Needs your attention
Where the fleet stands
Get set up
Rolling out now
Where each ring stands.
App Control
App catalog
Third-party apps NexpatchOnline can package for Intune. Turn on auto-publish for apps you want the scheduled runbook to keep current, or publish one now.
| App | Latest | Installed versions | Status | Auto-publish |
|---|
Versions shown are sample data until you import inventory on the Connect page. The packaging script always reads the current version from winget at the moment it runs.
Discovery
Apps found on your devices that NexpatchOnline isn’t managing yet. Anything with a winget package can be patched. Add it to the catalog in one click.
| App | Installs | Versions | Status | Winget package |
|---|
Find winget packages for unmatched apps
NexpatchOnline recognizes common apps on its own. For the rest, this script searches winget on your packaging machine and copies the matches back.
Lookups match by name, so check the winget package shown next to each app before adding it. In-house apps aren’t in winget and need your own installer.
Deployments
Each published update rolls out ring by ring. Pilot gets it first, then each later ring after its deferral. Devices install before the deadline or are prompted.
Publishing activity
Apps published to Intune from NexpatchOnline, newest first.
| App | Status | Deployment | By | Started |
|---|
Reports
Compliance, exposure, install results, rollouts and App Control in one place. Copy any table straight into Excel, or copy a written summary for an email.
Compliance over time
Share of tracked installs on the latest version. A snapshot is saved every time you import inventory.
Patch compliance by app
Least compliant first.
Vulnerability exposure
Apps with installs that have a known vulnerability, most exposed first.
Install results from Intune
Import install results
Rollout history
Every update you published and how far it has rolled out.
App Control activity
App Control policy
Build an App Control for Business (WDAC) policy without writing XML. Start in audit mode, review what would have been blocked, allow what you need, then switch to enforce.
Live events: where NexpatchOnline gets them
Choose one source for your organization. You can switch at any time.
App Control activity
Apps App Control blocked or would have blocked on your devices.
| App | Publisher | Status | Devices | Last seen | Decision |
|---|
-
Name and target
-
Start from
-
Mode
-
Also trust
-
Extra rules
Use folders only admins can write to. App Control ignores path rules in folders users can write to.
The file’s path on the reference device where you run the script. Only this exact file is allowed; a new version needs a new rule.
What audit mode caught
Apps App Control blocked, or would have blocked in audit mode. Allow by publisher to cover future versions, or by file hash to allow only that exact file. Sample events are shown until you import your own.
Import events from Defender advanced hunting
Run on a reference device that has the trusted apps installed, in an elevated PowerShell. It builds the policy with Microsoft’s ConfigCI cmdlets, compiles it, and creates an Intune profile assigned to your group.
Access needed
You don’t have access to NexpatchOnline yet.
Ask your IT team’s NexpatchOnline owner to add you under Users and access, then sign in again.
Users and access
Choose who in your organization can use NexpatchOnline, and what they can do. Everyone signs in with their own Microsoft work account.
Invite someone
They get access the first time they sign in to NexpatchOnline with that account. NexpatchOnline doesn’t send an email, so let them know.
People with access
| Person | Role | Status | Last signed in |
|---|
Global Administrators and Intune Administrators in your Microsoft Entra ID always have owner access, so your organization can’t get locked out.
Recent activity
Sign-ins with new invitations, role changes, removals and syncs.
Extra protection in Microsoft Entra ID
Optionally, stop everyone else in your organization from even signing in to NexpatchOnline.
- Entra admin center → Enterprise applications → NexpatchOnline
- Properties → Assignment required → Yes → Save
- Users and groups → add the people or groups allowed to use NexpatchOnline
Connect to Intune
Approve NexpatchOnline for your organization, then set the tenant details the PowerShell scripts use. NexpatchOnline never sees your password.
Approve NexpatchOnline for your organization
An administrator who can grant tenant-wide consent approves once. You can remove NexpatchOnline at any time in Entra ID under Enterprise applications.
Tenant
Saved in this browser only and inserted into every script.
Default rollout rings
One-time setup
- Let the scripts sign in.
In your NexpatchOnline app registration, add the platform Mobile and desktop applications with redirect URI http://localhost, and set Allow public client flows to Yes. - Add delegated Graph permissions.
DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.Read.All, Group.Read.All. Then approve NexpatchOnline again above. - Prepare the packaging machine.
Windows with winget, then run: Install-Module IntuneWin32App, Microsoft.Graph.Authentication -Scope CurrentUser - Import your real inventory below so the catalog shows your fleet.
- Schedule the auto-publish runbook from the catalog to keep apps current every day.
Inventory from Intune
The script reads discovered apps from Intune and copies them to your clipboard as JSON. Paste the result here.