The Intune alternative that skips the .intunewin dance
Start with what Intune gets right: it is powerful - if you are all-in on Entra ID (Azure AD) and Microsoft 365 licensing. It does deep OS and MDM management, mobile devices, conditional access, and compliance policies, and it plugs straight into the M365 tenant you may already pay for. If that’s your world, Intune is a reasonable place to live.
The friction shows up when all you actually want to do is push software to Windows machines. With Intune, a Win32 app generally has to be repackaged into the .intunewin format with the Content Prep Tool before it can go out. Devices typically need to be enrolled and Entra-joined to be managed. And the whole thing usually rides M365 / EMS licensing (E3, E5, or an equivalent). That’s a lot of ceremony to install one EXE.
RFF is software deployment without the wrapper. Point it at a plain EXE, MSI, PowerShell, or any script and it ships - no .intunewin repackaging, no Content Prep Tool. Agents enroll with one PowerShell line, no Entra dependency and no per-user licensing, on any Windows box. Free for your first 100 endpoints.
And if you do still need a .intunewin - because part of your fleet stays on Intune - you skip the Content Prep Tool for that too. SwitchHunt, RFF’s free browser tool, builds one for you: drop the installer and it hands back a real, Intune-ready .intunewin - plus the install, uninstall, and detection-rule text to paste into the portal - packaged entirely in your browser, nothing uploaded, nothing to install.
Start free → · No .intunewin · No Entra required · No credit card
Why a Windows team reaches for RFF instead
- Deploy plain packages, no repackaging. MSI, EXE, PowerShell, any script - as-is. No .intunewin conversion step before you can roll something out. Agents pull in parallel from a Cloudflare R2 CDN edge, so a big installer lands fast across the fleet.
- One-line enrollment, no MDM ceremony. A single PowerShell line enrolls the agent. No device MDM-enrollment ritual, no Autopilot, no Entra / Azure AD requirement, no per-user M365 seats to true up.
- Policy without the identity project. Intune’s settings catalog needs Entra-joined devices; RFF’s Settings Catalog parses your own ADMX and enforces Group Policy settings on any Windows box - domain, workgroup, or nothing at all.
- Cloud-native, nothing on-prem. Agents check in over outbound HTTPS (443) only - no inbound holes, no server to stand up. Need a one-off push to a box with no agent? RFF is also agentless over SMB + WMI for that.
- Config you can read, baseline, and enforce. Intune’s compliance policies are pass/fail against Microsoft’s schema. RFF instead lets you capture a golden box’s effective Group Policy - or seed from a CIS Windows L1 template - edit it as a versioned desired-state document, and detect drift in plain English, down to which GPO set each value. Enforcement is approval-gated with one-click rollback, and it’s free on every tier. More on conformance.
- Works on any Windows box. No Entra-join precondition. Domain-joined, workgroup, that one server nobody wants to touch - if it runs Windows and can reach 443, RFF can manage it.
- Dynamic groups that actually see your fleet. Target machines by OS, installed software, and their on-prem AD OU / Computer DN - recomputed every run. Intune’s dynamic device groups can’t key off your on-prem OU at all, so hybrid shops end up scripting extensionAttributes just to group by location.
- Monitoring and remote tools, not just policy. Scheduled checks - service state, disk-free, Defender health, event-log matches, script exit codes - open email + webhook alerts and can self-heal. Browser remote tools give you console, files, registry, and live processes without screen takeover. Intune leans on compliance policies and Remote Help.
