Third Party Patcher

Seconds of countdown in the deferral prompt before the automatic action fires.

Default: 300

Action when the deferral countdown expires with no user input: "defer" (postpone to next cycle) or "kill" (force-quit blocking app and apply).

Default: "defer"

Default deferral duration in minutes applied when the user accepts without choosing a custom time (4 hours).

Default: 240

Comma-separated list of deferral durations in minutes shown in the pop-up menu.

Default: "5,30,60,120,240,480,1440"

The number of minutes to defer the update restart dialog automatically if a process has prevented display sleep (for example, during an active meeting) or the user has Focus or Do Not Disturb enabled

Day of the week for the patch window: 1=Sunday, 2=Monday, 3=Tuesday … 7=Saturday.

Default: 3

Range: Sunday (1), Monday (2), Tuesday (3), Wednesday (4), Thursday (5), Friday (6), Saturday (7)

Which occurrence of `PatchingWeekday` in the month: 1=first, 2=second, etc.

Default: 2

Range: First (1), Second (2), Third (3), Fourth (4)

Earliest time to begin applying on patch day (24-hour `HH:MM`). Empty = no lower bound.

Latest time to begin applying on patch day (24-hour `HH:MM`). Apply will not start a new run after this time.

When `true`, the swiftDialog window floats above all other windows.

Default: true

When `true`, the apply completion dialog closes automatically after `UnattendedExitSeconds` if the user does not interact.

Default: true

Seconds before the apply completion dialog auto-closes when `UnattendedExit` is `true`.

Action when a blocking process is running during apply: `"ignore"` (skip the check entirely), `"kill"` (force-quit silently), `"notify"` (brief notification; skip label if still running), `"prompt"` (timed dialog; user can quit or skip), `"defer"` (skip silently; retry next cycle).

Default: "prompt"

Range: ignore, kill, notify, prompt, defer

Seconds of countdown in the blocking process prompt before the automatic action fires.

Default: 120

Path to a custom icon for the apply dialog. Empty = use the system computer icon. Supports absolute paths, `SF=<symbol>` notation, or an SF Symbol name directly.

When `true`, a small overlay icon is composited onto the dialog icon. Automatically disabled when swiftDialog is not installed.

Default: true

Path to the overlay icon image. Empty = auto-detect from known MDM agents (Jamf, Intune, etc.).

Position of the main apply dialog: `topleft`, `left`, `bottomleft`, `top`, `center`, `bottom`, `topright`, `right`, or `bottomright`.

Default: "center"

Range: topleft, left, bottomleft, top, center, bottom, topright, right, bottomright

Position of the progress/status window during apply. Same position values as `DialogScreenPosition`.

Default: "bottomright"

Range: topleft, left, bottomleft, top, center, bottom, topright, right, bottomright

curl `--limit-rate` format bandwidth cap for staged downloads (e.g. `"500K"` for 500 KB/s, `"2M"` for 2 MB/s). Empty string = unlimited.

Default: ""

Consecutive download or verification failures before a label is marked broken and skipped by the stage phase.

Default: 3

Consecutive install failures before a staged update is abandoned and that version is blocked from re-staging. Staging resumes automatically when a newer version becomes available.

Default: 3

When `true`, labels that return no `appNewVersion` value are skipped entirely during staging.

Default: false

For labels with unknown versions, re-check this many days after the last attempt (instead of the normal `CheckIntervalHours` cadence).

Default: 7

When a label reports a version that does not match the file actually downloaded, suppress re-staging for this many days. Cleared automatically when the label reports a different `appNewVersion`.

Default: 7

When `true`, a one-time random delay is applied before the first scan after initial deployment. Spreads fleet-wide first-scan load across the `InitialScanDelayMaxSeconds` window.

Default: true

Maximum jitter for the initial deployment delay in seconds (default: 24 hours). The actual delay is chosen randomly in `[0, max]` on first launch and persisted.

Default: 86400

Days between full application scans. A full scan re-evaluates all Installomator labels to discover installed apps.

Default: 30

When `true`, a scan is triggered immediately if the Installomator or Managed Labels have been updated since the last scan, regardless of `ScanIntervalDays`.

Default: true

Hours between light scan runs. A light scan checks uninstalled labels for apps that may have been installed by other means, without re-running label scripts or hitting the network for non-installed labels.

Default: 24

Hours between check runs. A check reads installed versions for already-discovered apps to detect whether an update is needed.

Default: 12

Hours between stage runs. The stage phase downloads pending updates.

