Statuses & glossary

Every status vocabulary used across Patch Console, in one place, plus the terms the rest of the documentation leans on.

Deploy states

The lifecycle of a patch group's deployment, from creation to cleanup:

State		Meaning
new	New	Group created; no installer validated yet.
validated	Validated	Installer passed SHA-256 and signature checks.
approved	Approved	Intune artifacts or signed agent scripts created; rollout in motion.
deployed	Deployed	The rollout reached its devices; verification is tracking results.
retired	Retired	Finished; artifacts cleaned up.

The per-group rollup of how the member devices stand against the fix target:

Status		Meaning
Open	Open	Devices remain below the fix target and unaddressed.
Partial	Partial	Some devices are verified at target; others are still pending or failing.
Done	Done	Every member device is verified at or above the fix target (or the product was removed).
Not Deployed	Not Deployed	The group has no active deployment yet.

Status	Set by	Meaning
open	engine	Vulnerable version present, no deployment covering it.
patch_available	engine	A fixed version exists; the finding is actionable.
remediation_scheduled	engine	An approved deployment targets this device and product.
remediation_attempted	engine	The install ran; inventory has not yet proven the fix.
reboot_required	engine	The update landed but needs a restart to take effect.
remediation_failed	engine	The deployment ran and the device is still vulnerable.
resolved	engine	Inventory proved the fixed version, or the software was removed.
mitigated	admin	Addressed by a compensating control; audited.
accepted_risk	admin	Deliberately accepted, on record; audited.
false_positive	admin	The match is wrong for this device; audited.

Band		Reading
A / B	Healthy	Strong severity-weighted coverage, no open caps.
C	Needs attention	Coverage slipping or a cap in effect.
D / F	Critical	Significant unremediated exposure.

Term	Meaning
Patch group	The unit of work: one product, a fix target version, and every device below it.
Fix target	The version at or above which the group's vulnerabilities are fixed; everything measures against it.
Pilot ring	The small set of devices a deployment reaches first, before the rest of the group.
Version gate	The post-install check that reads the real installed version and refuses success if it did not move.
Hybrid group	A patch group containing both Intune-managed and agent-only devices; each device uses its own channel.
Self-servicing product	A product only its own vendor updater can update (Defender platform, Microsoft 365 Apps). See Self-servicing products.
Auto-halt	The safety rail that stops a deployment after 3 device failures or 10% of the group failing.
Four-eyes approval	The second-administrator sign-off required for agent-channel deployments above 25 devices.
KEV	CISA's Known Exploited Vulnerabilities catalog; open KEV findings cap the Remediation Grade.
EPSS	Exploit Prediction Scoring System, the probability a CVE will be exploited in the wild.
OSV	The open-source vulnerability feed used for npm, PyPI, and NuGet developer packages.
EOL	End-of-life software that will never receive a patch; its presence caps the Remediation Grade.