Works with Microsoft Intune
Third-party apps for Intune, packaged, inspected and shipped in rings
Multi-tenant from $24.99/mo. No version reaches a device until its hash, signer and malware checks pass. Pilot first, Broad later.
Free plan: 25 devices, 1 tenant, 15 apps. Rings and rollback included. No card.
- Graph permissions, each explained
- 3
- checks before a version ships
- 4
- default Broad ring delay
- 48 h
Crate · Windows x64
7-Zip 25.01
SHA-256 3f9a1c0e…b27dIgor PavlovMSI
- Hash passed
- Signer passed
- Scan passed
- VM passed
Bay track
Halvorsen Dental · Pilot 0 h · Broad 48 h
- Bay 2 in 31 h
7-Zip
25.01
- Paused
Zoom Workplace
6.3.1
Demo data. Tenants and versions in this preview are illustrative.
Dock overview
One board for every tenant. Every crate has a tag you can open.
Rows show where each app version sits: on the dock, in Bay 1 (Pilot) or in Bay 2 (Broad). Open a row to read the QA log behind the tag.
Out of date
7
across 4 tenants
Paused rings
1
Zoom 6.3.1, Bay 2
Disconnected
1
consent revoked
Devices
108 / 250
counted nightly
Apps
Halvorsen Dental
- 152.0.6913
Google Chrome
Google LLC
Shipped - 25.01
7-Zip
Igor Pavlov
Bay 2 in 31 h - 6.3.1
Zoom Workplace
Zoom Communications
Paused - 8.8.5
Notepad++
Notepad++ Team
Shipped - 25.001.20630
Adobe Acrobat Reader
Adobe Inc.
Held in QA - 3.0.21
VLC media player
VideoLAN
Shipped
Demo data. Not a customer and not real telemetry.
Every vendor update is another .intunewin to build, test, upload and assign.
Intune can deploy Windows apps, but each third party app needs a packaged Win32 wrapper, install and uninstall commands and a detection rule, repackaged for every vendor update. Small teams repackage 5 to 10 apps a month. Multiply by your tenants.
Source: Recast, 4 to 12 hours per manually packaged app including testing.
By hand, per app version, per tenant
- Package
- Test
- Upload
- Assign
- Repeat for the next tenant
Search, publish, done
Autopatch and DockCrate
Autopatch handles Microsoft. DockCrate by BufferSol handles everything else, tested before it ships.
Three steps from a new tenant to a full dock
Step 1: Connect a tenant
You'll need a Global Admin for one click. Not you? Send them this link. The tenant shows as Connected within 60 seconds.
Consent summary
3 permissions
- DeviceManagementApps.ReadWrite.All
- DeviceManagementManagedDevices.Read.All
- Group.Read.All
Status: Waiting for admin, then Connected.
Step 2: Pick your rings
Choose a Pilot and a Broad group. Defaults: Pilot 0 h, Broad 48 h. A ring pauses itself when more than 10% of its devices fail.
- Bay 1, Pilot
- Delay 0 h
- Bay 2, Broad
- Delay 48 h
- Auto pause
- Over 10% failed installs
Step 3: Publish and let it update
Search an app, publish, and it shows up in Intune. New versions go to Pilot first, then Broad, or pause themselves. Target: search to published in under 120 s median.
- Google Chrome152.0.6913
- 7-Zip25.01
- Zoom Workplace6.3.1
- Google Chrome152.0.6913
Crate · Windows x64
7-Zip 25.01
SHA-256 3f9a1c0e…b27dIgor PavlovMSI
- Hash passed
- Signer passed
- Scan passed
- VM passed
Demo data. Tenants and versions in this preview are illustrative.
Four checks before any version reaches a device
- HashThe installer SHA-256 must match the manifest.
- SignerSame signer as the previous version, or the version is held for manual review.
- ScanMalware scan in an isolated sandbox. A detection or a signature database older than 24 h holds publication.
- VMInstalled, detected, launched and uninstalled in a clean Windows VM.
- Hash passed
- Signer passed
- Scan passed
- VM pending
While our Windows test lab is being commissioned, the VM check shows as pending on any version it has not tested, and those versions publish to Pilot only.
