Most businesses have Windows patching under control by now. The gap is everything else: browsers, PDF readers, meeting clients, compression tools, runtimes and the vendor utilities on every laptop. Those apps carry a steady stream of security fixes, and they are often months behind. Intune third-party app patching closes that gap, either with the Enterprise App Catalog or with a disciplined packaging process of your own.
Here is how each approach works, what it costs, and how to keep third-party apps current without a weekly packaging marathon.
Why third-party apps are the soft spot
Windows Update and Windows Autopatch handle Windows, Microsoft 365 Apps, Edge and Teams. They do not touch anything else. In the tenants I review, the same pattern shows up again and again: Windows is current, but Defender Vulnerability Management lists dozens of exposed devices because of an old PDF reader or an outdated runtime that someone deployed once and never updated.
Some apps update themselves, which helps, but only if users have the rights and the network allows it. Many line-of-business tools and utilities do not self-update at all.
What the Enterprise App Catalog is
The Enterprise App Catalog is a library of Microsoft and third-party Windows applications that Microsoft has already packaged as Win32 apps and hosts in Microsoft storage. It is part of Enterprise App Management (EAM). When you add an app from the catalog, Intune prefills:
Install and uninstall commands and install behavior (system or user)
Return codes and restart behavior
Requirements such as OS architecture and minimum Windows version
Detection rules based on file version, file size or registry values
That removes the slowest parts of Win32 packaging: finding silent switches, writing detection rules and testing them. You can still edit the prefilled values, although Microsoft warns that changing install commands can break installs.
Microsoft publishes service level objectives for catalog updates: most app updates pass automated validation and are available within 24 hours, and updates that need manual testing typically arrive within seven days. Intune does not perform license checks for catalog apps, so licensed software still needs a license from the vendor.
Licensing: who has it
This is where many small businesses get caught out. EAM is not part of Intune Plan 1.
License
Enterprise App Management
Microsoft 365 Business Premium
Not included; available as an add-on
Microsoft 365 E3
Not included; available as an add-on
Microsoft 365 E5 and E7
Included, rolling out from July 2026
Intune Suite or standalone EAM add-on
Included
Microsoft began adding EAM, Endpoint Privilege Management and Microsoft Cloud PKI to Microsoft 365 E5 from July 2026, with tenants provisioned gradually and a 30-day notice posted in the Microsoft 365 admin center. If you are on E5, check whether it has appeared in your tenant before buying an add-on.
Keeping catalog apps updated
Adding an app is the easy part. Keeping it current is where EAM earns its cost. There are three update paths:
Auto-update. For catalog apps with a Required assignment, you can enable auto-update. Intune detects when a newer version is in the catalog and updates targeted devices without you building a new package.
Guided supersedence. Without auto-update, apps with newer versions appear in Apps › Enterprise App Catalog apps with updates. Select the app, choose Update and Supersede app, and Intune creates a new app linked to the old one. Assignments and scope tags are not copied, so set them again.
Self-updating apps. Some catalog apps update themselves through the vendor’s own mechanism. Intune ensures a minimum version and reports what it detects. Your network must allow the vendor’s update traffic.
A sensible routine: enable auto-update for low-risk utilities and browsers, use supersedence with a pilot group for apps that matter to the business, and review the updates report weekly.
Third-party patching without EAM
If you are on Business Premium or E3 without the add-on, you can still patch third-party apps well. It just takes more process.
Package Win32 apps yourself with the Win32 Content Prep Tool, use version-aware detection rules, and use supersedence when a new version ships.
Use the Microsoft Store app type for apps available through the Store, which Intune can keep updated.
Prefer apps that self-update when you choose software, and configure them through policy so updates are allowed.
Use remediations to detect outdated versions and trigger updates for a small number of stubborn apps, if you have Windows Enterprise E3 or E5 licensing.
Drive priorities from Defender Vulnerability Management. Patch the apps with real exposure first, instead of chasing every minor release.
Whichever path you use, reduce the number of apps. Every utility installed in case someone might need it is something you now have to patch. Removing unused software is the cheapest third-party patching there is.
A practical rollout plan
Pull your discovered apps or Defender software inventory and list the top 20 third-party apps by install count and exposure.
Remove anything unused or duplicated, such as three PDF readers.
Check which of the remaining apps are in the Enterprise App Catalog if you have EAM.
