Intune third party patching

Intune Patch Management: Automate Third-Party Updates

Automate third-party patch management in Microsoft Intune with ManageEngine Patch Connect Plus. Publish updates for 800+ applications, use deployment templates, attach pre/post scripts, and enforce compliance without manual Win32 packaging. Free 30-day trial with full Intune patching on the Enterprise edition.

overview

What is Intune patch management?

Intune patch management is the process of deploying, tracking, and enforcing software updates on devices enrolled in Microsoft Intune. For Windows OS updates, Microsoft provides built-in tools: Windows Update for Business policies, update ring configurations, and Windows Autopatch handle quality and feature updates out of the box.

Third-party applications are a different story. Intune does not maintain a native catalog of third-party patches. Apps like Google Chrome, Adobe Reader, Zoom, Java, and Firefox need to be manually packaged as Win32 .intunewin files, uploaded individually, and re-uploaded every time a vendor ships a new version. That's the gap Patch Connect Plus fills.

Capabilities covered by native Intune:

  • Windows OS updates
  • Update ring policies
  • Windows Autopatch
  • Microsoft 365 app updates
  • Driver updates
  • Deployment reporting

Why native Intune patch management falls short for third-party apps

Intune is built around Microsoft's own update ecosystem. It handles Windows quality updates, driver updates, and Microsoft 365 app updates well. Once you move outside Microsoft's catalog, the experience drops off.

  • No third-party app catalog

    Intune does not ship with a pre-built repository of third-party application updates. Every non-Microsoft app has to be sourced, packaged, and uploaded manually.

  • Manual Win32 packaging for every release

    Each vendor update means re-downloading the installer, wrapping it as an .intunewin file using the Win32 Content Prep Tool, configuring detection rules, and uploading it to Intune. Multiply that across 30, 50, or 100 apps and the overhead is significant.

  • Limited cross-vendor compliance visibility

    Intune's compliance reporting covers Microsoft updates. Telling whether Adobe Reader 24.005 is installed across 3,000 endpoints, or whether an old version of Java is still running on 200 machines, requires additional tooling.

  • No automated supersedence for third-party apps

    When a new version of Chrome ships, the old version doesn't automatically retire in Intune. Admins have to manage version conflicts and cleanup manually.

  • Patch Connect Plus addresses each of these gaps.

    It plugs into your Intune tenant and adds a curated catalog of 800+ third-party apps, automated publishing, supersedence management, and compliance reporting.

How Patch Connect Plus enables third-party patching in Intune

Patch Connect Plus has progressed from on-premises SCCM patch management to full cloud device management with Intune. All existing users with an Enterprise license can update to the latest build and find Intune added under the Third Party Updates tab, allowing a quick toggle between cloud and on-premises management.

The product supports the following capabilities to make Intune patch management practical at scale:

  • Automated publishing of third-party patches
  • Superseded update management
  • Pre-defined deployment templates
  • Custom pre/post deployment scripts

Automated publishing of third-party patches in Intune

Patch Connect Plus identifies third-party applications that have been created within Intune and automatically publishes updates as they get released by vendors. New builds are typically available within 6 to 9 hours of vendor release. This takes the bulk of the workload away from IT admins: no manual download, no repackaging, no re-upload.

console

Superseded update management in Intune

Patch Connect Plus gives you control over how superseded software updates are handled in the Intune console. You can choose to retain or remove older versions based on your environment's needs.

  • Retain superseded updates: Keep the list of superseded updates visible under All apps in the Intune console. Disable this if you only need the most recent version displayed.
  • Retain superseded application updates: Same control, scoped to application-level updates rather than individual patches.
  • Delete superseded updates after a set period: Choose how many days superseded updates stay in the Intune console before automatic removal (maximum: 60 days).
config

Pre-defined deployment templates for Intune patching

Similar to the Intune Application Management feature, managing updates to Intune supports ready-to-use templates for controlling deployment behaviour on managed devices. These templates cover common use cases:

  • Skip if app is running
  • Uninstall older patches
  • Suppress start menu icons
  • Suppress taskbar icons
  • Suppress desktop shortcuts

Custom pre/post scripts for Intune third-party patching

Patch Connect Plus allows granular control over Intune third-party patching according to enterprise-specific goals. Upload custom scripts for pre and post-deployment activities to manage client-side behaviour before and after each update. Common uses include:

  • Applying follow-up configurations after the update completes.
  • Changing registry settings required by your security or licensing policies.
  • Creating or removing shortcuts that vendors add by default.
  • Creating or appending environment paths for developer tools and runtimes.

Patch compliance and reporting in Intune

Audit readiness is one of the main reasons teams invest in patch management tooling. Native Intune reporting covers Microsoft updates, but third-party compliance data is harder to pull together without additional tools.

