Set up patch policies and cycles

A patch policy controls how operating-system updates roll out across your fleet. It targets customers, splits their devices into staged deployment rings, and gives each ring its own Maintenance Window. From those rings octoja generates patch cycles — one scheduled maintenance occurrence per ring, where you review and approve the updates before they install.

This guide walks through creating a policy, then shows how the cycles it produces are reviewed and approved.

Prerequisites

• You need the Patch Policy Management permission to create and edit patch policies. To review and finalize cycles you also need Approve Patch Cycles, and to create emergency cycles you need Emergency Patch Cycles. Permissions are assigned under Administration → Groups.
• At least one managed device with the octoja agent installed, so a ring has devices to patch.

Create a patch policy

Patch management lives under the Patch Management navigation group, which holds Patch Cycles, Update Catalog and Policies.

1. Go to Patch Management → Policies and click Create Policy. The quick-create dialog asks only for a Name, then drops you into the policy editor.
2. In the editor, add an optional Description.
3. Set the Customer scope. Pick the customers this policy applies to, or leave it empty to apply it to every customer's devices.

Add deployment rings

Rings let you roll out updates in stages — for example a small pilot ring first, then the rest of the fleet. Each ring has an order, a schedule, and rules that decide which devices belong to it.

1. Under Rings, click Add Ring.
2. Enter a Ring Name. Drag rings to reorder them; the order is the promotion order from first ring to last.
3. Under Rules, define which devices match this ring.
4. Set the Maintenance Window schedule. This is when the ring's cycles run. Set a Duration of maintenance window (minutes) for how long the window stays open (default 240). Choose Run manually only (no schedule) if you do not want automatic cycles — no cycles are generated on a schedule, but you can still create emergency cycles by hand.
5. Set Auto-reboot after patching if devices may restart on their own after installing updates, and set Max reboot cycles to cap how many reboot passes a single maintenance window allows (default 3).

How rings pick devices: a device is patched by every ring whose rules it matches — octoja does not assign it to just one ring for you. Give each ring a distinct set of devices (for example by tag, group, or operating system) so that every device falls into exactly one ring; a device that matches two rings is patched by both.

Optional: auto-promotion between rings

Auto-promotion moves an update on to the next ring automatically once the current ring has installed it successfully — so you only approve once, and a healthy rollout continues without further clicks.

1. Open the Auto-Promotion section and turn on Enable auto-promotion between rings.
2. Set the gate that the current ring must clear before promotion:

Optional: exclude updates

The Exclusions block permanently withholds specific updates from every device the policy covers, even when they would otherwise be approved — useful for holding back drivers or a problematic KB. Open Exclusions, click Add Exclusion, and match by Update ID, KB article number, or Category.

Click Save Policy. octoja now generates patch cycles for each ring according to its Maintenance Window.

How patch cycles get reviewed and approved

A patch cycle is one ring's scheduled maintenance occurrence. Its status flows from Draft to Approved to In Progress to Completed (or Cancelled, or Missed if its maintenance window passed before the cycle was finalized). You review and approve the updates while the cycle is still a draft.

1. Go to Patch Management → Patch Cycles and open a cycle. The Updates tab lists every update in scope.
2. Decide each update. An update is Pending Review until you set it to Approved, Rejected, or Deferred. Use Approve All Pending or Approve Critical + Important to decide in bulk. If the fleet changed since the cycle was drafted, click Refresh now to re-check it against the current devices while keeping the decisions you have already made.
3. When every update has been reviewed, click Finalize Cycle. The cycle moves to Approved and waits for its Maintenance Window, then installs during the window and moves to Completed.

The Update Catalog page shows where each update stands across your environment, so you can see which rings have already received it.

Emergency cycles

An emergency patch cycle bypasses ring ordering and rolls a chosen update out to the rings you select, at the time you choose. Use it for an urgent fix that should not wait for the normal staged rollout. Creating one needs the Emergency Patch Cycles permission.

One policy patches Windows and macOS together

A single policy, ring, and cycle covers a mixed Windows and macOS fleet. There is no per-policy operating-system switch: octoja derives each device's operating system from the device itself and sends it only its own operating system's updates. When auto-promotion is on, the success gate is evaluated per operating system independently, so a healthy Windows rollout is not held back by macOS results and the reverse.

See also: Patch Management for how patching works, the Update Catalog page for tracking a single update across rings, and your group and permission settings under Administration → Groups.