How deployment works
Every fleet has devices Intune can reach and devices it cannot. Patch Console deploys through whichever channel a device actually has, from the same patch group, without you running two tools.
Two delivery channels
When you approve a patch group, Patch Console picks the delivery channel per device:
- Intune channel. For Intune-managed devices, the deployment is created directly in your tenant via Microsoft Graph: a winget install, a packaged Win32 app, or a remediation script, assigned to an automatically maintained device group.
- Agent channel. For devices without Intune, the Patch Console agent executes a cryptographically signed deployment script on its next check-in.
Deployment methods
| Method | When it is used |
|---|---|
| winget | The product exists in the Windows Package Manager catalog and installs machine-scoped. Patch Console validates the package against a local winget index before using it. |
| Installer-URL Win32 app | Patch Console downloads the vendor's installer, validates it (SHA-256 and Authenticode signature), wraps it as an .intunewin Win32 app with detection rules, and assigns it. Used when winget is not a fit, including per-user installs that need user-context handling. |
| Remediation script | A detect + remediate script pair, used for targeted fixes such as uninstalls and products that need a scripted nudge rather than a full installer. |
| Agent script | For non-Intune devices: the same work delivered as an ECDSA-signed script the agent verifies before running. See Agent install & enrollment. |
Hybrid groups
A patch group targets a product, not a management channel, so one group can hold Intune-managed and agent-only devices at the same time. Each device is served by its own channel and progress rolls up into one fleet status.
What "installed" actually means
Success is never taken from an installer exit code. After an install runs, a version gate reads the real installed version from the device and refuses to report success if the version did not move. The vulnerability finding itself resolves only when later inventory proves the fix, which is the subject of the Verification loop.
Special cases
A few Microsoft products cannot be updated with a downloaded installer at all and get a dedicated vendor-updater lane instead; see Self-servicing products.