Windows Autopatch, How it Works | Automate updates to Windows PCs and devices

[@DeployJeremy]

Was fun going inside how the Windows Autopatch service automates the creation of AAD groups and policies to configure ring based deployment of Windows quality and feature updates. Let us know what you think. It's a major time saver.

[@MSFTMechanics]

Stay tuned. There are more updates coming.

[@ngabrunhosa]

This is really great but please can we have a third party software patching as well.

[@russwilson5314]

Great Windows Autopatch overview Jeremy. Excited to be working on this important service allowing IT Teams to free up time with Microsoft taking care of patch rollout.

[@MSFTMechanics]

Thanks Russ!

[@johnvintzel2641]

Great job showing off all the cool things my team is building!

[@Peccavi75]

I see drivers update in your screens... when will the rest of us see it released?

[@hsarvesh]

Really nice to see Windows Autopatch..

[@ChrisTulip]

Really cool to see the stuff I've worked on on Microsoft Mechanics! Love how Jeremy breaks it all down

[@MSFTMechanics]

Thanks Chris!

[@mediabeyondajr]

There are more quick-hit videos of Autopatch on the Windows IT Pro channel too.

[@DeployJeremy]

Great channel recommendation. There are quite a few over there as well. This also came up in my last Windows in the Cloud show for Windows 365. Autopatch is part of the provisioning policy definition: kzbin.info/www/bejne/eIazdZWXaq2Vick.

[@memoragab5087]

This was just awesome! Thanks a lot!

[@MSFTMechanics]

Thank you, Memo!

[@francescoferrise]

Very powerful service, but this Warning let us a little bit confused: "Adding or importing devices into any of these groups directly is not supported and doing so might cause an unexpected impact on the Windows Autopatch service." But, can we create other AzureAD groups with dynamic device assignment and assign those groups to Windows Autopatch rings? Or is possible to change the assignment of these groups (Modern Workplace Devices-Windows Autopatch-XXX) from static to dynamic?

[@ChrisTulip]

The autopatch service goes through and intelligently distributes devices between the rings so it is not supported for customers to nest AAD Groups into the rings. Instead, groups can be nested into the enrollment group and then if you have some that you need to make sure are in Broad ring then they can be moved using the Devices blade.

[@bbowling619]

Have drivers been an issue with Auto Patch? I know this vid is a year old so I am just checking to see if anyone is still having issues with drivers specifically? I haven't played around with this in a little while.

[@adampembs1397]

We are enrolled in the UK government "Cyber Essentials" program. Part of this demands security patches are updated within 7 days. Can the Autopatch feature achieve this in a reliable manner?

[@moepskie]

Looks good. I've been an Intune user for sometime, but I'm a bit confused about the statement made between 2:00 and 2:10 which says: "It can also automatically take necessary actions like pausing or rolling back quality updates if issues are detected". How does this process get automated exactly? As far as I've experienced until now (so Intune without Autopatch), I always had to do this manually. Really curious about how that works!

[@mjay1304]

Well I guess this has something to do when Patch Tuesday comes in play. Broad feedback from the community helps Microsoft stopping those services. I don't know whether a real person stops all the patching for every tenant or it is an automatic process.

[@ChrisTulip]

Great Question! Autopatch gives customers the ability to easily pause / resume QUs across rings from our UI but the service also monitors a lot of signals: Consumer incidents, BSODs on version 1 vs version 2, the security risk profile, and several others. Based on those signals there are Microsoft engineers behind the scenes who are evaluating if it makes sense to broadly pause or expedite specific releases for our customers. To learn more, check out our documentation: learn.microsoft.com/en-us/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-signals

[@bw_merlin]

If you don't use Intune as your MDM is this available for other MDM options?

[@MSFTMechanics]

This service is deeply tied with Intune and Azure AD as the management platform.

[@SanjaySalmansd]

thank you so much sir for valuable info with details patch management

[@ashish0kiit]

if I have to blacklist a patch and allow others for a particular month, can I do that?

[@Necsissy]

Does this tool support Forced restarts or allow metrics to track actions?

[@MSFTMechanics]

Yes, as demonstrated in the update policy settings, restart is set to mandatory after the grace period to ensure cumulative updates apply fully.

[@user-it4pg5ox1q]

Amazing 🤩

[@MSFTMechanics]

Thanks 🤗

[@NbaSeizer]

says heard...*

[@skynetintex5878]

First :)

[@MSFTMechanics]

Yes you are!

[@skynetintex5878]

@@MSFTMechanics Cheers! Keep up the great videos!

[@MSFTMechanics]

@@skynetintex5878 Thank you!

[@mburland]

Imagine if Windows came with a built in service that could automatically patch (update) Windows and Microsoft apps...

[@MSFTMechanics]

I know, right? When you see the actual mechanics of it at enterprise level scale, the AAD groups and policies created, plus the proactive monitoring with pause/roll back, it's quite different from the Microsoft Update or Windows Update for Business services.

[@scottluebke5012]

Maybe I'm missing something, but unless updates are disabled, Windows has always automatically patched itself. Now, sure, that doesn't give you organization level control of your patching, but it's not like computers are just staying on super old OS builds.

[@mburland]

@@MSFTMechanics my point was: "why should it have to be different?" Surely this should just come as standard?

[@markc6714]

Always a cost for basic features with Microsoft. The fact is, the only need for patches is because Microsoft screwed up the software on the first place, and patches are needed to secure the broken systems. For this, Microsoft expect us to pay........

[@sundiatabradshaw6189]

Have you ever heard of a business model known as Software as a Service (SaaS)? Don't blame Microsoft for taking advantage of the opportunity to make as much $$$ as possible w/o being accused of having a monopoly. It sucked when Adobe went to this bs but WTH are you going to do?