Does Intune Patch Third-Party Apps? What Admins Need to Know:

Direct Answer 

Microsoft Intune does not automatically patch most third-party applications out of the box. Intune can deploy non-Microsoft software as Win32 apps and use supersedence to replace older versions, but administrators must package and publish every new release. Microsoft’s Enterprise App Management add-on adds a Microsoft-hosted catalog with auto-update for supported apps. Organizations that need broader coverage, Configuration Manager or WSUS support, or vulnerability-driven automation typically add a third-party patching tool that publishes updates into Intune.  

Key Takeaways

• Intune manages Windows updates and can keep Microsoft 365 Apps and Microsoft Edge current.
• Non-Microsoft applications need Win32 packaging, supersedence and assignments for every new version.
• Enterprise App Management automates catalog apps but requires additional licensing.
• Third-party publishers automate packaging and publishing without adding an endpoint agent.

What Intune updates natively  

Intune manages Windows quality and feature updates through Windows update policies and Windows Autopatch. It can also keep Microsoft 365 Apps and Microsoft Edge up to date. These capabilities cover the operating system and Microsoft’s own applications.

What Intune does not do by default

Intune does not track new releases of non-Microsoft applications such as Google Chrome, Zoom, Adobe Acrobat Reader, Java runtimes or 7-Zip, and it does not download or package their installers. Unless you use Enterprise App Management or another automation, each new version is a manual task.

Option 1: Package and supersede Win32 apps manually

1. Download the new installer from the vendor’s official source.
2. Wrap it into an .intunewin file with the Microsoft Win32 Content Prep Tool.
3. Define install and uninstall commands, return codes and requirements.
4. Create a detection rule, such as a file version, registry value or MSI product code.
5. Add a supersedence relationship to the previous version and choose whether to update or replace it.
6. Assign the app to pilot and production groups, then monitor installation status.

This works well for a small number of applications. The effort grows with every application and every release, which is why most teams automate it.

Option 2: Enterprise App Management

Enterprise App Management (EAM) provides the Enterprise App Catalog, a collection of Win32 apps that Microsoft prepares and hosts with prefilled install commands, detection rules and requirements. Auto-update for catalog apps became generally available with Intune service release 2606 in June 2026.

EAM is not included in Intune Plan 1 or Plan 2. It is available as an add-on, as part of the Intune Suite, and in eligible Microsoft 365 E5 subscriptions. Before relying on it, check whether the catalog covers the applications you run and whether its rollout and recovery options meet your change-management requirements.

Option 3: A third-party publishing tool

Third-party publishers track vendor releases, download and verify installers, create Win32 packages and publish them to Intune through Microsoft Graph. Devices install the updates through the Intune Management Extension that Intune already uses, so no additional agent is required. Some publishers also support Configuration Manager and WSUS, which helps organizations that manage devices in more than one system.

Option 4: An agent-based patching platform

Agent-based platforms install their own agent on each device and deploy updates from their own console, independent of Intune. They can suit multi-OS environments or organizations without Intune, but they add a second management stack alongside Intune.

Which option fits your environment?

Situation	Typical fit
A handful of applications, low release frequency	Manual Win32 apps with supersedence
Intune-only estate, eligible licence, mainstream applications	Enterprise App Management, possibly combined with a publisher for gaps
Intune plus Configuration Manager or WSUS	A publisher that supports all three
Vulnerability findings should drive what gets patched	A publisher integrated with Microsoft Defender Vulnerability Management
Mixed Windows, macOS and Linux fleet managed outside Intune	An agent-based platform

How Easy2Patch works with Intune

Easy2Patch offers two ways to patch third-party applications in Intune. PatchInCloud is a cloud service: administrators sign up with Microsoft Entra ID, grant enterprise application consent, pass an automatic Intune readiness check, select applications from the catalog and publish them to Intune with Available, Required or Uninstall assignments. Auto-publish rules and version supersedence keep applications current, and role-based access control governs sensitive actions

E2P Patch Manager publishes to Intune, Configuration Manager and WSUS from one catalog. Its Defender integration can publish Intune updates for applications that Microsoft Defender Vulnerability Management reports as vulnerable once their highest CVSS score meets a configured minimum

Frequently Asked Questions

Does Microsoft Intune patch third-party applications automatically?

Not by default. Intune can deploy third-party software as Win32 apps and replace older versions through supersedence, but an administrator must package and publish each new version. Automatic updates for catalog apps require Enterprise App Management, an Intune add-on that Microsoft also includes in eligible Microsoft 365 E5 subscriptions from July 2026. Many organizations use a third-party patching tool to automate packaging and publishing instead.

What does Intune update natively on Windows devices?

Intune manages Windows quality and feature updates through Windows update policies and Windows Autopatch, and it can keep Microsoft 365 Apps and Microsoft Edge current. It does not natively track new releases of non-Microsoft applications such as Google Chrome, Zoom, Adobe Acrobat Reader or 7-Zip. Those applications need a separate packaging and update process.

What is supersedence in Intune?

Supersedence is a Win32 app relationship in Intune that declares a new app version as the replacement for an older one. When it is configured to update rather than replace, Intune can upgrade devices that already have the older version installed. Supersedence reduces manual deployment work, but someone still has to package and publish every new version.

What is Intune Enterprise App Management?

Enterprise App Management (EAM) is an Intune capability built around the Enterprise App Catalog, a set of Win32 apps that Microsoft prepares and hosts with prefilled install commands, detection rules and requirements. Auto-update for catalog apps became generally available in June 2026. EAM is not part of Intune Plan 1 or Plan 2 and requires the add-on, the Intune Suite or an eligible Microsoft 365 E5 subscription.

Do I need an extra agent to patch third-party apps through Intune?

No. When updates are delivered as Intune apps, Windows devices install them through the Intune Management Extension that Intune already uses for Win32 apps. A patching tool that publishes packages into Intune can therefore rely on the existing client. Agent-based patching platforms work differently: they install their own software on each endpoint and deploy updates outside Intune’s app model.

How does Easy2Patch work with Intune?

Easy2Patch publishes third-party application packages and updates directly into Microsoft Intune, where they are assigned to Entra ID groups as Available or Required apps. It does not install an additional agent on endpoints. With its Defender integration, Easy2Patch can publish updates for applications that Microsoft Defender Vulnerability Management reports as vulnerable when their highest CVSS score meets a configured minimum.

Conclusion

Intune is an excellent delivery system for third-party updates, but it needs content and automation to keep those applications current. Choose between manual packaging, Enterprise App Management and a publishing tool based on how many applications you run, which systems you manage, and whether vulnerability data should drive your updates.