How to Create Patch Rings in JumpCloud for Controlled OS Updates?

Overview

JumpCloud can automate OS updates (Windows Quality Updates, macOS Minor/Major versions) to ensure compliance without interrupting users during critical work.

Step 1: Define Your Patch Rings

Do not push updates to everyone at once. Create Policy Groups for:

• Ring 1 (IT/Test): Updates immediately (0 Days Deferral).

• Ring 2 (General Staff): Updates after 7 Days.

• Ring 3 (Critical/Execs): Updates after 14 Days.

Step 2: Configure the Policy (Windows Example)

1. Go to Device Management > Policy Management.

2. Select Patch Management tab.

3. Click (+) > Windows.

4. Configure Settings:

   • Deferral Days: 7 (Wait 7 days after Microsoft releases the patch).

   • Grace Period: 3 (Once the 7 days are up, the user has 3 days to install it before forced reboot).

   • Active Hours: Start 8:00 AM - End 6:00 PM (Prevent reboots during these times).

5. Assignments: Bind to your "Ring 2" Device Group.

Step 3: macOS Specifics (Nudge vs Force)

For macOS, JumpCloud uses MDM commands.

• Minor Updates: Can be installed silently in the background.

• Major Upgrades (e.g., Ventura to Sonoma): require user interaction. JumpCloud will prompt the user to run the installer.

  • Tip: Use the "Major Version Upgrade" policy to block the installer until your organization is ready (e.g., "Delay Major Updates for 90 Days").

FAQ

1) What are patch rings in JumpCloud?

Patch rings are device groups with different update deferral policies, allowing staged OS update rollouts to test, staff, and executive devices safely.

2) How do I prevent forced reboots during working hours?

Use the Active Hours and Grace Period settings in JumpCloud Patch Management to block reboots during business hours.

3) Can JumpCloud silently install macOS updates?

Yes. Minor macOS updates install silently via MDM, but major OS upgrades require user interaction to complete.

4) How many days should I defer Windows updates?

A common practice is 7 days for general staff and 14 days for critical users to avoid issues from newly released patches.

5) Can I block major macOS upgrades like Ventura to Sonoma?

Yes. Use the Major Version Upgrade policy in JumpCloud to delay or block macOS upgrades for up to 90 days.