Deploy catalog or self-packaged versions to a pilot group, using supersedence to replace old deployments.
Turn on auto-update where it is safe, and set a weekly review for the rest.
Track exposure in Defender Vulnerability Management month over month.
Frequently asked questions
Does the Enterprise App Catalog use WinGet?
No. Catalog apps are installed by the Intune Management Extension as Win32 apps, using packages Microsoft prepares and hosts.
Is Enterprise App Management included in Business Premium?
No. It is included in Microsoft 365 E5 and E7 from July 2026, and available as an add-on or through the Intune Suite for other plans.
What happens if a vendor removes an app from the catalog?
Existing deployments keep working, but you cannot add new deployments from the catalog. Package the app yourself as a Win32 app for future updates.
Most businesses have Windows patching under control by now. The gap is everything else: browsers, PDF readers, meeting clients, compression tools, runtimes and the vendor utilities on every laptop. Those apps carry a steady stream of security fixes, and they are often months behind. Intune third-party app patching closes that gap, either with the Enterprise App Catalog or with a disciplined packaging process of your own.
Here is how each approach works, what it costs, and how to keep third-party apps current without a weekly packaging marathon.
Why third-party apps are the soft spot
Windows Update and Windows Autopatch handle Windows, Microsoft 365 Apps, Edge and Teams. They do not touch anything else. In the tenants I review, the same pattern shows up again and again: Windows is current, but Defender Vulnerability Management lists dozens of exposed devices because of an old PDF reader or an outdated runtime that someone deployed once and never updated.
Some apps update themselves, which helps, but only if users have the rights and the network allows it. Many line-of-business tools and utilities do not self-update at all.
What the Enterprise App Catalog is
The Enterprise App Catalog is a library of Microsoft and third-party Windows applications that Microsoft has already packaged as Win32 apps and hosts in Microsoft storage. It is part of Enterprise App Management (EAM). When you add an app from the catalog, Intune prefills:
That removes the slowest parts of Win32 packaging: finding silent switches, writing detection rules and testing them. You can still edit the prefilled values, although Microsoft warns that changing install commands can break installs.
Microsoft publishes service level objectives for catalog updates: most app updates pass automated validation and are available within 24 hours, and updates that need manual testing typically arrive within seven days. Intune does not perform license checks for catalog apps, so licensed software still needs a license from the vendor.
Licensing: who has it
This is where many small businesses get caught out. EAM is not part of Intune Plan 1.
Microsoft began adding EAM, Endpoint Privilege Management and Microsoft Cloud PKI to Microsoft 365 E5 from July 2026, with tenants provisioned gradually and a 30-day notice posted in the Microsoft 365 admin center. If you are on E5, check whether it has appeared in your tenant before buying an add-on.
Keeping catalog apps updated
Adding an app is the easy part. Keeping it current is where EAM earns its cost. There are three update paths:
Apps › Enterprise App Catalog apps with updates. Select the app, choose Update and Supersede app, and Intune creates a new app linked to the old one. Assignments and scope tags are not copied, so set them again.A sensible routine: enable auto-update for low-risk utilities and browsers, use supersedence with a pilot group for apps that matter to the business, and review the updates report weekly.
Third-party patching without EAM
If you are on Business Premium or E3 without the add-on, you can still patch third-party apps well. It just takes more process.
Whichever path you use, reduce the number of apps. Every utility installed in case someone might need it is something you now have to patch. Removing unused software is the cheapest third-party patching there is.
A practical rollout plan
Frequently asked questions
Does the Enterprise App Catalog use WinGet?
No. Catalog apps are installed by the Intune Management Extension as Win32 apps, using packages Microsoft prepares and hosts.
Is Enterprise App Management included in Business Premium?
No. It is included in Microsoft 365 E5 and E7 from July 2026, and available as an add-on or through the Intune Suite for other plans.
What happens if a vendor removes an app from the catalog?
Existing deployments keep working, but you cannot add new deployments from the catalog. Package the app yourself as a Win32 app for future updates.
Third-party patching is part of our Intune managed service, and pairs naturally with Microsoft Defender for Endpoint for exposure tracking. If you are weighing E5 for features like this, our E5 vs E3 calculator helps compare the numbers. Microsoft’s Enterprise App Management documentation lists the current catalog.
Want to know which third-party apps are exposing you? Get a free Microsoft 365 security assessment and we will show you where to start.