Patch Console overview
Patch Console turns vulnerability scans into patches that ship. It ingests your scanner reports, matches them against what is actually installed on every Windows device, groups the results into per-product patch jobs, and deploys the fixes through Intune or its own lightweight agent, then verifies each fix against real inventory.
Why Patch Console exists
A scanner report tells you what is vulnerable; it does not patch anything. The gap between "the scanner flagged Chrome on 42 devices" and "Chrome is updated on all 42 devices, provably" is usually spreadsheets, hand-built Intune apps, and hope. Patch Console closes that gap in one place: a vulnerability becomes a patch group, the patch group becomes a deployment, and the deployment is only called done when a later inventory proves the fixed version is on disk.
The pieces
| Component | What it does |
|---|---|
| Admin console | The web app: vulnerabilities, patch groups, devices, deployments, reports, and a full audit trail on every mutating action. |
| Vulnerability engine | A daily scan that matches installed software and OS patch level against CVE feeds (NVD/CVE5, CISA KEV, EPSS, OSV, browser-extension IOCs, Windows KB/MSRC). See Vulnerability engine. |
| Intune integration | Syncs managed devices and users from Microsoft Graph and deploys patches as winget installs, Win32 apps, or remediation scripts. |
| Inventory agent | A lightweight PowerShell agent (MSI-installed, scheduled-task based) that reports installed software the moment it changes, and runs signed deployments on devices Intune cannot reach. See Agent install & enrollment. |
| Reports | A weekly Patch Report with a Remediation Grade, SLA tracking, and a per-week time machine. See Patch Report & Remediation Grade. |
From scan to verified fix
- Import a weekly scanner report, or let the built-in daily engine raise findings straight from inventory.
- Findings are normalized into patch groups: one per product, each with a fix target version and the devices below it.
- You pilot to a test ring, validate the installer (SHA-256, signature), and approve. Patch Console creates the Intune artifacts or signed agent scripts.
- The deployment expands to the rest of the group. A version gate checks the real installed version after each install, not the installer's exit code.
- The finding resolves only when a later inventory proves the version healed or the software was removed.
Two delivery channels, one rule
Devices managed by Intune always deploy through Intune. Devices outside Intune deploy through the Patch Console agent. A single patch group can contain both kinds (a hybrid group), and each device gets the right channel automatically; an Intune-managed device is never switched to the agent channel. How deployment works covers the mechanics.