Deployment lifecycle
A patch that breaks the fleet is worse than the vulnerability it fixes. The lifecycle makes every rollout deliberate and provable: pilot first, validate the installer, approve explicitly, expand, verify against real inventory, then clean up after itself.
The stages
- Pilot. Deploy to a small pilot ring first and watch real results before the rest of the group is touched.
- Validate. Patch Console fetches the installer and checks it: SHA-256 hash and Authenticode signature. Nothing unvalidated ships.
- Approve. An explicit, audited action. Approval creates the actual artifacts: the Intune Win32 app or remediation script with its assignment groups and detection rules, or the signed script for agent-channel devices.
- Expand. The deployment rolls out to the remaining devices in the group.
- Verify. Version gates and inventory confirm each device really moved to the fix target. See Verification loop.
- Clean up. Finished deployments are retired automatically, including the Intune artifacts they created, so your tenant does not accumulate dead apps.
Deploy states
| State | Meaning | |
|---|---|---|
| new | New | The group exists; no installer has been validated yet. |
| validated | Validated | The installer passed hash and signature checks and is ready to approve. |
| approved | Approved | Artifacts are created and assigned; the rollout is in motion. |
| deployed | Deployed | The rollout has reached its devices; verification is tracking results. |
| retired | Retired | The deployment is finished and its artifacts have been cleaned up. |
Auto-halt on repeated failures
If a rollout starts failing, Patch Console stops it before it does damage: a deployment halts automatically when 3 devices fail or 10% of the group fails, whichever comes first. A halted deployment stays halted until you look at why and release it; failures carry the underlying evidence (exit codes, error codes, versions) so the diagnosis starts from facts.
Version gates
Every install is followed by a version gate that reads the actual installed version from the device. An installer that exits 0 while leaving the old version on disk is a failure, not a success. This keeps deployment statistics honest and feeds the verification loop.