Patch Management

Understand how octoja rolls out operating-system updates — patch policies, deployment rings, maintenance windows, and patch cycles.

Written By Stefan Steuer

Last updated 28 days ago

octoja keeps the operating systems on your managed devices up to date. Instead of pushing every update to every device at once, you roll updates out in controlled stages, review what installs, and let healthy rollouts continue on their own. You describe the rollout once in a patch policy; octoja generates the work and installs only what you approve. Patch management covers Windows and macOS.

The building blocks

Four pieces make up a rollout.

Building block	What it is
Patch policy	The overall plan: which customers' devices it covers, the rings it rolls out through, and the rules for promoting updates between them.
Deployment ring	One stage of the rollout — for example a small pilot first, then the rest of the fleet. Each ring has its own device-matching rules and its own maintenance window.
Maintenance window	When a ring installs updates: a schedule plus how long the window stays open.
Patch cycle	One ring's scheduled maintenance occurrence — where you review and approve updates before they install.

How a rollout works

You create a policy, split its devices into rings, and give each ring a maintenance window.
octoja generates a patch cycle for each ring on its schedule, listing every pending update as Pending Review.
You review each update — Approve, Reject, or Defer — and finalize the cycle.
When the maintenance window opens, the agent installs the approved updates and reports the result of each one.
If auto-promotion is on and the ring's rollout was healthy, the same updates advance to the next ring automatically.

How rings choose which devices to patch

Each ring has rules that decide which devices belong to it. A device is patched by every ring whose rules it matches — octoja does not pick a single ring for you at install time. So give each ring a distinct set of devices (for example by tag, group, or operating system) so that every device falls into exactly one ring. A device that matches two rings is patched by both.

Rings have an order, and that order is the rollout sequence: the first ring — your pilot — installs first, then each later ring in turn. Promotion, automatic or manual, always moves updates from a ring to the next one up.

Note: The Update Catalog shows each device under a single ring to keep its per-ring counts readable, even when a device's rules overlap several rings. That display does not change which rings actually patch the device.

The patch cycle lifecycle

A patch cycle moves through a fixed set of states.

State	What it means
Draft	The cycle has been generated and is waiting for you to review its updates.
Approved	You have decided every update and finalized the cycle. It now waits for its maintenance window.
In Progress	The window is open and devices are installing.
Completed	The window has closed. Any device that never checked in is marked Missed.
Cancelled	The cycle was stopped before it ran.

You can reopen an approved cycle back to draft if you need to change a decision before its window opens.

Auto-promotion between rings

Auto-promotion advances updates to the next ring automatically once the current ring's rollout looks healthy — so you approve once and a good rollout continues without more clicks. Before promotion, the ring must clear the gate you set: a minimum success rate, a minimum number of devices that reported a result, and optionally no failures at all. The gate is checked per operating system independently, so a healthy Windows rollout is not held back by macOS results, and the reverse.

Maintenance windows and time zones

A maintenance window is a schedule plus a duration — four hours by default. Windows are evaluated in the policy's time zone and may run past midnight. A ring set to Manual only has no schedule: it generates no cycles on its own, so you patch it with an emergency cycle or by promoting updates into it from an earlier ring.

Windows and macOS together

A single policy patches a mixed Windows and macOS fleet. octoja works out each device's operating system and sends it only its own updates, so one ring and one cycle can cover both. Linux devices are not patched by patch management.

Keeping a specific update out

Sometimes one update should not install — a faulty driver, or a problematic update you are waiting to clear. Within a policy you can exclude it (by update, KB number, or category). You can also block a Windows update globally, by its KB number, so it never reaches any device across the whole instance; macOS updates can't be blocked globally, so exclude those in a policy instead. Both are honoured at the moment updates are handed to a device, even if a cycle already approved them.

Seeing what happened

The Update Catalog shows every update seen across your fleet and how far each one has progressed through the rings — how many devices have succeeded, failed, or missed it. Each cycle also has a results view with the per-device outcome, including reboots and any error reported.

Permissions

Patch management uses four permissions, granted per group under Administration → Groups:

Permission	What it allows
Patch Policy Management	Create and edit patch policies, exclusions, and global blocks.
Approve Patch Cycles	Review and finalize the updates in a cycle.
Emergency Patch Cycles	Create an emergency cycle outside the normal schedule.
View Patch Management	See patch status and history without making changes.