CISA's Known Exploited Vulnerabilities list is flagged as exploited, even before NVD has scored it.
Filter the queue to what matters
Update Candidates can show security fixes only. Deployed Apps show how many CVEs are open on the version your devices actually run, coloured by the worst score.
Let critical fixes skip the queue
Set a CVSS threshold per app. An update that fixes a CVE at or above it, or one that is being exploited, is approved on the next sweep instead of waiting out your ring delay.
About two hundred of the most deployed apps are linked to their vulnerability records out of the box. An app without data says nothing rather than claiming it is clean.
How the security data worksThird-party patching
Third-party app patching in Intune, without the hand work
Chrome, Zoom, 7-Zip and 6,300+ other Windows and macOS apps, kept current in Microsoft Intune by one service instead of a packaging queue.
01
Detect
A nightly sweep compares every deployed app with the catalog and raises an update candidate the moment a vendor ships a new build.
02
Package
The new version is packaged with the same silent switches, detection rule and supersedence as the one before it, with no hand work in between.
03
Roll out
Rings decide who gets it first, auto-approve rules decide what goes without a person, and CVE data decides what goes first.
PatchBee patches applications. Windows and macOS operating system updates stay with Intune's own update policies, where they belong, and PatchBee never touches them.
Manual Intune vs PatchBee
The same job, minus the busywork
What it takes to get one app onto Intune by hand, and what it takes with PatchBee.
| Task | Doing it by hand | With PatchBee |
|---|---|---|
| Time per app | 45–90 minutes* | About 2 minutes |
| Detection rules | Written by hand, hoping they match | Auto-generated and shown to you |
| Silent-install switches | Guessed, then tested on a VM | Known and pre-filled per installer |
| Updates | Re-package the app every release | Staged rings, supersedence, one-click rollback |
| macOS | A separate, manual process | Same catalog, same console |
| Installer integrity | Manual checks, or none | SHA-256 verified before packaging |
* 45–90 minutes is the widely cited industry norm for manually packaging a single app for Intune, not a PatchBee measurement.
By the numbers
Every app in the catalog has a working path to Intune.
Packaging one app used to mean chasing an installer, then guessing the right silent-install switches, then writing detection rules by hand, and repeating all of it on the next update.
PatchBee does that work and shows you the result before anything ships, so a package that took an afternoon takes a couple of minutes and behaves the same on Windows and macOS.
- 6,300+
- apps ready to deploy
- 2
- platforms, one console
- SHA-256
- verified before it ships
- 100%
- have a working deploy path
Migrate
Keep everything you have already deployed
PatchBee reads your tenant, matches what is already there against the catalog, and takes over updates for the ones you choose. Nothing is republished, nothing is deleted, and anything you leave alone keeps working exactly as it does now.
Security
Works with your Intune, on your terms
PatchBee connects to your tenant with least privilege and keeps the sensitive parts locked down. No agents, no surprises.
Your tenant stays the source of truth
PatchBee works with Intune through the Microsoft Graph. There's no agent to install and nothing to run on your endpoints. Your tenant remains the system of record; PatchBee just does the packaging.
Least-privilege Graph permissions
PatchBee requests only the Graph scopes it needs to package, publish, and assign. Nothing more.
Encrypted connection secrets
Tenant connection secrets are encrypted at rest and never shown back to you in the UI.
SSRF-guarded downloads
Installers are fetched through SSRF-guarded requests, so PatchBee only pulls from the real source.
SHA-256 verified installers
Every installer is hashed and checked before packaging, so what ships is what the publisher released.
Pricing
Simple plans, the full catalog on every one
Every plan includes all 6,300+ apps across Windows and macOS. Update automation and MSP mode scale up from there.
Free
Up to 50 devices
The whole packaging workflow for a small fleet, free forever.
Pro
Unlimited devices
Keep a whole fleet current, automatically, across any number of devices.
MSP / Enterprise
Many tenants
For MSPs and large estates spanning many customer tenants.
Free forever for up to 50 devices, or try Pro or MSP for 30 days. No card at any point.
FAQ
Questions, answered
The things IT teams ask before they connect a tenant.
How do I get started, and do I need a card?
Select Start free and sign in with your Microsoft work account. PatchBee asks for your company name, your role, and roughly how many devices you manage, then you pick a plan: Free forever under 50 devices, or a 30-day trial of Pro or MSP. No card, at any point. If you later decide to stay on a paid plan, we email you an invoice.
What Entra permissions does PatchBee need?
PatchBee signs in with Entra and requests least-privilege Microsoft Graph permissions, just enough to publish Win32, MSIX and macOS apps and assign them to the Entra groups you choose. It doesn't ask for scopes it doesn't use.
Where does packaging happen, and what happens to installer data?
PatchBee downloads each installer through SSRF-guarded requests, verifies its SHA-256, and builds the .intunewin or macOS package before handing it to Intune. Installers come straight from the publisher's source, and connection secrets are encrypted at rest.
Does anything reach my tenant without my approval?
No. PatchBee shows you the full generated plan (install and uninstall commands, detection rules, and requirements) and nothing publishes or assigns to your tenant until you approve it.
What happens when a package breaks?
Updates roll out through staged rings, so a bad build is caught before it reaches everyone. Supersedence chains upgrades cleanly, and one-click rollback returns you to the last known-good version.
Does PatchBee show which updates fix security vulnerabilities?
Yes. Apps and updates carry their known CVEs with CVSS scores from the National Vulnerability Database, plus a flag when a CVE is on CISA's list of actively exploited vulnerabilities. Update Candidates can be filtered to security fixes only, Deployed Apps show the open CVEs on the version your devices run, and auto-approve can skip its waiting period when a fix clears a CVSS threshold you set.
Do I need to install an agent?
No. PatchBee works with Intune through the Microsoft Graph. There's nothing to deploy to your endpoints. Intune stays the delivery mechanism and your tenant stays the source of truth.
How does macOS packaging work?
macOS pkg and dmg installers are packaged for Intune with bundle-identity based detection, so they deploy and detect the same way your Windows apps do, from the same console.
Can MSPs keep customers separate?
Yes. MSP mode runs many customer tenants from one console with per-customer scoping, so every packaging and assignment job lands in the right tenant and customers stay isolated.
Try PatchBee on your tenant.
Sign in with your Microsoft work account, pick a plan, and connect your tenant. Free forever under 50 devices, or a 30-day trial of Pro or MSP. No card.