Capabilities
Everything Patchblox does, and what it adds to what you run
Choose what you run today and which devices you manage. Each view lists what Patchblox adds, and marks what works with the Patchblox agent alone.
Every environment
Patchblox works with Intune, Azure Update Manager and Configuration Manager, and on its own. Choose what you run to see what Patchblox adds to it.
Patching
14Rings with health gates
Each ring opens only when the devices before it pass the checks you pick: the update installed, the device booted, no new event log errors, critical services running, the network reachable and your own validation scripts, with a success bar and soak time.
Promotion right away or on a schedule
A ring that passes opens the next one right away, or holds it for a recurring window you set, such as every Saturday at 2 AM, so testing runs all week and production deploys on the weekend.
Approval on any ring
Require a person to sign off before any ring you choose.
Stop and flag on failure
A ring that misses its success bar stops the rollout and flags the devices that already got the update. A run can be paused, resumed, retried on its failed devices, or rolled back.
Updates the test ring never saw
An update only a later ring needs is held and flagged, released from an allow list you keep, or paused for you, so nothing untested ships without a look.
Workflow Orchestration
Chain workflows so the next starts when the last finishes with the success you require: right away, once a person approves, or in a scheduled window. Change the order whenever you like, and patch a cluster one group of nodes at a time to keep it serving.
Approval rules
Priority-ordered rules approve updates by publisher, platform, classification, source, update type or security, and send them to a workflow, with an optional deferral. Exclusions force a manual review, and anything unmatched waits for a person.
Planning mode
A dry run shows which devices would get what before anything changes.
Hypervisor hosts protected
The agent won't patch a Hyper-V, Proxmox, VMware or VirtualBox host while VMs are running on it unless you allow it for that workflow.
Signed pre- and post-install scripts
Run your own steps before and after each install, such as starting a stopped VM, signed and verified on the device.
Microsoft updates
Windows and Microsoft product updates, delivered through Automation Workflows.
600+ curated third-party Windows apps
Business apps only, signed content only, with the vendor's signature checked at download and again at install.
Linux packages from each distribution
OS and app updates from each distribution's own repositories across the Debian, Red Hat and SUSE families, with control over dependencies, config files, service restarts and exact versions.
Signed and notarized macOS apps
125+ macOS apps, every one signed and notarized, checked for available updates and their CVEs. With Intune, Patchblox publishes them to Intune to install.
Vulnerability and posture
8Vulnerability Hub
Every open CVE, ranked by the fix that closes it: patch now for exploited ones (CISA KEV, MSRC and Apple), then urgent, high and routine, with EPSS, ransomware use and KEV due dates. Deploy the fix from the same row.
Monthly Releases
Every vendor's security releases this month, ranked the way Patch Radar ranks them, and how many of your devices each one reaches.
Microsoft 365 Apps, Edge and Teams
Installed versions checked against their CVEs.
Security baselines
Industry Standard and DISA STIG for Windows, macOS and Linux, Microsoft SCT for Windows, and your own.
Gold standard from a device
Clone a baseline from a well-configured device, adopting its values for the rule results you choose, and measure the rest against it.
Evidence, rule by rule
Expected against actual for every rule on every device, read from the device and exportable to Excel, CSV and PDF.
Update configuration across the fleet
Which authority controls updates on each Windows device, with its deferrals, reboot policy and active hours, and for Linux and macOS, how recently each device scanned and its automatic update settings.
Delivery Optimization health
Peer and cache savings over time, the Connected Cache hosts devices use, and where each device's Delivery Optimization settings come from.
Intune and Microsoft governance
13Intune policy version history
Every version of every compliance, configuration and update policy, with its body, assignments and custom compliance script, including silent changes Intune's own tracking doesn't show.
Drift from the approved version
Tag a version as the approved baseline and see where the live policy has moved, across settings, assignments, scripts and detection schemas.
Restore any version
Put a policy back under your own delegated Intune sign-in. Patchblox holds no standing write access.
Compare policies and devices
Compare two policies of the same type, any two versions of one policy, or the policy settings two devices actually receive.
Change impact
Line up each policy change with the device compliance that followed it.
Intune audit with anomaly detection
Every Intune change by actor, operation and target, grouped into device, app, admin, enrollment and approval events, with anomalies and deletions called out.
Effective Intune permissions
Who can perform each Intune operation, computed across every role definition and assignment.
BitLocker key escrow
Which volumes are protected and whether their recovery keys are escrowed, comparing what the device reports with what Intune holds.