RFF vs Intune, honestly
| RFF | Microsoft Intune | |
|---|---|---|
| Win32 / app deployment | Plain EXE/MSI/PowerShell, no repackaging | Win32 apps repackaged to .intunewin (Content Prep Tool) |
| Enrollment | One PowerShell line, no Entra needed | Device enroll / Entra-join, often Autopilot |
| Licensing to get started | Free for 100 endpoints, no M365 seats | Typically rides M365 / EMS (E3, E5, or equivalent) |
| Hosting | Hosted SaaS, agents dial out on 443 | Hosted SaaS (Microsoft cloud) |
| Platforms | Windows + macOS + Linux, no mobile (Windows-first) | Windows + macOS + iOS + Android (MDM) |
| Mobile / MDM | No - not our focus | Yes - core strength |
| Conditional access | No | Yes - deep Entra integration |
| GPO baselines + drift detection | Yes - capture or CIS template, versioned, plain-English drift | Compliance policies (pass/fail, MS schema) |
| Monitoring, alerting & auto-remediation | Yes - checks, email/webhook alerts, self-heal, workflows | Compliance policies, not RMM checks/alerts |
| Remote tools (console / files / registry / live processes) | Yes - browser, no screen takeover | Limited (Remote Help) |
| Dynamic groups by on-prem OU / Computer DN | Yes - target machines by their AD OU / DN, recomputed every run | No - Entra dynamic device groups can’t read on-prem OU; hybrid needs extensionAttribute sync hacks |
| Compliance dashboard | Yes - EOL Windows, missing AV/EDR, expiring certs, unlocked screens | Yes - device compliance state |
| Shadow-AI visibility | Yes - detects AI tools, Ollama, LM Studio, extensions | Not a focus |
| End-user self-service catalog | Yes - JAMF-style tray catalog; publish in minutes, no packaging, brandable with your logo | Yes - Company Portal (Win32 apps need .intunewin packaging) |
| Remote desktop | Beta - attended browser control, drives logon as SYSTEM | Via companion Remote Help |
| Pricing | Published, self-serve, no sales call | Bundled into M365 / EMS licensing |
Where Intune wins: if you already pay for E3/E5 and live in the Microsoft stack, Intune’s reach is real - deep OS and MDM management, mobile device management, conditional access, and tight Entra / M365 integration that RFF doesn’t do. RFF runs on Windows, Mac and Linux, but it’s not an MDM and does no phones or tablets; on a Mac, what Apple reserves for MDM (silent configuration profiles, remote wipe) stays with Intune. Where RFF wins: if the job is getting software onto Windows machines without the .intunewin wrapper, the Entra-join precondition, or another M365 seat - plus Group Policy you can actually read and keep from drifting - that’s exactly what RFF is built for.
Keep Intune too - we even build the .intunewin
This isn’t strictly either/or. If part of your fleet stays on Intune, RFF’s free SwitchHunt tool packages your app for Intune: drop a plain EXE or MSI and it builds a real .intunewin right in the browser - the same Win32 content format Microsoft’s Content Prep Tool produces, minus the download, the local install, and the upload. You get the Intune-ready package plus the install and uninstall commands and a detection rule to paste into the portal. Push what you can through RFF, and feed the rest to Intune without the packaging chore.
Try the thing Intune makes you work for
Grab any installer you’ve got - a plain EXE or MSI, no wrapping. Enroll one Windows box with the single PowerShell line, then push the installer. No .intunewin, no Content Prep Tool, no Entra-join first. Watching a raw EXE land on a machine that was never enrolled in anything is usually the moment the difference clicks.
Switching from something else?
RFF is a common landing spot for teams leaving a range of tools. If Intune isn’t the one you’re comparing, we’ve written these up too:
- PDQ alternative - cloud-native deployment for remote and WFH machines
- Action1 alternative - Windows-first, built around readable Group Policy
- NinjaOne alternative
- Tactical RMM alternative
- Automox alternative
- ManageEngine alternative
FAQ
Do I have to repackage apps into .intunewin? No. RFF deploys plain EXE, MSI, PowerShell, or any script as-is - there’s no Content Prep Tool step before you can roll something out. And if you do need a .intunewin for Intune itself, RFF’s free SwitchHunt tool builds one in your browser - no Content Prep Tool, nothing uploaded.
Do machines need to be Entra-joined or MDM-enrolled? No. Agents enroll with one PowerShell line over outbound 443. No Entra / Azure AD requirement, no Autopilot, no device MDM ceremony.
Do I need M365 or E3/E5 licensing? No. RFF is priced on its own - free for 100 endpoints, then Starter at $149/mo including 100 and $2.00/endpoint above that - and doesn’t depend on M365 or EMS seats.
Can I still use Intune alongside RFF? Yes. RFF’s free SwitchHunt tool even builds the .intunewin for you - drop an installer, get an Intune-ready package in the browser (no Content Prep Tool) - so keep part of your fleet on Intune if it suits you and run the rest through RFF.
Does RFF manage Macs and Linux? Yes, since October 2026, but it isn’t an MDM. It doesn’t do phones or tablets, and on a Mac it can’t do what Apple reserves for MDM, like silent configuration profiles or remote wipe. Running both works: Intune for MDM and mobile, RFF for software, scripts and patching. What runs where.
How is any of this secured? Agents dial out over TLS on 443 with nothing inbound, credentials are encrypted at rest, and every privileged action is audited - security details here.
Start free - deploy to Windows, no .intunewin, 100 endpoints →