Capabilities
Everything Patchblox does, and what it adds to what you run
Choose what you run today and which devices you manage. Each view lists what Patchblox adds, and marks what works with the Patchblox agent alone.
With Configuration Manager
Patchblox reads collections, client health and scan state from your site database and works alongside it.
Microsoft details are from Microsoft's documentation as of November 2026.
Where Patchblox goes further
- Linux and macOS. Configuration Manager removed its Linux client in version 1902 and ended Mac client support at the end of 2022.
- Gates that check the devices after an install, in automated monthly workflows. Phased deployments advance on install success and can't use automatic deployment rules.
- Dashboards, SQL reports and change timelines, on a schedule with snapshots and alerts.
- One console with Intune and Azure Update Manager, if you run them too.
Patching
4Rings with health gates
The gates read the devices after the install, not only whether it reported success, and they work in automated monthly workflows, which phased deployments don't.
Updates the test ring never saw
An update only a later ring needs is held and flagged, released from an allow list you keep, or paused for you, so nothing untested ships without a look.
Linux packages from each distribution
OS and app updates from each distribution's own repositories across the Debian, Red Hat and SUSE families, with control over dependencies, config files, service restarts and exact versions.
Signed and notarized macOS apps
125+ macOS apps, every one signed and notarized, checked for available updates and their CVEs.
Vulnerability and posture
7Vulnerability Hub
Every open CVE, ranked by the fix that closes it: patch now for exploited ones (CISA KEV, MSRC and Apple), then urgent, high and routine, with EPSS, ransomware use and KEV due dates. Deploy the fix from the same row.
Monthly Releases
Every vendor's security releases this month, ranked the way Patch Radar ranks them, and how many of your devices each one reaches.
Microsoft 365 Apps, Edge and Teams
Installed versions checked against their CVEs.
Security baselines
Industry Standard and DISA STIG for Windows, macOS and Linux, Microsoft SCT for Windows, and your own.
Gold standard from a device
Clone a baseline from a well-configured device, adopting its values for the rule results you choose, and measure the rest against it.
Evidence, rule by rule
Expected against actual for every rule on every device, read from the device and exportable to Excel, CSV and PDF.
Update configuration across the fleet
Which authority controls updates on each Windows device, with its deferrals, reboot policy and active hours, and for Linux and macOS, how recently each device scanned and its automatic update settings.
Real-time operations
1Owners and access lists
Owner, DACL and SACL for files, folders and registry keys, collected by the rules you set in each inventory template.
Reporting and notifications
1Three report designers
Dashboards, tabular reports with a Visual Query Builder and SQL editor, and change detection timelines.
See it against your environment
We'll walk through what Patchblox adds to the tools you already run.