Default: 12

Minimum hours between apply runs in deadline-based patching mode. Prevents apply from running every 10-minute cycle once updates are pending. Not used in monthly patching mode — the patch-day window controls timing.

Default: 4

A space-separated list of Installomator labels to ignore for the TPP workflow. Supports wildcards, for example "microsoft*". A single "*" ignores every Installomator label except those listed in Required Labels and Optional Labels.

When `true`, automatically detects apps whose updates are already controlled by MDM policies and excludes their labels from patching. Currently detects Microsoft 365/Office (via MAU), Microsoft Edge, Google Chrome, and Google Drive.

Default: true

When `true`, automatically ignores non-production label variants — labels whose name ends with one of `NonProductionLabelSuffixes` — but only when a production label of the same base name also exists. E.g. with the default suffixes, `microsoftedgebeta` and `microsoftedgedev` are ignored because `microsoftedge` also exists as a label; a label like `figma` is untouched, and a hypothetical `somethingbeta` is left alone if `something` is not also a known label.

Default: true

Space-separated list of suffixes that mark a label as a non-production variant of a base label. Only used when `IgnoreNonProductionLabels` is `true`. Does not support wildcards.

Default: "beta canary dev"

When a label and its `pkg`-suffixed counterpart both exist (e.g. `bbedit` and `bbeditpkg`), only one should ever be active — they deliver the same app via different installer mechanisms. When `true`, the pkg-suffixed label is preferred and the non-pkg label is ignored. When `false`, the non-pkg label is preferred and the pkg-suffixed label is ignored instead.

Default: true

a space-separated list of Installomator labels that are required, regardless if the app is installed or or the latest version. Supports wildcards.

Space-separated list of label names made available for user-initiated self-service installation via the Available Software catalog. Does not support wildcards. Labels are presented in the order listed here, allowing you to feature priority apps at the top. Example: `"microsoftword zoom slack"`.

Show swiftDialog prompts during the apply phase. If `false` (or swiftDialog is not installed), blocking process handling falls back to the configured `BlockingProcessAction`.

Default: true

Allows you to customize the name of Third Party Patcher to something else

Default: "Third Party Patcher"

Font color used in dialogs and apps. These values set the accent colors used in swiftDialog prompts. Each accepts a standard Apple color name (`black`, `blue`, `gray`, `green`, `orange`, `pink`, `purple`, `red`, `white`, `yellow`) or a hex value (e.g. `#00A4C7`).

Default: "white"

Background color used in dialogs and apps. These values set the accent colors used in swiftDialog prompts. Each accepts a standard Apple color name (`black`, `blue`, `gray`, `green`, `orange`, `pink`, `purple`, `red`, `white`, `yellow`) or a hex value (e.g. `#00A4C7`).

Default: "blue"

Enable verbose debug logging. When `true`, per-label key dumps and other low-signal output are included in `/Library/Logs/Patcher/`.

Default: false

Number of days to retain log files in `/Library/Logs/Patcher/`. Files older than this are deleted during the `cleanLogs` run. Set to `0` to disable automatic log cleanup.

Default: 90

Ignore apps found in '/Users/'. If an update is found in '/Users/' and variable is set to false, the app will be updated into the application's default path

Default: true

This will convert any apps found in the users home folder to the /Applications folder

Default: false

When `true`, apps found only on external volumes (`/Volumes/*`) are excluded from discovery and never updated. Useful in environments where external drives are transient and should not be managed.

Default: false

GitHub account hosting the Installomator label repository.

Default: "Installomator"

GitHub repository name for Installomator labels.

Default: "Installomator"

The name of the branch you want to use in your custom repo, typically main.

Default: "main"

When `true`, disables all Installomator label management: no initial download, no update checks, and Installomator labels are never used. Only Managed-Labels are used.

Default: false

When `true`, skips routine label update checks while still using labels already on disk. Has no effect on the initial download when no labels are present. Ignored when `InstallomatorLabelsDisable` is `true`.

Default: false

GitHub account hosting the Installomator Metadata repository.

Default: "Installomator"

GitHub repository name for Installomator Metadata.

Default: "Installomator"

Branch to pull metadata from.

Default: "main"

When `true`, the scheduler periodically checks the metadata repository for updates and syncs icons and metadata to a local cache.

Default: true

Days between metadata repository sync checks.

Default: 10

Display name for your IT team in the Help Message

Default: "IT Support Team"

Support email address. Shown as a clickable `mailto:` link in the Help Message

Default: "support@company.com"

Support phone number in the Help Message. Set to `"None"` to hide the field.

Default: "None"

Support portal URL in the Help Message. Set to `"None"` to hide the field.

