What's new
What changed, and when
Every change that reached customers, newest first, in plain terms. Work that is still on a branch is not here; when it ships, it is.
Known vulnerabilities on every app and update
Update Candidates gained a Security column ("Fixes 2 CVEs (max 9.8)", with an Exploited chip for CVEs on CISA's Known Exploited Vulnerabilities list) and a Security-updates-only filter. Deployed Apps shows the open CVEs on the version your devices run, and an app's page lists affected versions with their CVEs, each linked to NVD. A per-app CVSS fast-track lets auto-approve skip the delay for a fix at or above the score you set, or for anything actively exploited. About two hundred common apps are covered out of the box; apps without data say nothing rather than claiming to be clean.
Version history for macOS and MSIX apps
Every deployed macOS and MSIX app now records each published version, the same way Windows Win32 apps always did, so Deployed Apps shows a real version count, the history is browsable, and rollback is available for them. Apps deployed earlier pick this up on their next publish.
macOSFixPackaging a Mac app whose download has no published hash
Some vendors serve the latest macOS build from a fixed address and publish no checksum (Google Chrome, AnyDesk, Adobe Acrobat Pro and about 160 others). The plan page used to break on those; it now packages them and says "none published" where the SHA-256 would be, with a note that the download cannot be verified.
macOSFixBook a demo from the site
The contact page shows a calendar for a 30-minute walkthrough over Teams, and every "Book a demo" button leads to it.
SiteContact →A walkthrough of the whole job on the home page
The home page shows the product working: search returning a Windows and a macOS installer, a packaging job running its steps, apps landing in a tenant, an update moving through rings, and an existing deployment being adopted, plus a 74-second walkthrough with chapters you can jump between.
SiteWatch it →Apps that can only be packaged at their newest version warn up front
A few vendors replace the installer at one fixed download address with every release (Google Chrome on Windows is the common one), so an older version can never be verified. The plan now says so before you package and names the version that will build, instead of failing after the download.
CatalogFixmacOS apps no longer claim to be Apple silicon only
Every Mac app showed an arm64-only warning, telling you that most of the catalog would not install on Intel Macs. Architecture now comes from the app's Intel and Apple silicon variants, so universal apps read as universal.
macOSFixUser documentation at patchbee.io/docs
Task-oriented guides with worked examples: getting started, connecting a tenant, finding and packaging apps, deploying many at once, tracking deployed apps, automating updates, app sets, macOS, migrating existing apps, notifications, customers, users, troubleshooting.
SiteDocs →Migrate sees every Intune app type, and assignments are edited in place
Migrate lists everything in your tenant (Win32, MSIX, macOS PKG and DMG, and the rest), matches it against the catalog and takes over updates for the ones you choose. Deployed Apps gained an assignment editor, so groups are changed without republishing.
Firefox, Thunderbird and Postman join the catalog
Mozilla Firefox and Thunderbird were added to the Windows catalog, and Postman to the macOS catalog.
CatalogEvery macOS disk image deploys
The bundle identifier is now read from the disk image itself, including compressed images that earlier could not be opened, so the Mac apps that failed with an unreadable identifier (Thunderbird, GIMP, calibre and others) deploy normally.
macOSFixPlans, trials and the 50-device Free limit
Free is free forever up to 50 Intune-managed devices with the full catalog and publishing. Pro and MSP start as a 30-day trial from the sign-up wizard, with no card anywhere. Above 50 devices on Free, publishing pauses until an upgrade; everything already published keeps working, and a trial that ends drops the workspace back to Free without deleting anything.
UpdatesPlans and feature access →patchbee.io is live
The site, real pricing, and the contact form that reaches a person.
Site
Try PatchBee on your tenant.
Sign in with your Microsoft work account, pick a plan, and connect your tenant. Free forever under 50 devices, or a 30-day trial of Pro or MSP. No card.