PowerStacks vs Patch My PC: app patching in your tenant
Both automate third-party app packaging, deployment, and updates for Microsoft Intune. The difference is where it runs: App Store for Intune does the whole lifecycle inside your own tenant, never a vendor's cloud.
The same app lifecycle, without the vendor cloud
Patch My PC packages third-party applications, deploys them to Intune, and keeps them updated. App Store for Intune runs that same lifecycle, with one architectural difference: every step happens inside your own Azure tenant, from the same WinGet catalog plus your own custom MSIs.
Package
PSADT v4 wrap and .intunewin conversion, built in your tenant. The manifest and the installer are both SHA-256 verified before packaging.
Deploy
Uploaded to Intune as a standard Win32 app through Microsoft Graph, with detection rules generated from the source manifest.
Update
Automated update detection, rolled out through your existing Autopatch rings. Health-gated progression pauses the rollout if failures spike.
Roll back
Return a single app to a previous version with one click. The two-app model makes rollbacks deploys, not deletes.
The fundamental difference: where your data lives
When evaluating endpoint management tools, the first question should be: does your data stay in your environment, or does it pass through someone else's? This is not a minor architectural detail. It has direct implications for compliance, governance, and security posture.
PowerStacks
Runs in YOUR environment
- ✓ All products deploy into your own Azure tenant or Power BI workspace
- ✓ Customer data never leaves your environment or passes through any third-party service
- ✓ Credentials stay in your Azure Key Vault under your control
- ✓ No trust bridge to a vendor's infrastructure, so zero supply-chain risk
- ✓ Full visibility into the code, data, and processes running in your subscription
Patch My PC
Vendor-hosted SaaS
- • Cloud product runs on Patch My PC's infrastructure
- • Customer data passes through Patch My PC's systems for processing
- • Requires granting the vendor's service broad Graph API permissions to your tenant
- • Also offers an on-premises publishing service that requires a local server
- • Vendor breach could expose the trust relationship to your tenant
Side-by-side comparison
| Category | PowerStacks | Patch My PC |
|---|---|---|
| App packaging | Automated PSADT v4 wrap and .intunewin conversion, built inside your tenant from WinGet manifests or your own uploaded MSI. Manifest and installer both SHA-256 verified. | Vendor-maintained catalog of pre-packaged applications, prepared and hosted on Patch My PC infrastructure. |
| Third-party app updates | Automated update detection with ring-based rollout through your existing Autopatch rings, running entirely in your tenant. | Automated third-party patching from the Patch My PC catalog, delivered via the cloud service or an on-premises publisher. |
| Data residency | All data stays in the customer's Azure tenant / Power BI workspace. No data ever leaves the customer's environment. | Data processed through Patch My PC's hosted infrastructure. On-prem option available but requires a local server. |
| Architecture | Azure IaaS deployed in the customer's subscription (App Service, SQL, Blob Storage). Power BI reports in the customer's workspace. | Vendor-hosted cloud SaaS, or on-premises publishing service requiring a Windows Server. |
| Reporting scope | Full star-schema data model across Intune, Defender, and SCCM. The only product that merges all three datasets on a common unique key. | Focused on patching and vulnerability compliance reporting. |
| Reporting requirements on the endpoint | Script. Extended inventory uses an optional Intune Remediation script that runs on a schedule, posts data to your Azure Log Analytics workspace through the Log Ingestion API, and exits. Nothing is installed persistently and there is no service to maintain. | Agent. Patch My PC's advanced reporting requires a persistent agent on each managed device to collect and forward reporting data to the Patch My PC service. |
| Report creation | Power BI native point-and-click interface. Customers create virtually any report using the star-schema model, no coding required. | Pre-built reports and dashboards within the Patch My PC console. |
| Vendor access | None. PowerStacks has no access to customer environments. Products are self-contained. | Cloud service requires Graph API consent granting vendor access to your Intune environment. |
| Primary strength | Data sovereignty and cross-platform reporting (Intune + Defender + SCCM). | Broad third-party application catalog and automated patching workflows. |
App catalog coverage is often a deciding factor, so we made it easy to check. Search the App Store for Intune catalog → Anything not in WinGet still ships via custom MSI upload.