Every version has a public QA log. No login. Read a sample QA log
What you get on every plan, and what you get as you grow
Rings and rollback on every plan
Roll back to any of the last 3 versions in one click. The audit log records who did it and when.
Multi tenant from the first paid plan
Starter covers 5 tenants. App Sets push a baseline of apps and ring defaults to many tenants at once.
Update only variants
Published as a requirement script app, so it never installs where the app is absent.
Audit log you can export
Every user and system action with actor, IP and time, as CSV.
Three permissions, each explained
The table is on the security page, with what each one does not allow.
Another vendor with write access to your tenants? Read exactly what we ask for.
We ask for 3 permissions. Here is exactly what each one lets us do, and what it doesn't.
| Permission | What it lets us do | What it does not allow |
|---|---|---|
DeviceManagementApps.ReadWrite.All | AllowsCreate, update and assign the Win32 apps we publish, upload their packages, and read install status. | Does not allowTouch device configuration, compliance or Conditional Access policy, or run any action on a device. Graph cannot scope this permission to our apps alone, so we only modify apps whose name starts with "DC |". |
DeviceManagementManagedDevices.Read.All | AllowsRead the device list and detected apps to count devices nightly for billing and to suggest your starter set. | Does not allowWrite anything, or wipe, retire, sync or reset a device. |
Group.Read.All | AllowsRead group names so you can pick your Pilot and Broad groups. | Does not allowCreate, edit or delete groups, or change who is in them. |
Publisher verification with Microsoft Partner Center is pending. SOC 2 Type 1 is on the roadmap. We do not claim any certification today.
Robopack has a bigger catalog. IntuneGet is free. Here's when we're the better pick.
Competitor facts checked Nov 3, 2026.
| Alternative | What they offer | DockCrate by BufferSol |
|---|---|---|
| Pckgr Starter (pckgr.com) | $49/mo, single tenant | Starter $24.99/mo, 5 tenants |
| Microsoft Enterprise App Management | Included in M365 E5. An add on at $2 to $5 per user per month for E3 and Business Premium. No rings or rollback. | Rings and rollback on every plan |
| IntuneGet | Free and open source, no SLA | Paid plans with support, free plan for 25 devices |
Roughly half the price of the tools you're comparing us with. Same device tiers, so you can check.
Free
$0
25 devices
Starter
$24.99/mo
100 devices
Professional
$49.99/mo
1,000 devices
Business
$74.99/mo
2,500 devices
Fleet
$99.99/mo
5,000 devices
The free plan is the trial. No card.
Questions, answered
Another vendor with write access to all my tenants?
We ask for 3 Graph permissions and the security page lists what each allows and does not allow. Every version has a public QA log, no login. Publisher verification with Microsoft Partner Center is in progress and we will show its status on the security page.
Will you be around in two years?
DockCrate by BufferSol is a BufferSol Technologies product. Apps we publish stay in your Intune if you cancel, and you can export your data as CSV at any time.
Do I have Enterprise App Management?
It is included in Microsoft 365 E5. It is not in E3 or Business Premium, where it is an add on. A three question checker is planned.
What about winget supply chain risk?
Every version passes four checks: hash, signer, scan and VM. New versions go to Pilot first, Broad waits 48 h by default, and a ring pauses itself when installs fail.
Why not free IntuneGet or Robopack's free tier?
Both have real strengths: IntuneGet is free and open source, and Robopack has a bigger catalog. We add support, multi tenant operations for MSPs, and rings with rollback on every plan.
What happens to my apps if I cancel?
Leave them in Intune, or remove only the apps prefixed "DC |". You can export your data as CSV.
Which Windows apps, and how many?
The catalog size shown is the real verified count at launch. The MVP target is 200 verified apps. Unknown installer types go to manual review and are never guessed.
Is there an agent or RMM?
No. DockCrate by BufferSol works through Intune only.
Your dock is empty. Start with the 5 apps your devices already have.
Free plan: 25 devices, 1 tenant, 15 apps. Rings and rollback included. No card.