Approve updates

Every update or application update seen on a customer's devices has an effective decision: approved by policy, approved by someone, deferred until a date, declined, or waiting for approval. Only approved updates are ever installed.

Find what needs a decision

Open Patching → Updates (portfolio or customer). Filter by kind, classification, severity or decision; Needs approval is the queue. Each update shows its decision and why, for example:

• Auto-approved by policy Standard on Oct 16 (security update, 2 days after release)
• Needs approval: policy Standard doesn't auto-approve driver updates

Decisions

Select updates and choose:

For one customer or everyone

• In a customer, choose whether the decision is for that customer only or all customers (unless they have their own decision).
• In the portfolio, decisions apply to all customers.

The most specific decision wins: a customer's own decision, then a workspace decision, then the policy rule.

Known-exploited fast track

Updates that fix a vulnerability on CISA's Known Exploited Vulnerabilities list are tagged Actively exploited. With the policy's fast track on (the default), they skip the policy's waiting days and ring delays: an auto-approved KEV fix installs in each device's next window. A KEV fix that your policy doesn't auto-approve still needs approval. See KEV and EPSS.

Choosing updates yourself counts as approving

When you select specific updates for Install now, that counts as approving them for those devices, under your name. See Install, scan and restart now.

Good practice

• Decline only what you're sure you never want; prefer Defer for "not yet".
• Declined and unapproved updates appear in the Path to 100% patching report as reasons a device isn't compliant, so decisions stay visible to the customer conversation.
• Every decision is audited with who made it and when.