Capabilities
Everything Patchblox does, and what it adds to what you run
Choose what you run today and which devices you manage. Each view lists what Patchblox adds, and marks what works with the Patchblox agent alone.
With Intune
Intune stays your policy and compliance engine. Patchblox reads it with read-only app permissions and changes it only under your own sign-in.
Microsoft details are from Microsoft's documentation as of November 2026.
Where Patchblox goes further
- Rings that open when the devices before them are healthy. Intune's Deployments preview moves rings on by date and time.
- 125+ signed and notarized macOS apps, published to Intune to install. Intune's Enterprise App Catalog holds Windows apps.
- Version history, drift and restore for every Intune policy, including silent changes Intune's own tracking doesn't show.
- Linux servers and more distributions. Intune enrolls Ubuntu and Red Hat desktops, and lists Ubuntu Server as unsupported.
- Baselines with evidence on macOS and Linux as well as Windows.
- An Intune audit with anomaly detection, and who can do what across your Intune roles.
Patching
12Rings with health gates
Each ring opens only when the devices before it pass the checks you pick: the update installed, the device booted, no new event log errors, critical services running, the network reachable and your own validation scripts, with a success bar and soak time.
Promotion right away or on a schedule
A ring that passes opens the next one right away, or holds it for a recurring window you set, such as every Saturday at 2 AM, so testing runs all week and production deploys on the weekend.
Approval on any ring
Hold any ring until a person signs off. Intune's approvals cover a deployment as a whole.
Stop and flag on failure
A ring that misses its success bar stops the rollout and flags the devices that already got the update. A run can be paused, resumed, retried on its failed devices, or rolled back.
Updates the test ring never saw
An update only a later ring needs is held and flagged, released from an allow list you keep, or paused for you, so nothing untested ships without a look.
Workflow Orchestration
Chain workflows so the next starts when the last finishes with the success you require: right away, once a person approves, or in a scheduled window. Change the order whenever you like, and patch a cluster one group of nodes at a time to keep it serving.
Approval rules
Priority-ordered rules approve updates by publisher, platform, classification, source, update type or security, and send them to a workflow, with an optional deferral. Exclusions force a manual review, and anything unmatched waits for a person.
Planning mode
A dry run shows which devices would get what before anything changes.
Hypervisor hosts protected
The agent won't patch a Hyper-V, Proxmox, VMware or VirtualBox host while VMs are running on it unless you allow it for that workflow.
Signed pre- and post-install scripts
Run your own steps before and after each install, such as starting a stopped VM, signed and verified on the device.
Linux packages from each distribution
OS and app updates from each distribution's own repositories across the Debian, Red Hat and SUSE families, with control over dependencies, config files, service restarts and exact versions.
Signed and notarized macOS apps
125+ macOS apps, every one signed and notarized, checked for available updates and their CVEs, and published to Intune to install.
Vulnerability and posture
7Vulnerability Hub
Every open CVE, ranked by the fix that closes it: patch now for exploited ones (CISA KEV, MSRC and Apple), then urgent, high and routine, with EPSS, ransomware use and KEV due dates. Deploy the fix from the same row.
Monthly Releases
Every vendor's security releases this month, ranked the way Patch Radar ranks them, and how many of your devices each one reaches.
Microsoft 365 Apps, Edge and Teams
Installed versions checked against their CVEs.
Security baselines
Industry Standard, DISA STIG and your own baselines on macOS and Linux as well as Windows.
Gold standard from a device
Clone a baseline from a well-configured device, adopting its values for the rule results you choose, and measure the rest against it.
Evidence, rule by rule
Expected against actual for every rule on every device, read from the device and exportable to Excel, CSV and PDF.
Update configuration across the fleet
Which authority controls updates on each Windows device, with its deferrals, reboot policy and active hours, and for Linux and macOS, how recently each device scanned and its automatic update settings.
Intune and Microsoft governance
11Intune policy version history
Every version of every compliance, configuration and update policy, with its body, assignments and custom compliance script, including silent changes Intune's own tracking doesn't show.
Drift from the approved version
Tag the approved version and see drift in settings, assignments, scripts and detection schemas, in the console, with every version kept.
Restore any version
Put a policy back under your own delegated Intune sign-in. Patchblox holds no standing write access.
Compare policies and devices
Compare two policies of the same type, any two versions of one policy, or the policy settings two devices actually receive.
Change impact
Line up each policy change with the device compliance that followed it.
Intune audit with anomaly detection
Every Intune change by actor, operation and target, grouped into device, app, admin, enrollment and approval events, with anomalies and deletions called out.
Effective Intune permissions
Who can perform each Intune operation, computed across every role definition and assignment.
BitLocker key escrow
Which volumes are protected and whether their recovery keys are escrowed, comparing what the device reports with what Intune holds.
Intune script history
Changes to remediation, compliance, platform and shell scripts, with their content and assignments.
Compliance trending
Intune compliance over 30, 90, 180 and 365 days, and device-to-device comparison.
Multiple Intune and Azure tenants
Every connected Entra tenant for Intune and Azure in one console, switched from any page.
Real-time operations
5Real-time actions
Live results from each device across Windows and Linux, servers included.
Intune repair from the device
Trigger an Intune sync, check and repair the Intune Management Extension, enroll an Entra-joined device, or refresh its Entra tokens, through the Patchblox agent.
Quick inventory
Fresh data in under a minute on Windows, macOS and Linux. Intune's live device query covers Windows.
Owners and access lists
Owner, DACL and SACL for files, folders and registry keys, collected by the rules you set in each inventory template.
Reusable schedules
Named schedules in any time zone, shared by as many tasks as you like, with several runs a day, a calendar of every run, and the next occurrences shown before you save.
Reporting and notifications
5500+ data views
Across Windows, Linux and macOS, ready to report on.
Three report designers
Dashboards, tabular reports with a Visual Query Builder and SQL editor, and change detection timelines.
Scheduled reports
Run any report on a reusable schedule and keep every result as a snapshot: CSV for tabular reports, PDF for dashboards and business reports.
Report alerts
Get an alert when a scheduled report returns rows, on every run, or only when its results change, at the severity you set.
Email, Teams, Slack and webhooks
Rules send the events you pick, by severity, to people, groups, email lists, Microsoft Teams, Slack or signed webhooks, as they happen or in hourly or daily digests, with a delivery log. Each person sets what emails them, and can mute one thing.
See it against your environment
We'll walk through what Patchblox adds to the tools you already run.