CI/CD for patching

Your developers don't ship code straight to production, and your updates shouldn't go out that way either. Approve a product once. Every new release then flows through your rings, and each ring opens only when the devices before it are healthy, right away or at a time you schedule. Windows and Linux, servers and desktops.

Get a demo Compare with Intune Deployments

Automation WorkflowThird-party Windows apps

Running

InstallingPassedNeeds approvalPaused

CGoogle Chrome 142.0.7444.59Installing on the test ringChecking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthy. Ring 1 opens.Installing on Ring 1Passed: 99.4% healthy, needs 98%Installing on Ring 2Health checks passed. Waiting for the ring owner to approve Production.Approved. Production opens.Rolling out to ProductionReleased to all 5,754 devices, one ring at a time

AAcrobat Reader 25.001Not released yetInstalling on the test ringChecking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthyInstalling on Ring 1Event logs: Acrobat crashed on 5 devices. 97.2% healthy, needs 98%.Paused. 5 devices flagged; Ring 2 never sees it.Paused at Ring 1 until you retry, resume or roll back.

7z7-Zip 25.01Not released yetInstalling on the test ringChecking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthyInstalling on Ring 1Passed: 100% healthy, needs 98%Installing on Ring 2Installed on Ring 2

Approved

Test ring24 devices Ready for the next releaseInstalling on 24 devices24 of 24 installed

Gate

Boot
Logs
Health
98%

Ring 1180 devices Ready for the next releaseInstalling on 180 devices180 of 180 installed5 devices failing their checksPaused with 5 devices flagged

Gate

Boot
Logs
Health
98%

Ring 21,250 devices Ready for the next releaseInstalling on 1,250 devices1,250 of 1,250 installed

Gate + approval

Boot
Logs
Health
98%
Owner

Production4,300 devices Ready for the next releaseRolling out to 4,300 devices4,300 of 4,300 installed

CGoogle Chrome142.0.7444.59Checking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthy. Ring 1 opens.Checking boot, event logs, health signals and the thresholdPassed: 99.4% healthy, needs 98%Checking boot, event logs, health signals and the thresholdHealth checks passed. Waiting for the ring owner to approve Production.Approved. Production opens.Released to all 5,754 devices, one ring at a time

AAcrobat Reader25.001Checking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthyChecking boot, event logs, health signals and the thresholdEvent logs: Acrobat crashed on 5 devices. 97.2% healthy, needs 98%.Paused. 5 devices flagged; Ring 2 never sees it.

7z7-Zip25.01Checking boot, event logs, health signals and the thresholdPassed: 24 of 24 healthyChecking boot, event logs, health signals and the thresholdPassed: 100% healthy, needs 98%

New releases of the products you approve enter on their own. Microsoft updates and Linux packages run in their own workflows.Sample data

The CI/CD ideas you already trust, applied to updates

CI/CD concept	In Automation Workflows
Pipeline	An Automation Workflow for an update type: Microsoft updates, third-party Windows apps or Linux packages
Trigger	The products you approve. Each new release enters the pipeline on its own.
Stages	Rings, each with its own device group and timing
Canary	The test ring, which always goes first
Gates	Boot verification, event log analysis, customizable health signals and success thresholds, plus a manual approval on any ring you choose
Deployment window	Scheduled promotion: once a ring passes its gate, the next one can wait for the time you set, so testing runs all week and production deploys on Saturday
Release	The approved updates, installed in the order you approved them
Dry run	Planning mode
Rollback	A ring that misses its threshold stops the pipeline and flags the devices that got the update. You roll back a run when you choose.
Pipeline chaining	Workflow Orchestration
Build board	The Kanban board: To Do, In Progress, Testing, Done

Gates that look at the devices, not just the calendar

Boot verification: did the device come back up after the update?
Event log analysis: new errors, service failures or crashes after installation.
Customizable health signals: service status, registry values, running processes, network reachability, defined per workflow.
Manual approval per ring, for the rings where you want a person to sign off.
Right away or on a schedule: once the ring before it passes, the next ring opens immediately or at the time you set, so testing can run all week and production can deploy on Saturday.
Success thresholds per ring, with automatic pause on boot failures, critical service failures or application launch failures.
Retry, resume or roll back: a run that stops flags the devices that already got the update, and you choose what happens next.
Notifications by email, Teams or webhook when a ring is promoted or paused.

Know what your test ring doesn't test

Patchblox shows where production differs from your test ring, so a clean test run means what you think it means.

Before and after

Signed pre- and post-install scripts stop services, take backups or check prerequisites, with a continue-on-failure option for non-critical checks.

Automation Workflows and Intune Deployments

Intune's new Deployments feature, in public preview since September 2026, takes one specific version of one app, or one policy, and pushes it through timed rings. When the next version ships, an admin builds a new deployment and starts again. Automation Workflows do what Deployments do, staged rings, and add what they leave out: a continuous pipeline, gates that check the devices, and Windows updates and Linux on servers as well as desktops.

	Intune Deployments (preview)	Patchblox Automation Workflows
What a rollout carries	One payload: a single app version or a single policy	A standing pipeline for the products you approve
When the next version ships	An admin wraps it in a new deployment and runs the rings again	It enters the pipeline automatically
What it rolls out	Win32 and Enterprise App Catalog apps, Settings catalog and Endpoint security policies	Microsoft updates, 600+ third-party Windows apps and Linux packages
Windows updates and drivers	Not among the supported payloads	Microsoft updates are a core update type
Platforms	Windows 10 and later	Windows and Linux, servers and desktops
How rings advance	On a schedule, by deferral time between rings	When gates pass: boot verification, event logs, your customizable health signals and success thresholds, plus a manual approval on any ring you choose. The next ring then opens right away or at a time you schedule.
When something breaks	Rings keep advancing on schedule unless an admin pauses or cancels by hand, so problems tend to surface as user reports	The rollout stops itself past the threshold you set and flags the devices that got the update. You retry, resume or roll back.
Before and after install	Not part of a deployment	Signed pre- and post-install scripts
Dry run	Not documented	Planning mode
Test coverage	Not documented	Test-ring coverage gaps

Based on Microsoft's documentation for Deployments in Intune as of November 2026, while the feature is in public preview; Microsoft may change it before general availability. Microsoft Learn: Deployment plans and deployments

Where each fits: Intune Deployments are a good way to stage a single app or policy change. Automation Workflows run the continuous stream of Microsoft, third-party and Linux updates across servers and desktops. They work side by side.

Watch a release move through the rings

We'll show a workflow from approval to production, including a gate that stops a bad update.

Get a demo