Patch Connect Plus provides compliance visibility for every third-party application under management in Intune:

  • Installation status by app

    See which endpoints have the current version installed, which are missing the update, and which failed.

  • Failed deployment details

    Error codes, device names, last attempt timestamps, and last successful install dates.

  • Pending updates

    Applications where a newer vendor version exists but hasn't been published yet.

  • Coverage gaps

    Applications installed on endpoints but not currently under Patch Connect Plus management.

These reports are scoped to your Intune environment when you toggle to Intune in the console. Admins running co-management (SCCM + Intune) see both sets of data from the same interface.

Best practices for Intune third-party patch management

Patching third-party apps in Intune is simpler with the right process in place. These practices reflect what works in production environments, not theory.

  • Start with a baseline inventory

    Before publishing updates, know what's installed. Use Patch Connect Plus' auto-detection to scan your Intune-enrolled devices and identify which third-party applications are present and which versions are running.

  • Automate publishing, review exceptions

    Set Patch Connect Plus to auto-publish new vendor releases for your standard app portfolio (browsers, runtimes, productivity tools). Reserve manual review for niche or internally modified applications where you need to validate compatibility before rollout.

  • Use deployment templates for consistency

    Standardise your deployment behaviour using templates. Decide once whether to suppress shortcuts, uninstall old versions, or skip running applications, then apply that template across all updates instead of configuring each one individually.

  • Test with a pilot group first

    Assign new updates to a small Entra ID pilot group before rolling out to the full organisation. Catch issues early without impacting production broadly.

  • Monitor compliance weekly

    Review the patch compliance reports in Patch Connect Plus at least once a week. Focus on failed deployments and coverage gaps first, since those represent the highest risk.

  • Keep superseded updates on a cleanup schedule

    Configure automatic deletion of superseded updates after a set number of days (30 to 60 days is typical). This prevents clutter in the Intune console and keeps your app list manageable.

Get started: set up third-party patching in Intune

Five steps from download to your first published update. The full step-by-step guide has screenshots.

  • Step 1 : Download and install Patch Connect Plus

    Grab the installer from the free trial page. The Enterprise edition includes full Intune patching.

  • Step 2 : Connect to your Intune tenant

    In the Patch Connect Plus console, go to Admin > Intune Settings. Enter your Client ID, Tenant ID, and Client Secret from your Azure AD (Entra ID) app registration.

  • Step 3 : Enable third-party updates

    Open the Third Party Updates tab. Toggle to Intune. Patch Connect Plus syncs your managed devices and displays available third-party applications.

  • Step 4 : Configure auto-publishing and templates

    Select which applications to auto-publish. Apply a deployment template for default behaviour (suppress shortcuts, uninstall old versions, etc.). Attach pre/post scripts if needed.

  • Step 5 : Publish and assign

    Click Publish Now for your first batch. Assign the updates to an Entra ID group. The updates reach enrolled devices on the next sync cycle.

After the initial setup, new vendor releases are published automatically. The only ongoing manual step is reviewing the compliance reports and handling any failed deployments.

The bottom line If your team uses Microsoft Intune and needs to patch anything Microsoft didn't write, Patch Connect Plus is the most direct path from "we need this fixed" to "it's done."

Frequently asked questions about Intune patch management.

Yes, Microsoft Intune includes patch management capabilities for Windows OS updates via Windows Update for Business and Windows Autopatch. However, it does not natively patch third-party applications. For that, you need an integrated tool like Patch Connect Plus.

Connect Patch Connect Plus to your Intune tenant, enable third-party updates under the Third Party Updates tab, then configure auto-publishing rules and deployment templates. A full walk-through is available in our setup guide.

Intune does not natively patch third-party applications. Patch Connect Plus fills this gap by automatically identifying apps installed on Intune-managed devices, detecting new vendor releases, and publishing updates for 800+ applications without manual packaging.

Intune is designed for endpoint and mobile device management, not server patching. Windows Server environments are better served by WSUS or dedicated server management tools. Patch Connect Plus focuses on third-party patching for Intune-enrolled client endpoints.

The primary limitation is the lack of native third-party application support. Intune cannot patch apps like Chrome, Adobe Reader, or Java out of the box. It also provides limited granular reporting across a mixed application portfolio without additional tooling.

Windows Autopatch and update ring policies handle automated OS updates. For automated third-party patching, Patch Connect Plus continuously monitors vendor releases and publishes updates to Intune automatically once configured. No manual review is needed for each release.

Patch Connect Plus connects to your Intune tenant via Microsoft Graph API. Once linked, it syncs your managed devices and enables direct third-party update publishing, all managed from the Third Party Updates tab inside the Patch Connect Plus console.

Yes, Intune fully supports Windows 10 and Windows 11 patch management through update ring policies, quality update policies, and Windows Autopatch. Patch Connect Plus extends this to third-party application patching on those same Windows 10 and Windows 11 Intune-enrolled devices.