Roadmap

Versions, hashes, and icons kept current automatically, with no packaging work on your side.

DMG, ZIP, and APP sources are repackaged into signed PKG installers. Vendor PKGs pass through untouched.

Chunked, encrypted uploads over Microsoft Graph with retry, duplicate detection, and live progress.

Every app is matched against NVD and the CISA KEV catalog so you can prioritize by real risk.

Keep existing assignments across updates, apply scope tags, and optionally remove superseded versions.

Map rings to your existing Entra groups, publish a new version to a ring first, and promote it to the next ring when you are ready. The previous version stays live meanwhile.

Hold a new version back for up to 30 days per app. Held versions stay out of bulk updates until the window passes, and publishing one early warns you first.

Push many outdated apps in one run, and export inventory, outdated app, and vulnerability reports as CSV or PDF.

Per app subscriptions plus outbound webhooks for your own automation.

Run the whole pipeline unattended inside your own tenant using managed identity or certificate auth.

Read installed apps and versions per Mac straight from Intune over Microsoft Graph. No agent to deploy.

See exactly which devices are running a version with a known exploited vulnerability, and ship the fix from the same screen.

Surface apps your users installed themselves that Intune never deployed, and bring them under management in one click.

Publishers and bundle identifiers on every catalog entry, so apps detected by Intune match the right catalog app by name and publisher.

Get told when a version of an app deployed in your tenant picks up a known exploited vulnerability, checked daily and sent to the email, Slack, or webhook destination you already configured.

Invite colleagues by email as administrator or viewer instead of sharing one account.

Set one hold back window for every app from a publisher with a wildcard rule, instead of configuring each app on its own.

Move a new version from ring to ring on a schedule you define, instead of promoting each step by hand.

Let a new version flow into Intune automatically the moment it ships, or on the cadence you choose.

When a known exploited vulnerability is confirmed on a version in your fleet, publish the fixed version to the affected groups instead of waiting for the next manual review.

Define the apps every Mac in a group should have and publish the whole set in one action, so a new device lands fully equipped. No agent needed.

A first class Teams destination alongside the existing Slack and generic webhook support.

A shell script that surfaces pending updates and vulnerable app counts inside native Intune device reporting.

Pull catalog, fleet, and vulnerability data as JSON for your own dashboards, exports, and compliance evidence.

Point Claude, Copilot, or any other MCP client at the same read only data and ask which Macs are exposed in plain language.

A signed command line agent that installs and updates catalog apps on device. No self service store, no branding, no local admin rights required.

Give users a configurable window before an update is installed for them, with a clear enforcement deadline.

Name the apps that must always be present. They reinstall automatically if removed.

Build the agent's profile in the portal, or push it straight into your tenant over Graph.