Solutions

Built for teams that run Microsoft endpoint management

Patchblox extends Intune, Azure Update Manager and Configuration Manager where they stop, and fully manages endpoints standalone where there is no Microsoft stack. Here is where it helps most.

Where Patchblox fitsWhat Patchblox adds to the stack you run
You runPatchblox adds
You runIntunePolicies, compliance and devices

Patchblox adds

  • Policy history with side-by-side diff
  • Drift and restore under your own sign-in
  • Compliance trended over 365 days
  • Advanced inventory across Windows, Linux and macOS
  • Fully customizable reporting with hundreds of built-in reports
  • Servers and Linux in the same console
You runAzure Update ManagerWindows and Linux servers in Azure, on Arc or in your data center

Patchblox adds

  • Rings with health gates and rollback
  • Workflows that run in an order you can change
  • 600+ third-party Windows apps, no WSUS required
  • Pre- and post-install scripts
You runConfiguration ManagerPatchblox reads its collections, client health and scan state

Patchblox adds

  • Client actions with a live result from each device
  • Extended inventory beyond hardware inventory
  • Linux and macOS
  • Automation Workflows
  • Fully customizable reporting with hundreds of built-in reports
No Microsoft stackPatchblox on its ownFull endpoint management, standalone

Patchblox runs

  • Windows, Linux and macOS
  • Private Hosted or Patchblox Cloud
  • Signed content and outbound-only agents

Intune admins

Intune without Configuration Manager

You manage policies, compliance and devices through Intune, and Configuration Manager is gone or on its way out.

"A policy changed last Thursday and broke 200 devices. Intune's audit log doesn't show what changed."
  • Policy version history with side-by-side diff, including linked script changes the Intune audit log misses.
  • Drift from the version you approved, and restore under your own delegated sign-in.
  • Compliance trended over 30, 90, 180 and 365 days, not just today's checkbox.
  • Advanced inventory across Windows, Linux and macOS: fresh data from a device in under a minute, and live data in up to 18 categories, from the registry and certificates on Windows to keychain items on macOS and systemd units on Linux.
  • Fully customizable reporting with hundreds of built-in reports. Design your own dashboards, tabular reports (visual query builder or SQL) and change timelines over 500+ data views that include your Intune data, run any of them on a schedule, keep every result, and get an alert when the results change.
  • Servers and Linux that Intune doesn't manage, in the same console.
  • Real-time actions with a live result from each device.
Intune and Microsoft governance

Server teams

Servers on Azure Update Manager or on-premises

You patch Windows and Linux servers in Azure, on Azure Arc or in your own data center.

"We push updates to production and pray. There's no staging, no testing, no rollback."
  • Automation Workflows: rings with health gates, an automatic stop when a ring fails, rollback when you choose, and a manual approval on any ring.
  • Workflow Orchestration: one update workflow starts when another finishes with the success you require, right away, after an approval or in a window you set, and you can change the order whenever you like. Update Manager runs each maintenance configuration on its own schedule.
  • 600+ curated third-party Windows apps, no WSUS required. Update Manager installs third-party updates only after you publish them to WSUS, which Microsoft deprecated in September 2024.
  • Pre- and post-install scripts without Event Grid or Azure Functions.
  • Linux packages from each distribution's own repositories, across the Debian, Red Hat and SUSE families.
How Automation Workflows work

Security and compliance teams

Proof of actual state for auditors

You need evidence of configuration state, and a defensible order for fixing what's exposed.

"Our auditor wants proof of actual configuration state, not a vendor's pass/fail checkbox."
  • Expected against actual for every rule on every device, read from the device itself.
  • Baselines: Industry Standard and DISA STIG for Windows, macOS and Linux, Microsoft SCT for Windows, and your own.
  • Exploited first: priorities from CISA KEV, EPSS and vendor exploitation data.
  • Exports to Excel, CSV and PDF.
Vulnerability and posture

Regulated and sovereign

Keep the platform and the data in your own environment

Your endpoint data can't sit in someone else's cloud, or your policy says it shouldn't.

  • Private Hosted runs entirely on your infrastructure. Patchblox receives no endpoint data and no telemetry.
  • Your own certificate authority. The root key isn't kept on the server; you hold the recovery file.
  • Signed scripts, tasks and catalog content, verified by the agent before anything runs.
  • Outbound-only agents, and no standing write access to your Microsoft tenant.
Security and Trust

Configuration Manager sites

Running Configuration Manager?

Patchblox reads collections, client health and scan state from your Configuration Manager site database (one site per Patchblox installation). It runs client actions, cache cleanups and Software Center deployments through its own agent with a live result from each device, and adds extended inventory, Linux, macOS, Automation Workflows and fully customizable reporting.

Supported platforms

See it in your situation

Tell us what you run and we'll show you the parts of Patchblox that matter to it.

Get a demo