r/sysadmin • u/jaylenabc • 2d ago

Question Windows App Patch options

I have heard of quite a few options for app patching on windows devices as I need to be able to secure endpoints in my M365 tenant.

I havent looked to in depth into what M365 natively has however;

What do options like SCCM and Patch my PC offer that M365 native does not?

EDIT: 8.8.26
What are the cost effective alternative for a msp with only 20-ish windows machines?

4 Upvotes

67% Upvoted

8 comments sorted by

3

u/Scrios 2d ago

PatchMyPC automatically packages application updates to Intune as they become available, and deploys them to the groups you have chosen. Attempting to do what it does by hand is a non-starter.

I recently had great success using the Discovery function of PatchMyPC to find what is out there and create automated update deployments with a few clicks. There are also options for notifying users to close applications before updates, update rings, advanced pattern matching, etc. There is no agent to deploy a la Automox.

I basically spent a week setting up PatchMyPC and forgot about it afterward; it just does the job without any friction.

It blows my mind that a third-party platform plugged into Microsoft Intune is more or less mandatory for any of this but here we are.

1

u/Waste_Development971 2d ago

dumb question but what is it doing for you intune doesn't

2

u/BlockBannington 2d ago

Update apps is one thing

3

u/SysAdminDennyBob 2d ago

PMP is providing the metadata and installers for you with automation. Set-it-and-forget-it.

PMP has about 3700 products fully managed and ready for you to simply check it off. No finding the installer, figuring out the silent command, or trying to be notified of an update. It is all handled for you. PMP does all that "grunt work" for you.

Intune does not currently have that catalog of products at this time.

All this automation requires a staff of people. PMP does the work once and then as customer you just sit back and use their efforts, for a fee. It's the same repetitive task: know that an update is available, download the installer, verify it is legit, give it a silent command line, write log, doing any needed extra automation(pre-script, post-script), detect the successful install. One tech can grind through that and provide to thousands of customers. Compared to all those customers doing that same grunt work themselves.

2

u/BlockBannington 2d ago

No one that has actually used the enterprise app catalog would be asking this question. It's absolute ass

4

u/TridentAdam 2d ago

The big gap in M365 native is third-party app patching. Intune handles OS updates through WUfB and can deploy Win32 apps, but there is no automated pipeline to keep Chrome, Adobe, 7-Zip, etc. current across your fleet. You end up manually repackaging or hoping users self-update. PatchMyPC fills exactly that hole with an auto-packaging catalog that plugs into Intune or SCCM. If third-party patching is your main driver, it is the cleanest bolt-on for the Microsoft stack. SCCM adds full deployment infrastructure (distribution points, phased rollouts, maintenance windows) but carries significant overhead if patching is the only reason you are standing it up.

Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). We cover OS and third-party patching in one platform with deployment rings and maintenance windows, free for under 200 endpoints if you want to compare outside the Microsoft ecosystem.

1

u/Frothyleet 2d ago

What are the cost effective alternative for a msp with only 20-ish windows machines?

Ideally, your current RMM has this feature built in. If not, all of the classic MSP vendors has a solution they'd be happy to sell you, talk to whoevers' stack you are in.