"Twin Application" deployment model to allow user uninstalls on Auto-Patched Apps

Problem Statement:
Currently, when a Patch My PC (PMPC) application is deployed to users as "Available" (via Software Center or Company Portal) and updates are managed via a "Required" deployment to a device collection, a conflict arises. The "Required" deployment prevents the end-user from permanently uninstalling the application. If a user decides they no longer need the software and uninstalls it, the "Required" assignment simply reinstalls the application during the next policy sync. This wastes licenses, consumes disk space, and frustrates users.

Proposed Solution:
Introduce a "Twin Application" (or Dual-App) management feature within the Patch My PC Publisher.

When enabled for a specific product, the PMPC Publisher would automatically create, manage, and synchronize two separate application objects in MECM/Intune simultaneously:

1. The "Self-Service" App:

   • Deployed as "Available" to user or device groups.

   • Purpose: Allows end-users to install the application on-demand from the Company Portal/Software Center and, crucially, allows them to successfully trigger an uninstall when they are finished with it.

2. The "Updater" (Required) App:

   • Deployed as "Required" to a device collection.

   • Purpose: Handles the auto-patching. It would utilize requirement rules (e.g., checking for existing registry keys or file paths) to ensure it only applies the update if the application is already installed on the device.

Benefit:
By managing these as twin apps, IT administrators can maintain strict security compliance (like UK Cyber Essentials) by forcing silent updates to vulnerable software, while still empowering users with self-service installations and uninstalls.

Note on Potential Timing Issues & Mitigation:
One potential challenge with this dual-app setup is the delay in MECM/Intune inventory synchronization. When a user uninstalls the "Available" app, the backend database does not update instantaneously. During this sync delay, the "Required" updater deployment might evaluate based on outdated inventory data and unintentionally reinstall the application.

To handle this timing overlap, the Patch My PC installation script (e.g., via the PSADT wrapper) could incorporate built-in deferrals or a grace period delay. By adding enough deferral time into the install script, the system is given a sufficient buffer for the local state and cloud/server database to sync, ensuring the required update is only enforced if the application is genuinely still installed on the device.