PackageForge turns an installer into a PSADT v4 package, an .intunewin, and an SCCM application — vulnerability-scanned, staged, and audited — in one flow.
Why PackageForge
Most tools pick a side — patching, ConfigMgr, or Intune. PackageForge is the workbench underneath all of them.
PackageForge is the packaging and deployment workbench for Windows admins who run Intune and SCCM — built by packagers, for packagers, with PSADT v4 at the core and a real audit trail from analysis through staged rollout.
Capabilities
Four pillars. One package. Both deployment systems.
MSI metadata, ProductCode, UpgradeCode, EXE properties, silent-install args, dependencies — pulled out automatically.
WinGet and Homebrew in one catalog. Download SHA256-verified. Vulnerability scanning built in.
VirusTotal hash lookup, NVD CVE matching, and Defender TVM cross-reference — before the package leaves the bench.
Install, uninstall, and repair scripts generated from the v4 community template. You still own the script — we just stop you typing the boilerplate.
Auto-generated MSI, file, registry, and PowerShell detection methods. Edit them. Test them. Trust them.
Your packaging standards, baked in. Branding, transforms, custom actions, log paths — templated once, applied everywhere.
Publish to ConfigMgr through a relay-queue connector with HMAC-authenticated agents. Then run the parts ConfigMgr never gave you: supersedence chains, retire/restore, soft-guard against accidental retirement, impact preview before you click, and a full audit feed of every move.
Build the .intunewin, upload via Graph, set detection rules, assign to Entra groups. No portal-clicking.
Every package, both targets, one view. Install status, available updates, supersession state — surfaced.
Vulnerable app or version drift detected? One flow — latest version, packaged, dual-published.
Pilot → Broad → Production. Configurable success thresholds per phase. Auto-advance when the floor holds. Batched Graph status calls so it scales to thousands of devices without throttling. Real-time progress over WebSocket, not a five-minute refresh loop.
PSADT scripts POST install outcomes back to the server. Rate-limited, persisted, and queryable per device.
OIDC via Entra ID, AES-256-GCM encrypted secrets, full audit feed of lifecycle actions, web-only deploy on Azure Container Apps.
Integrations
No re-platforming. No new agent on the endpoint.
Win32 and macOS app upload (DMG/PKG via Graph), group assignment & supersedence
Relay-queue connector, HMAC-authenticated agents, supersedence, retire/restore.
SSO via authorization code flow. Legacy password fallback for first-run.
Windows software catalog — SHA256-verified downloads
macOS software catalog — search, SHA256-verified download, Intune upload (DMG/PKG)
File-hash threat intel, CVE lookup by product/version, aggregated risk score.
Cross-reference packages against your tenant's Defender vulnerability findings.
FAQ
The things the packaging team asks before they sign up.
Yes — that's the primary use case. PackageForge publishes the same package to both targets from a single flow.
Yes. A lightweight .NET connector runs on your ConfigMgr infrastructure and communicates outbound over HTTPS. No inbound firewall rules required.
No. Installers and PSADT packages stay in your environment. PackageForge stores metadata, deployment status, and the audit record — not binaries.
Yes. Every generated script is yours to edit before packaging runs. We generate the scaffold; you own the source.
Full access to the packaging pipeline, Intune and SCCM publishing, Iron Chain rollouts, and the deployments dashboard. Capacity is limited per wave.
PackageForge v2 is web-only, hosted on Azure. A self-hosted option is on the roadmap — join the waitlist to vote on it.
Partially — here is what works today: The software catalog searches both WinGet (Windows) and Homebrew (macOS), and you can download and upload macOS apps (DMG and PKG format) directly to Microsoft Intune from the same workspace. PSADT packaging, SCCM deployment, and Iron Chain rollouts are Windows-only capabilities. If your team manages both Windows and macOS endpoints through Intune, the catalog and upload flow works today.
We're letting in packaging engineers and endpoint teams in waves. Tell us what you run — we'll reach out when your spot opens.