Solutions · Managed service providers
Intune patch management for MSPs
Package and patch the third-party Windows and macOS apps your customers run, in every Intune tenant you manage, from one console. New versions are detected nightly, packaged with the right switches and detection rule, and rolled out through rings, with CVE and KEV flags saying what goes first. 6,300+ apps, and Windows itself stays with Windows Update.
Multi-tenant operation
One console, every customer
Each customer is a separate Intune tenant with its own catalog and deployments. MSP mode keeps them that way while you work on all of them from one place.
Per-customer scoping
Pick the customer, then the Intune tenant. Every packaging, publishing and assignment job lands in the tenant you chose, and each customer's catalog, deployments and history stay isolated from the others.
Unlimited tenants
MSP / Enterprise has no tenant limit. Connect each customer's tenant once, with the least-privilege permissions their administrator consents to, and switch between customers without signing out.
Nothing ships unseen
Every package starts as a plan: install and uninstall commands, detection rule, requirements and the installer's hash, shown in full. Nothing is published or assigned to a customer's tenant until someone approves it.
Rings and rollback
Patch the pilot group first, everyone else later
A bad build should be found on ten devices, not a thousand. Updates go out in stages, and coming back is one click.
01
Rings with a delay between them
Pilot, broad and all, each with its own delay. A new version lands on a handful of machines first and only moves on once it has survived them.
02
Supersedence, written for you
Each update is a new Intune app with a version-aware detection rule and a supersedence relationship to the previous package, and the assignments carry across.
03
Rollback in one click
The last known-good version supersedes the bad one and takes the assignments back. The version history of every deployed app is kept, so you can see which package each device got.
CVE and KEV flags
Know what an update fixes before you approve it
Every update says which vulnerabilities it closes and whether any of them are being exploited, so the queue can be worked by risk rather than by date.
- CVE records and CVSS scores from the National Vulnerability Database on every app and update
- An Exploited flag when a CVE is on CISA's Known Exploited Vulnerabilities list, even before NVD has scored it
- A security-updates-only filter on the update queue, and the open CVEs on the version each customer's devices run
- A CVSS threshold per app: a fix at or above it, or one being exploited, skips the auto-approve delay
- How the security data works
Plans
Free to start, quoted per estate at scale
Every plan includes the full 6,300+ app catalog and the CVE data. Device count, update automation and the multi-tenant console scale up from there.
Free
Up to 50 devices
The whole packaging workflow for a small fleet, free forever.
Pro
Unlimited devices
Keep a whole fleet current, automatically, across any number of devices.
MSP / Enterprise
Many tenants
For MSPs and large estates spanning many customer tenants.
Free is free forever for up to 50 devices. Pro and MSP / Enterprise start as a 30-day trial and are invoiced by email, at $3 per device per year for Pro and a quote per estate for MSPs. There is no card anywhere in PatchBee.
Every plan, side by sideWhere the line is
Applications, not operating systems
PatchBee keeps third-party applications patched. Windows quality and feature updates stay with Windows Update for Business or Windows Autopatch, macOS updates with Intune's own update policies, and PatchBee never touches either. The two systems run side by side, ideally on the same pilot group.
FAQ
Questions MSPs ask
Can I run every customer's Intune tenant from one console?
Yes. MSP mode puts every customer and their Intune tenants in one console. You pick the customer, then the tenant, and every packaging, publishing and assignment job is scoped to that tenant; customers never see each other's catalog or deployments. MSP / Enterprise has no tenant limit.
What does the MSP plan cost?
MSP / Enterprise is quoted per estate (custom volume pricing). The multi-tenant console is self-serve to trial for 30 days, with no card. For a single tenant, Free covers up to 50 devices and Pro is $3 per device per year. Paid plans are invoiced by email.
Does PatchBee patch Windows or macOS itself?
No. PatchBee packages and patches third-party applications. Windows quality and feature updates stay with Windows Update for Business or Windows Autopatch, macOS updates with Intune's own update policies, and PatchBee never touches either.
Does anything reach a customer's tenant without approval?
No. Every package starts as a plan showing the install and uninstall commands, the detection rule, the requirements and the installer's hash, and nothing is published or assigned until someone approves it. Update automation then runs inside the rings, delays and auto-approve rules you set, and any ring can be paused or rolled back.
How do I see which updates fix vulnerabilities?
Every app and update carries its known CVEs with CVSS scores from the National Vulnerability Database, plus an Exploited flag when a CVE is on CISA's Known Exploited Vulnerabilities list. The update queue can be filtered to security fixes only, Deployed Apps show the open CVEs on the version each customer's devices run, and a CVSS threshold you set lets critical fixes skip the auto-approve delay.
Do I need an agent on customer devices?
No. PatchBee works through the Microsoft Graph with least-privilege permissions each customer's administrator consents to. Nothing runs on endpoints: Intune stays the delivery mechanism and the customer's tenant stays the source of truth.
Run every customer's patching from one console.
Sign in with your Microsoft work account and start a 30-day trial of MSP / Enterprise. The multi-tenant console is self-serve to try; only the price is quoted. No card.