Every application on your Intune devices, current and tested.
AutoPackager finds new versions of your Windows and macOS applications, builds the Intune package, test-installs it on your own build machine, waits for your approval and rolls it out ring by ring. Every update shows which known vulnerabilities it closes. Outdated applications are a known attack surface. AutoPackager keeps them current.
The Cost of Manual Packaging
Every day between a vendor release and your deployment is a day the old version runs on your devices. AutoPackager reduces that time to hours.
What AutoPackager Automates
Driver Management
Dell, HP and Lenovo driver updates from the vendor catalogs, and printer drivers from a ZIP or the vendor’s installer. Drivers use the same rings and the same approval as your applications.
Commercial Software Updates
Updates for commercial software: Chrome, Adobe, Zoom and more. A daily version watch reads the publisher’s feed, WinGet and NVD. Each update is built and test-installed before you approve it, and its card shows the known vulnerabilities it closes.
New Software Intake
Upload the installer or paste a download link. AutoPackager finds the silent switches and the detection rule, test-installs the package and publishes it to Intune. When it needs information, it asks you a question in the console. A package is ready in hours, not weeks.
How AutoPackager Differs From Patch My PC and WinGet
Patch My PC and Intune Enterprise App Management are catalogs of prepackaged applications. WinGet is a public package source. AutoPackager is a packaging and rollout pipeline that tests every package on your own build machine. The table shows the main differences.
| Capability | Catalog Tools | AutoPackager |
|---|---|---|
| Applications outside the catalog | Upload an MSI or EXE. You set the switches and the detection rule | ✓ Any installer. AutoPackager finds the switches and the detection rule |
| Hard installers | ✘ Not covered | ✓ Heisenberg mode: AI, PSADT, screen recognition or a recorded install, with your answers |
| Test before publishing | ✘ None, or a smoke test | ✓ Install, detect and uninstall on your build machine. A failed test is never published |
| Rollout | Update rings | ✓ Ring 0, then 10 / 30 / 60 / 100 %. Stops and rolls back by itself when installs fail |
| Drivers | ✘ Separate tool | ✓ Dell, HP, Lenovo and printer drivers in the same pipeline |
| Known vulnerabilities | ✘ Separate product | ✓ Shown per application and per update, with every plan |
| Price | Per device | ✓ Per working package. A failed build costs nothing |
Built for MSPs Managing Multiple Tenants
AutoPackager is multi-tenant. One team manages packaging for many client Intune tenants from one console. A package built once in the shared catalog can be rolled out in every tenant. Each client keeps its own rings, approvals and audit log.
- One console for all client tenants
- Rings and approvals set per client
- An audit log per client, exported to CSV
Pay for What You Use, Not for the Size of Your Estate
You pay per package, not per device. There are two prices. A standard package is an installer with a silent switch. A smart package is built in Heisenberg mode and costs more. You pay only for a package that AutoPackager builds, tests and publishes successfully. A failed build costs nothing. There is no fee per device and no fee per tenant.
Standard Package
- Installer with a standard silent switch
- MSI, Inno Setup, NSIS, WiX Burn, Microsoft bootstrapper, Advanced Installer, MSIX, PKG, DMG
- Most Dell, HP, Lenovo and printer drivers
- Daily version watch and test install
- Rings with automatic stop
- Known-vulnerabilities view
Smart Package
- Everything in Standard
- Heisenberg mode: AI, PSADT and screen recognition for hard installers
- Recorded install for an installer with no silent switch
- Per-user installation, tested as a standard user
- Answer files and custom steps built by the agent
- Complex drivers
An outsourced package costs 200 to 500 dollars and takes weeks. We send an offer after a 30-minute call. Evidence of each package’s tests and approvals for regulators is available on request.
Questions We Hear Most
What does AutoPackager do?
AutoPackager keeps the applications on your Intune-managed devices on a tested, current version. It watches for new versions every day, builds the Intune package, test-installs it on your own build machine, waits for your approval, and rolls it out ring by ring. Every update shows which known vulnerabilities it closes.
Outdated applications are a known attack surface. AutoPackager keeps them current.
Which operating systems does AutoPackager support?
Windows and macOS applications on Intune-managed devices. Windows applications are published as Win32 apps (.intunewin) or MSIX. macOS applications are published to Intune as PKG or DMG packages. The operating system itself is not in scope: Windows Update, Autopatch and Apple's updates stay as they are.
How is AutoPackager different from Patch My PC?
Patch My PC is a catalog of prepackaged applications with per-device pricing. It covers the popular titles well. AutoPackager is a packaging and rollout pipeline. The main differences:
- Any installer. Upload an MSI, EXE, MSIX, PKG or DMG, or paste a download link. AutoPackager finds the silent switches and the detection rule. Hard installers go through Heisenberg mode, which uses AI, PSADT and screen recognition and asks you when it needs an answer. An installer with no silent switch can be installed by hand on your build machine, recorded, and replayed on the device.
- A test install. Every Windows package is installed, detected and uninstalled on your own build machine before it is published. A package that fails its test is never published.
- Rings with an automatic stop. Ring 0 first, then 10, 30, 60 and 100 % of devices. When more than 20 % of finished installs fail, the rollout stops and rolls back by itself.
- Known vulnerabilities on every update card, with every plan.
- Drivers in the same pipeline. Dell, HP and Lenovo drivers and printer drivers use the same rings and the same approval as applications.
- Price per working package, not per device.
If every application you manage is in that catalog, a catalog tool is enough. Check which of your applications are not in it.
What is tested before a package is published?
The package is installed, detected and uninstalled on your own build machine. All three steps must pass. A package that fails is never published, and the job shows what failed.
How does a rollout work?
An update goes to Ring 0 first: your test devices or a small group. The next ring opens only after a gate: at least 2 business hours in the ring, enough finished installs, and 90 % success. You can also require an approval before the next ring. With 100 or more devices the rings are Ring 0, 10 %, 30 %, 60 %, 100 %. Fewer devices get fewer steps.
An admin can skip the rings and roll an update out to all devices at once. AutoPackager never skips a ring by itself.
What access does AutoPackager need in our tenant?
An app registration in your own Microsoft Entra ID, which you own, with 5 Microsoft Graph permissions. Each permission is listed in the console with the reason it is needed. The client secret is stored encrypted (AES-256-GCM) and never shown again. AutoPackager changes only the applications it built. Hand-made Intune assignments are kept.
What does it cost?
You pay per package, not per device. There are two prices. A standard package is an installer with a silent switch. A smart package is built in Heisenberg mode: a hard installer, a recorded install, a per-user installation, an answer file or custom steps built by the agent. The smart package has the higher price.
You pay only for a package that AutoPackager builds, tests and publishes successfully. A failed build costs nothing. There is no fee per tenant. The known-vulnerabilities view is included with every package. We send an offer after a 30-minute call.
Request a Demo
AutoPackager is in private preview with a small number of customers. We accept a small number of new pilot partners: MSPs and enterprise IT teams.