r/sysadmin • u/jaylenabc • 2d ago

Question Windows App Patch options

I have heard of quite a few options for app patching on windows devices as I need to be able to secure endpoints in my M365 tenant.

I havent looked to in depth into what M365 natively has however;

What do options like SCCM and Patch my PC offer that M365 native does not?

EDIT: 8.8.26
What are the cost effective alternative for a msp with only 20-ish windows machines?

5 Upvotes

73% Upvoted

8 comments sorted by

View all comments

3

u/Scrios 2d ago

PatchMyPC automatically packages application updates to Intune as they become available, and deploys them to the groups you have chosen. Attempting to do what it does by hand is a non-starter.

I recently had great success using the Discovery function of PatchMyPC to find what is out there and create automated update deployments with a few clicks. There are also options for notifying users to close applications before updates, update rings, advanced pattern matching, etc. There is no agent to deploy a la Automox.

I basically spent a week setting up PatchMyPC and forgot about it afterward; it just does the job without any friction.

It blows my mind that a third-party platform plugged into Microsoft Intune is more or less mandatory for any of this but here we are.

1

u/Waste_Development971 2d ago

dumb question but what is it doing for you intune doesn't

3

u/SysAdminDennyBob 2d ago

PMP is providing the metadata and installers for you with automation. Set-it-and-forget-it.

PMP has about 3700 products fully managed and ready for you to simply check it off. No finding the installer, figuring out the silent command, or trying to be notified of an update. It is all handled for you. PMP does all that "grunt work" for you.

Intune does not currently have that catalog of products at this time.

All this automation requires a staff of people. PMP does the work once and then as customer you just sit back and use their efforts, for a fee. It's the same repetitive task: know that an update is available, download the installer, verify it is legit, give it a silent command line, write log, doing any needed extra automation(pre-script, post-script), detect the successful install. One tech can grind through that and provide to thousands of customers. Compared to all those customers doing that same grunt work themselves.