Self-servicing products
A few Microsoft products refuse third-party installers and can only be updated by their own vendor updater. Patch Console gives them a first-class lane instead of a fragile repackaging workaround.
Why a separate lane exists
Products like the Microsoft Defender platform and Microsoft 365 Apps do not ship a normal installer you can download, validate, and wrap. Their update mechanism is the vendor's own updater. Forcing them through the winget or Win32 path either fails or silently does nothing, so Patch Console detects these products and routes them differently.
The vendor-updater deploy card
A self-servicing product gets a single deploy card: no installer URL to hunt down, no winget package to pick, no packaging step. Approving it deploys a script that invokes the vendor's own updater on each device. Verification is unchanged: the finding resolves only when inventory shows the updated version, exactly like every other product.
Supported products
| Product | Update mechanism | Notes |
|---|---|---|
| Microsoft Defender platform | Microsoft's updateplatform.exe | The updater binary is signature-verified before it runs. No reboot is required, and the deployment is marked accordingly. |
| Microsoft 365 Apps | Click-to-Run updater | Office updates itself through its built-in Click-to-Run mechanism; the deploy card triggers and tracks it. |