Intune script history
Changes to remediation, compliance, platform and shell scripts, with their content and assignments.
Compliance trending
Intune compliance over 30, 90, 180 and 365 days, and device-to-device comparison.
Multiple Intune and Azure tenants
Every connected Entra tenant for Intune and Azure in one console, switched from any page.
Azure Update Manager compliance
Update Manager's assessment next to Patchblox's own for the same machines, with configuration risks such as patch orchestration and the Windows Update authority on Arc servers, plus run history, maintenance configurations and policy definitions.
Configuration Manager site data
Collections, client health and scan state from your Configuration Manager site database, read by collection runners with failover.
Real-time operations
12Real-time actions
70+ built-in actions for Windows and Linux, from services, firewall, BitLocker and LAPS to sudo, SSH and SELinux, run now or on a schedule, with each device's result as it happens.
Intune repair from the device
Trigger an Intune sync, check and repair the Intune Management Extension, enroll an Entra-joined device, or refresh its Entra tokens, through the Patchblox agent.
Configuration Manager client actions
Run client cycles, clear the client cache, or start a Software Center deployment, through the Patchblox agent.
Quick inventory
Fresh data from a device in under a minute.
Resource Explorer
Live data per device in up to 18 categories: processes and connections, firewall rules, certificates and the registry on Windows, keychain items and system extensions on macOS, systemd units and SELinux on Linux.
Owners and access lists
Owner, DACL and SACL for files, folders and registry keys, collected by the rules you set in each inventory template.
Secrets for scripts
Write-only secrets, referenced by id in scripts and tasks, encrypted to each target device's key and never written to disk, logs, command lines or environment variables.
Reusable schedules
Named schedules in any time zone, shared by as many tasks as you like, with several runs a day, a calendar of every run, and the next occurrences shown before you save.
Dynamic device groups
Live queries over inventory, or static lists, that target tasks, workflow rings and role scopes.
Azure scans, as you
Check for updates on Azure VMs and Arc servers as the signed-in admin, under their own Azure permissions.
Outbound-only agent
Agents connect out to your gateway. No inbound ports, WMI, SMB or remote registry.
Permissions per task type
Someone can reboot servers without being able to run scripts, and only on the device groups or Intune scope tags their role is scoped to.
Reporting and notifications
9500+ data views
Across Windows, Linux and macOS, ready to report on.
Three report designers
Dashboards, tabular reports with a Visual Query Builder and SQL editor, and change detection timelines.
Scheduled reports
Run any report on a reusable schedule and keep every result as a snapshot: CSV for tabular reports, PDF for dashboards and business reports.
Report alerts
Get an alert when a scheduled report returns rows, on every run, or only when its results change, at the severity you set.
Email, Teams, Slack and webhooks
Rules send the events you pick, by severity, to people, groups, email lists, Microsoft Teams, Slack or signed webhooks, as they happen or in hourly or daily digests, with a delivery log. Each person sets what emails them, and can mute one thing.
Metric trends
Any inventoried metric over time, against its value 7 and 30 days ago and its 30-day baseline.
Excel, CSV and PDF
Export any report or view.
API with service principals
Service principals sign in with a certificate whose key never leaves your machine: you send a CSR, your Patchblox authority issues the certificate, and tokens last 30 minutes.
Read-only MCP server
For AI tools you run yourself. No setting turns write access on.
Security and deployment
9Private Hosted
Runs entirely on your infrastructure. Patchblox receives no endpoint data and no telemetry.
Patchblox Cloud
Separate databases and separated services for every customer, with a dedicated option.
Your own certificate authority
Each customer gets its own root and issuing certificates. The root key isn't kept on the server.
Signed before it runs
Scripts, tasks and catalog content are signed, and agents verify the signature before anything runs.
Enrollment you approve
No device joins until it's approved: enrollment tokens with limited uses and lifetimes, rules evaluated in order, an approval queue, and conflict handling for devices that look like ones you already have.
No standing write access
The connector in your tenant has read-only permissions. Changes in Intune and Azure use your delegated sign-in.
Agent rollout through Intune and Azure
Publish the agent to Intune as a Win32 app, a macOS package and a Linux configuration script, to a pilot group first, as you. Azure machines get it through a run command.
Per-object permissions
Owners and access lists on reports, workspaces, scripts, secrets, tasks, schedules, workflows, approval rules, baselines and device groups.
Audit trail
Every access check and sign-in: who was allowed or denied what, which role decided, how it turned out, and who signed in from where.
See it against your environment
We'll walk through what Patchblox adds to the tools you already run.