Data privacy matters
When a vendor-hosted SaaS product manages your Intune environment, your device inventory, application data, compliance status, and security posture information all flow through infrastructure you do not control. For organizations subject to regulatory frameworks (GDPR, HIPAA, SOC 2, FedRAMP, or internal data governance policies), this creates a compliance surface area that must be evaluated, documented, and continuously monitored.
PowerStacks eliminates this concern entirely. Every product in the PowerStacks suite runs in the customer's own environment. BI for Intune, BI for SCCM, and BI for Defender are Power BI template apps that deploy into your workspace. The data pipeline runs in your tenant and writes to your storage. There is no call home, no telemetry sent to PowerStacks, and no vendor-side processing of your data. Your security team has full audit visibility because everything runs under your Azure policies.
Compliance
No third-party data processor to evaluate. Your data stays within your compliance boundary, which simplifies audits and data protection impact assessments.
Governance
Full control over access policies, retention, and encryption. Your Azure AD Conditional Access and RBAC policies apply natively, with no exceptions for vendor service accounts.
Security
No trust bridge to a vendor's infrastructure means no supply-chain attack vector. A breach at PowerStacks cannot compromise your tenant because there is no connection to exploit.
Reporting that goes beyond patching
Patch My PC provides reporting focused on patching and vulnerability compliance, which is valuable for that specific use case. PowerStacks takes a fundamentally different approach: a full star-schema data model that covers the breadth of your endpoint management data.
BI for Intune, BI for SCCM, and BI for Defender each deliver a fully modeled Power BI dataset. Because all three share a common unique key value, PowerStacks is the only product on the market that can merge data across Intune, Defender, and SCCM in a single report.
This means you can answer questions like "Show me all devices managed by Intune that also have active Defender alerts and were previously managed by SCCM" in a single Power BI visual, built with the native drag-and-drop interface. No scripting, no data exports, no manual joins.
Star-schema advantage
- Data model
- Purpose-built star schema optimized for Power BI. Fact and dimension tables enable fast, flexible reporting.
- Report creation
- Power BI's native point-and-click UI. No DAX expertise required for the vast majority of reports.
- Cross-platform merging
- Common unique key across Intune, Defender, and SCCM datasets enables unified reporting no other product can match.
- Custom reports
- Build virtually any report from the star-schema model. Executive dashboards, compliance views, hardware inventory, all from one dataset.
- Data ownership
- All data lives in your Power BI workspace. Share reports using your existing Power BI governance and row-level security.
Programmatic access, available today
One of the most-requested capabilities on Patch My PC's own ideas portal is a public API to automate app management, integrate with CI/CD, and pull deployment data into external systems. As of this writing it sits at 639 customer votes with the status "NOTED" and no committed timeline. The same use cases customers are asking PMPC to build are, with PowerStacks, available today across two products.
App Store for Intune: the operational API
23 REST controllers, JWT Bearer auth via Entra ID, OpenAPI spec at /swagger. Built for automation:
- ✓Upload custom MSIs from a CI/CD pipeline
- ✓Trigger WinGet update detection from a CVE feed
- ✓Read approval queue state; submit requests programmatically
- ✓Manage update deployments (pause, resume, rollback)
BI for Intune: the reporting API
Power BI semantic model with native data access. Microsoft built the reporting API; we sit on it:
- ✓XMLA endpoint for direct semantic-model queries
- ✓Power BI REST API for embedding and automation
- ✓Dataflows + scheduled refresh into your data warehouse
- ✓Native PowerShell, Excel, Tableau access via the same protocol
Documentation, authentication walkthrough, and PowerShell examples at docs.powerstacks.com/app-store-for-intune/api/.
Keep your data where it belongs
PowerStacks products run entirely in your Azure tenant and Power BI workspace. No vendor-hosted processing, no third-party data access, no supply-chain risk. Start a free trial and see the difference data sovereignty makes.