Default: "None"

When `true`, the scheduler installs and loads the PatcherMenu LaunchAgent for the current console user. When `false`, the LaunchAgent is unloaded and the plist removed. Managed automatically at each scheduler run.

Default: true

Icon displayed in the menu bar status item. Accepts an SF Symbol name (e.g. `"gear"`) or an absolute path to a template-mode PNG. A template PNG adapts automatically to light/dark menu bar appearance. Empty = built-in default.

Default: ""

When `true`, a Help (?) button is shown in the menu bar popover header. Tapping it displays the support contact information.

Default: true

When `true`, the Last Activity section (scan / check / stage / apply dates) is shown in the menu bar popover.

Default: true

Controls how the deferral count line is shown in the popover. `combined` — one total covering every deferral, including auto-deferrals (timer time-outs and blocking-process skips). `split` — two figures: deferrals the user actively chose, and auto-deferrals combined. `userOnly` — only the count of deferrals the user actively chose.

Default: "combined"

Range: combined, split, userOnly

When `true`, a Quit button is shown in the menu bar popover footer.

Default: false

When `true`, the "Download New Updates" option appears in the Run Now menu.

Default: true

When `true`, the "Check for Updates" option appears in the Run Now menu.

Default: true

When `true`, the "Full Discovery Scan" option appears in the Run Now menu.

Default: true

When `true`, scan and check operations triggered from PatcherMenu display a swiftDialog progress window.

Default: true

Organization name shown in the Available Software sidebar header above the app title.

Default: "Patcher Corp."

Absolute path to a PNG or ICNS file used as the Available Software app icon, overriding the built-in icon in the Dock, Finder, and app switcher. Empty = use the default built-in icon.

Default: ""

When `true`, apps successfully installed via self-service are automatically added to the current user's Dock if not already present.

Default: true

Controls when scheduled webhook reports are sent: `"FALSE"` (never), `"FAILURES"` (failures only), `"ALL"` (successes and failures).

Default: "FAILURES"

Range: FALSE, FAILURES, ALL

Microsoft Teams incoming webhook URL.

Slack incoming webhook URL.

Comma-separated list of device attributes included in webhook payloads, in display order. MDM info is always appended if detected. Supported values: `deviceName`, `hostname`, `serial`, `osVersion`, `osBuild`, `osName`, `model`, `hardwareModel`, `user`, `patcherVersion`, `installomatorVersion`.

Default: "deviceName,serial,osVersion,user"

When to send accumulated webhook reports: `"immediate"`, `"daily"`, `"weekly"`, `"monthly"`, or `"patchDay"`.

Default: "immediate"

Range: immediate, daily, weekly, monthly, patchDay

For `weekly` schedule: day of week to send (0=Sunday … 6=Saturday).

Default: 1

Range: Sunday (0), Monday (1), Tuesday (2), Wednesday (3), Thursday (4), Friday (5), Saturday (6)

For `monthly` schedule: day of month to send (1–31).

Default: 1

For `daily`, `weekly`, and `monthly` schedules: hour of day (0–23) at which to send.

Default: 8

Minimum consecutive stage failures for a label before it is included in webhook notifications.

Default: 2

Controls whether an immediate webhook is sent after a user-initiated self-service install, regardless of `WebhookSchedule`. Options: `"FALSE"` (never), `"FAILURES"` (failed installs only), `"ALL"` (success and failure).

Default: "FALSE"

Range: FALSE, FAILURES, ALL

When `true`, the scheduler runs a silent apply pass before the interactive apply phase. Apps whose blocking process is not running are installed without prompting. Items skipped in the silent pass are shown in the interactive dialog as usual.

Default: false

Days a pending update must be present before Focus/DND auto-deferral is disabled and the user must be prompted regardless of Focus state. `0` means Focus is always respected.

Default: 4

Days a pending update must be present before no further deferrals are offered and the update is applied at the next opportunity. `0` disables hard deadlines.

Default: 10

When `false`, Focus/DND and display assertions (e.g. active screen sharing) are never checked. The prompt is shown regardless of the user's Focus state.

Default: true

Space-separated list of process names to ignore when checking for display-sleep assertions (`pmset -g assertions`). If the process holding the assertion resolves to a name that matches an entry here (case-insensitive), the assertion is not treated as a blocker and patching may proceed.

When `true`, deferral options are progressively capped as the patching window closes. Options shrink from 2 hours early in the day to 5 minutes near window end, then deferral is removed entirely once the window closes. When `false`, the full `DeferralTimerMenu` list is always shown. Applies to both monthly and deadline mode on the final patch day.

Default: true