Publishing section of Patch My PC Publisher
Applies to: Patch My PC Publisher V3.x
The PUBLISHING section on the Intune Options tab of Patch My PC (PMPC) Publisher controls how Publisher creates, updates, names, organizes, and maintains apps and updates in Intune. These settings apply globally to all apps created from the Intune Options tab and directly influence application lifecycle behavior.
Tip
Some options in the Intune Win32 Application Options section are global defaults. These settings can be overridden at the Vendor or Product level within the Product Tree. When a more specific customization exists at a lower level, it takes precedence over the global setting, following standard product tree inheritance behavior.
Digitally sign the detection method script and enforce signature checking on the application in Intune
When you enable the Digitally sign the detection method script and enforce signature checking on the application in Intune option, Publisher digitally signs PowerShell-based detection and requirement scripts used by Win32 apps and configures the Win32 app to require signed scripts.
Specifically, Publisher sets the Enforce script signature check and run script silently property on the Win32 app’s detection and/or requirement rule in Intune. This is an application-level setting and does not modify PowerShell execution policy or device security configuration.
This option is intended for environments that already enforce signed PowerShell scripts, such as those using an AllSigned execution policy or app control solutions like AppLocker or Windows Defender Application Control (WDAC). By signing the detection and requirement scripts and enabling signature enforcement on the app, Publisher allows them to run silently and unblocked where unsigned scripts would otherwise be blocked or require user confirmation.
To select a code-signing certificate for signing detection and requirement scripts
Enable the Digitally sign the detection method script and enforce signature checking on the app in Intune option.
Click Browse next to Select code-signing certificate.
In the certificate selection window, choose a valid code-signing certificate from the Local Computer – Personal certificate store.
Click OK to confirm the certificate selection.
Select OK again to save the Intune Options.
The rest of this section is split into the following two sections:
Application-Specific Options
Copy assignments from the previous release when a new application is published
When creating apps, Publisher applies any assignments that are configured within the Publisher itself. Administrators may sometimes also add or adjust assignments directly in Intune after an app has been created.
When you enable the Copy assignments from the previous release when a new application or update is published option, Publisher carries forward all existing assignments from the previous app version when creating a newer version. This includes assignments configured in Publisher and assignments that were manually added in Intune.
By enabling the option, the assumption is that any assignments present on the previous app represent the administrator’s intended targeting and should continue to apply to the updated version. This ensures assignment targeting remains consistent across app updates without requiring manual reassignment.
Delete assignments from the previous release when a new application is published
When you enable the Delete assignments from the previous release when a new application is published option, Publisher removes assignments from older app versions when a new version is created.
If app retention is enabled, older Win32 apps may still exist in the Intune admin center and would otherwise remain assigned. Removing assignments from the previous version ensures that only the latest version of the app is targeted to Microsoft Entra ID groups, avoiding multiple versions being deployed unnecessarily to the same devices or users.
Copy dependencies from the previous release when a new application is published
When you enable the Copy dependencies from the previous release when a new application is published option, Publisher keeps app dependencies in Intune aligned as new versions of Patch My PC apps are published.
If a Win32 app has dependencies that reference other Win32 apps created by Publisher, Publisher updates those dependency references to point to the latest published versions when a new app version is created. This ensures dependency chains remain valid and up to date without requiring administrators to manually maintain dependencies after each update.
Important
Apps that are part of an active dependency chain remain protected from deletion. However, once dependencies are replaced with newer versions, older apps created by Publisher that are no longer referenced may become eligible for deletion based on the app retention policy configured in Publisher.
Copy requirements from the previous release when a new application is published
When you enable the Copy requirements from the previous release when a new application is published option, any customer-defined Win32 requirement rules added to the previous app after it was initially published are copied forward and applied to future Win32 apps created by Publisher.
Update Enrollment Status Page associations when an updated application is published
When you enable the Update Enrollment Status Page associations when an updated application is published option, Publisher automatically updates Enrollment Status Page (ESP) app associations to reference the latest version of a Win32 app created by Publisher.
If a new version of an app is published and that app is already referenced by an ESP profile, Publisher replaces the older application version in the ESP association.
This ensures that when new devices go through Autopilot, the ESP waits for and installs the most recent version of the app, without requiring manual updates to ESP configurations after each app update.
Apps must be explicitly associated with an ESP profile using the Product Tree. This is done by right-clicking a product and selecting Manage Enrollment Status Page, where you choose which ESP configuration the application should be included in.
Enable 'Allow available uninstall'
When you enable the Enable 'Allow available uninstall' option, Publisher configures Win32 apps in Intune to allow users to uninstall the app from the Company Portal when the app is assigned as Available.
Delete any previously created applications when an updated application is published
When you enable the Delete any previously created applications when an updated application is published option, Publisher controls how many older Win32 app versions are retained in Intune when a new version is published.
If this option is not enabled, previously created app versions are never automatically removed and will continue to exist in the Intune tenant indefinitely.
Rather than being a simple on/off delete, this option works with Retain up to x previously created applications, where x can be set between 0 and 10. Publisher can track and manage up to the 10 most recent versions of an app.
Setting the value to 0 ensures that only the latest version of the app exists in Intune.
Setting the value to 1 or more retains that number of previous versions alongside the latest release.
Retention settings can be overridden at the vendor and product level in the Product Tree, allowing more granular control. For example:
A global default may be set to retain 1 or 2 previous versions.
Apps with a faster release cadence, such as web browsers, may retain 3 to 5 versions.
The maximum supported retention value is 10.
Important
Publisher tracks app retention based on catalog metadata, which includes the product IDs for the most recent 10 versions of an app. This means retention and cleanup decisions can be made only for those versions that still fall within the latest 10 versions tracked by the catalog.
If older Win32 apps exist in Intune outside of the last 10 tracked versions, Publisher can no longer associate them with the product lifecycle. Even if retention is enabled, those older apps are not automatically managed or removed.
In these cases, any apps falling outside of the tracked window must be reviewed and cleaned up manually using the Intune Manager.
Retention Best Practice
As a general best practice, it is recommended to retain at least one previous version of an app.
Keeping a single previous version allows administrators to rollback if an issue is discovered after publication that was not detected during testing. In these scenarios, Win32 app supersedence can be used to roll devices back to the last known good version. Without a retained previous version in Intune, rolling back becomes significantly more difficult.
The appropriate retention value ultimately depends on your organization’s update and rollback policy.
Delay in-place updates of previously created applications by x days
When you enable the Delay in-place updates of previously created applications by x days option, application updates are delayed for the specified number of days after the new version is synchronized from the catalog.
The delay is calculated from the date Publisher first detects the new version.
This allows time for validation or testing before updating production apps.
Example:If a new version is synchronized on February 3 and the delay is set to 3 days, the application will not be updated until a Publisher sync on or after February 6.
This allows time for validation or testing before updating production applications.
The delay is calculated from the date Publisher first detects the new version.
Update-Specific Options
The following options in this section behave the same regardless of whether they apply to applications or updates. Clicking a link takes you to the relevant section:
Last updated
Was this helpful?