Pckgr for Intune
Pckgr for Intune is designed to work alongside Microsoft Intune.
Pckgr uses a least-privilege approach when requesting permissions to connect to a customer’s Microsoft environment. The service requests access required to provide its application and Intune management functionality rather than broad access to customer end-user data.
Application deployment and management continue to use the customer’s Microsoft Intune environment.
Pckgr for Intune application security
Pckgr maintains a private application repository rather than relying solely on public package feeds.
Applications made available through the Pckgr repository are packaged through controlled infrastructure and are tested, validated and scanned for malware before release.
Pckgr for Intune uses established cloud infrastructure and controlled delivery mechanisms for application storage and delivery.
Data location
Pckgr RMM customer data is stored in the United States.
Pckgr for Intune customer data is also stored in the United States.
Certifications
Pckgr is in the process of ISO/IEC 27001 certification. Contact support@pckgr.com for the auditor’s statement of intent.
Encryption
All traffic between the portal, API and agents uses HTTPS/TLS, with HSTS enforced. Device credentials are protected at rest (DPAPI on Windows, root-only on macOS) and passwords are hashed with salted BCrypt.
Sign-in and access
Sign in with Microsoft Entra ID (SSO) or a password of at least 12 characters, with email one-time codes, repeated-failure lockouts and sessions that expire after 12 hours of inactivity.
Tenant isolation
Every query is filtered by tenant. If the tenant can’t be confirmed, no data is returned.
Agent and device security
Every agent request is signed and protected against replay, device secrets rotate every 30 days, and agent files are only writable by SYSTEM and Administrators.
Package integrity
Every package and script is checked against a SHA-256 hash before it runs, and is downloaded through short-lived storage links. Our installers and agent are code-signed by Pckgr Pty Ltd.
Package testing
Every app we package is tested before release: VM testing, installation validation, malware scanning and vulnerability testing.
Audit log
Admin actions, including sign-ins, configuration changes, app assignments and policy updates, are recorded in a tenant-scoped audit log.
Hardened environments
The Windows agent works alongside AppLocker, App Control for Business (WDAC), Attack Surface Reduction rules and restricted PowerShell policies. Our guide lists the exact rules and exclusions.
Vulnerability tracking
See known vulnerabilities (CVEs) in the apps installed across your devices.
Report a security concern
Email support@pckgr.com.