Skip to main content

Deploying and Managing Windows Autopatch

This guide provides a comprehensive procedure for enrolling in and managing Windows Autopatch. This Microsoft-managed service automates the entire update process, from policy creation and device assignment to monitoring and remediation. By offloading the operational burden of patching to Microsoft, IT administrators can significantly reduce overhead while ensuring devices remain secure and up-to-date.

TL;DR
  • It's a Managed Service: Windows Autopatch is not just a set of policies; it is a service where Microsoft engineers actively manage the update rollout, monitor for issues, and can pause or roll back deployments on your behalf.
  • Comprehensive Automation: Autopatch handles the complete lifecycle for Windows Quality and Feature updates, drivers, Microsoft 365 Apps, Microsoft Edge, and Microsoft Teams.
  • The Client Broker is Key: Autopatch uses on-device intelligence to check for and remediate common issues that block updates, making the service far more resilient than standard policy management.
  • Autopatch Groups are Your Control Plane: You manage the service by creating "Autopatch groups." These groups contain pre-configured deployment rings that you assign devices to, allowing you to tailor update cadences for different device populations.

Background and Scope​

While Windows Update for Business (WUfB) provides the tools to build a robust, ring-based deployment strategy, it still requires administrators to create, manage, and monitor the policies themselves. Windows Autopatch takes this a step further. It is a cloud service included with Windows Enterprise A3+ licenses that builds on top of WUfB and other Intune capabilities.

When you enroll your tenant and register devices, Autopatch automatically creates all the necessary update policies and intelligently assigns devices to a set of four deployment rings (Test, First, Fast, Broad). The service then manages the progressive rollout of updates across these rings according to service-level objectives, leveraging Microsoft's large-scale telemetry to detect issues and respond accordingly.

This guide covers the one-time tenant enrollment process, the creation and configuration of Autopatch groups, and the ongoing management of the service.

Guiding Philosophy: Trust the Service​

The core principle of Windows Autopatch is to move from manual, granular control to a state of trust and verification. Instead of spending time building and tweaking dozens of update policies, the administrator's role shifts to:

  1. Defining the business needs (e.g., this group of devices is for information workers, this group is for shared kiosks).
  2. Assigning devices to the appropriate Autopatch group.
  3. Monitoring the service's health and reporting.

By entrusting the operational details to Microsoft, you free up valuable time to focus on strategic initiatives, while benefiting from the expertise and automation of the service.

Prerequisites​

RequirementMin VersionNotes
LicensingWindows Enterprise A3+This is the primary requirement. Autopatch is a benefit of the premium license.
IdentityMicrosoft Entra IDDevices must be Entra ID Joined or Hybrid Joined.
ManagementMicrosoft IntuneAutopatch is built on and requires Intune for device and policy management.
Network-Devices must be able to reach Microsoft Update and Autopatch service endpoints.

Step 1 – One-Time Tenant Enrollment​

Before you can use Autopatch, you must enroll your tenant. This is a one-time setup that prepares your environment.

Enrolling Your Tenant in Windows Autopatch
  1. In the Microsoft Intune admin center, navigate to Tenant admin > Windows Autopatch.
  2. Select the Tenant enrollment blade.
  3. The service will run a Readiness assessment to check your tenant against key prerequisites, such as licensing, Intune configuration, and user roles. It will provide details on any items that need to be addressed.
  4. Once all checks are passed, you can consent to enroll your tenant. This process grants the Autopatch service the necessary permissions to manage update policies on your behalf and creates several Entra ID groups required for its operation, including:
    • Windows Autopatch Device Registration: The primary group used to register devices with the service.
    • Groups for each deployment ring (Test, First, Fast, Broad).

Step 2 – Creating and Configuring an Autopatch Group​

Once the tenant is enrolled, you manage the service through Autopatch groups. You can use the "Default group" that is automatically created or create custom groups to segment your devices (e.g., for different business units or device types).

Walking Through the "Add Autopatch group" Wizard

Navigate to Tenant admin > Windows Autopatch > Groups and click Add Autopatch group.

  1. Basics: Provide a clear name (e.g., "TAMU Information Workers") and description for the group.

  2. Deployment rings: This is where you structure the rollout.

    • Autopatch creates a set of rings. The Test and Last rings require you to assign specific, known devices via an "Assigned deployment ring group." This ensures predictable testing and final validation.
    • The middle rings (First, Fast, Broad) can be populated using Dynamic deployment ring groups, which automatically add devices based on attributes. You can also manually assign devices if preferred.

  3. Update types: Select which updates Autopatch will manage. It is highly recommended to keep all types selected to get the full benefit of the service.

