Intune: automate third-party app patching

Key insights

• A deployment process can run again when a new application version is available.
• Admins can schedule a process around Patch Tuesday instead of deploying immediately.
• Deployment rings can use delays, such as waiting four days before the next group.
• An update process targets devices that already have the application rather than installing it everywhere.
• The demonstration shows install commands, detection rules and assignments appearing in Intune.

Right Click Tools Patching adds automated packaging and update processes for third-party applications managed through Intune, including staged deployment and cleanup of older versions. It matters to endpoint administrators who otherwise build and refresh Win32 app packages manually. Jonathan Edwards demonstrates the workflow using Google Chrome and Slack in a YouTube video.

What it does

Intune administrators can use the Recast tool to select a catalog application, define when its deployment process runs, and send it to Intune with deployment settings. The demonstration shows the process generating application configuration such as install and uninstall commands, restart behavior, requirement rules, detection rules and assignments.

The distinction is between publishing an app and maintaining it. In the example, a regular deployment process sends Chrome to selected groups and can run again when a new version ships. An update process is used for Slack: devices that already have Slack can receive an update, while devices without it are not given a new installation.

That difference can matter for software used only by particular teams. An organization may want to keep existing installations current without making an optional app available across its entire device estate. The process also includes settings for deployment events, rings, delays and cleanup, reducing repeated manual steps described in the demonstration.

Who it is for and what you need

The workflow is aimed at IT teams that manage applications through Intune and need to keep non-Microsoft software current. The demonstration connects a Recast cloud service to an Intune tenant and selects Entra groups for deployment rings. It also says Configuration Manager can be connected, but the examples focus on Intune.

The video describes Microsoft’s Enterprise Application Management as an E5-included catalog capability from August 1, 2026, and says it does not include the broader process shown for staging deployments, recurring runs and cleanup. Those licensing and product-scope statements are from the demonstration; no official Microsoft source was available in the supplied material to verify them independently.

The demonstration does not specify the Recast licensing requirements, required Intune permissions, tenant prerequisites, supported regions, or rollout status. It also does not provide the detailed setup steps for connecting the Intune tenant. Check those requirements with Recast and your organization’s licensing administrator before planning a deployment.

How it works

1. In Recast’s cloud service, open Patching and create a deployment process. Connect the Intune tenant if it is not already connected.
2. Select an application from the catalog, then choose whether to create a regular deployment process or an update process. The demo uses Chrome for deployment and Slack for update-only behavior.
3. Choose the event that should trigger the process. The shown default runs when a new version is released; another available event is Patch Tuesday, which the demonstration configures to run one day afterward.
4. Add target Entra groups as deployment rings. Set the first ring to deploy immediately, then add a delay before the next ring. Edwards uses a four-day delay in the Chrome example.
5. Review the process settings, including the application name, notifications, category, description, pre- and post-installation actions, restart behavior, dependencies and cleanup. Save the process and select Check for updates.
6. In Intune, inspect the resulting application. The demonstration finds the generated commands, detection and requirement rules, restart settings and ring assignments there.

For an update process, the target group can include a wider set of devices while the process updates only devices where the application is already installed. That is the key difference from a standard deployment in the Slack example: it avoids installing Slack on devices that do not have it.

Limitations and open questions

The video is a product demonstration, not a complete implementation guide. It does not show permissions, connection configuration, failure handling, reporting, rollback, pricing or the steps for building a custom package. It also does not test the workflow across different apps or tenant configurations.

The catalog size differs between the published description and the demonstration: the description says more than 7,500 applications, while the screen shown in the transcript displays 7,789. Treat these as figures from the demonstration rather than a guaranteed current count. The transcript describes Recast’s packages as curated and checked, but does not provide details of the checks or their coverage.

Before adopting the approach, confirm which apps are in the catalog, how your organization will validate updates before broad deployment, and what cleanup removes. The staged rings and delays give admins a way to control timing, but the material does not explain rollback behavior if an update causes problems.

Sources

• Jonathan Edwards’ Right Click Tools Patching demonstration

Frequently asked questions

Can Right Click Tools Patching update apps without installing them everywhere?

The demonstrated update process updates devices that already have the application and leaves devices without it unchanged.

Can Intune app updates be deployed in rings?

The demonstration configures Entra groups as rings and adds a delay between them, including a four-day delay in the Chrome example.

What licensing does Right Click Tools Patching require?

The supplied material does not state Recast licensing requirements. It describes Microsoft Enterprise Application Management as included in E5, but provides no official Microsoft source to verify that claim.

What do I need to connect Intune to Recast?

The demonstration shows connecting an Intune tenant but does not specify permissions or setup prerequisites. Confirm the current requirements with Recast.