    • Quality updates
    • Feature updates
    • Driver updates
    • Microsoft 365 apps updates
    • Microsoft Edge updates

  4. Deployment settings: Configure the high-level behavior for each update type.

    • Feature updates: Set the Target version (e.g., Windows 11, version 25H2). Devices below this version will be targeted for an upgrade.
    • Driver updates: Set the Approval method. "Automatically approve all recommended drivers" is the default. You can choose to have different methods for each ring if needed.

  5. Release schedules: This is the most powerful configuration step. Instead of manually setting dozens of deferral, deadline, and notification settings, you can select a Release schedule preset.

    • Select a preset: Choose the preset that best matches your device population. The available options include:
      • Information worker: The default, balanced for typical user devices.
      • Shared device: More aggressive reboot schedules outside of business hours.
      • Kiosks and billboards: Even more aggressive policies for non-interactive devices.
      • Reboot-sensitive devices: Very gentle policies for critical devices like lab equipment.
    • Customize if needed: After selecting a preset, all the deferral, deadline, and grace period values are automatically populated with Microsoft's best practices. You can then edit individual settings if you have a specific business need.

  6. Scope tags: Apply Intune scope tags if you use them for role-based access control.

  7. Review + create: Confirm your settings and create the Autopatch group.

Understanding the Autopatch Client Broker: The On-Device Intelligence​

Windows Autopatch is more than just a set of cloud-based policies; its reliability is enhanced by a suite of client-side components collectively known as the Autopatch Client Broker. When a device is registered with the service, these components are deployed via Intune to provide on-device intelligence.

The Client Broker's primary responsibilities are:

  • Health Checks and Readiness: The broker constantly verifies that the device is in a healthy state to receive updates. It checks critical components like the Windows Update service, BITS (Background Intelligent Transfer Service), and network connectivity to ensure the device is ready before an update is attempted.
  • Automatic Remediation: This is the most significant function. If the broker detects an issue, it can automatically remediate it. For example, if the Windows Update service is stuck or disabled, the broker can restart it or reset its components. This is a crucial difference from standard GPO or Intune policies, which can only apply settings but cannot fix an underlying broken service.
  • Policy Coordination: The broker ensures that the complex sequence of deferrals, deadlines, active hours, and notifications is correctly orchestrated on the client, providing a smooth and predictable user experience.

Why it matters: The Client Broker makes the update process incredibly resilient. It proactively fixes the most common reasons for update failures, which dramatically increases update compliance rates and reduces the number of support tickets related to devices "not updating." This on-device automation is what truly elevates Autopatch to a managed service.

Step 3 – Device Registration and Ongoing Management​

Once a group is created, the final step is to add devices.

  1. Register Devices: To add devices to the service, simply add them to the Windows Autopatch Device Registration Entra ID group. The Autopatch service will detect the new devices, run readiness checks, and mark them as "Ready."
  2. Assign to a Group: Once a device is ready, add it to one of the Entra ID groups you associated with a deployment ring in your Autopatch group (e.g., the group for your "Broad" ring).
  3. Monitoring: The service takes over from here. You can monitor the status of releases, device health, and trends from the Windows Autopatch section in the Intune admin center. The service provides detailed reports and alerts if any issues are detected during a rollout.

Reference & FAQs​

Glossary​

  • Windows Autopatch: A Microsoft-managed cloud service that automates the update process for Windows, Microsoft 365, Edge, and Teams.
  • Autopatch Group: A logical grouping of devices in the Autopatch service, which contains its own set of deployment rings and release schedules.
  • Release Schedule Preset: A pre-configured set of best-practice settings for deferrals, deadlines, and notifications tailored to a specific device persona (e.g., Information Worker, Kiosk).
  • Client Broker: A suite of client-side components (scripts, scheduled tasks, and remediation policies) that ensures a device is healthy, configured correctly, and can automatically remediate common issues preventing successful updates.

FAQs​

Q: Does Windows Autopatch replace the WUfB rings I built manually? A: Yes. For any devices you enroll in Autopatch, you should remove them from your manually configured WUfB policies to avoid conflicts. Autopatch will create and manage its own set of more granular policies for those devices.

Q: What happens if a bad update is released? A: This is the primary value of the service. Microsoft's service operations team constantly monitors update health using large-scale data. If a known issue is detected that affects your devices, the service will automatically pause or roll back the deployment for the affected rings, often before you are even aware of the problem.

Q: Can I still expedite a security update if needed? A: Yes. The Autopatch service automatically handles expedited quality updates when necessary based on the threat landscape.

This guide was collaboratively developed by a human subject matter expert and an AI assistant to ensure it is both comprehensive and easy to understand.