The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
This group is the first set of devices to send data to Windows Autopatch and are used to generate a health signal across all end-users. For example, Windows Autopatch can generate a statistically significant signal saying that critical errors are trending up in a specific release for all end-users, but can't be confident that it's doing so in your organization.
Since Windows Autopatch doesn't yet have sufficient data to inform a release decision, devices in this deployment ring might experience outages if there are scenarios that weren't covered during early testing in the Test ring.|
+| Fast | **9%** | The Fast ring is the second group of production users to receive changes. The signals from the First ring are considered as a part of the release process to the Broad ring.
The goal with this deployment ring is to cross the **500**-device threshold needed to generate statistically significant analysis at the tenant level. These extra devices allow Windows Autopatch to consider the effect of a release on the rest of your devices and evaluate if a targeted action for your tenant is needed.
|
+| Broad | Either **80%** or **90%** | The Broad ring is the last group of users to receive software update deployments. Since it contains most of the devices registered with Windows Autopatch, it favors stability over speed in a software update deployment.|
+| Last | **zero** | The Last ring is intended to be used for either specialized devices or devices that belong to VIP/executives in an organization. Windows Autopatch doesn't automatically add devices to this deployment ring. |
+
+## Software update-based to service-based deployment ring mapping
+
+There’s a one-to-one mapping in between the service-based and software updates-based deployment rings introduced with Autopatch groups. This mapping is intended to help move devices in between deployment rings for other software update workloads that don’t yet support Autopatch groups such as Microsoft 365 Apps and Microsoft Edge.
+
+| If moving a device to | The device also moves to |
+| ----- | ----- |
+| Windows Autopatch – Test | Modern Workplace Devices-Windows Autopatch-Test |
+| Windows Autopatch – Ring1 | Modern Workplace Devices-Windows Autopatch-First |
+| Windows Autopatch – Ring2 | Modern Workplace Devices-Windows Autopatch-Fast |
+| Windows Autopatch – Ring3 | Modern Workplace Devices-Windows Autopatch-Broad |
+| Windows Autopatch – Last | Modern Workplace Devices-Windows Autopatch-Broad |
+
+If your Autopatch groups have more than five deployment rings, and you must move devices to deployment rings after Ring3. For example, ``. The devices will be moved to **Modern Workplace Devices-Windows Autopatch-Broad**.
+
+## Moving devices in between deployment rings
+
+If you want to move devices to different deployment rings (either service or software update-based), after Windows Autopatch's deployment ring assignment, you can repeat the following steps for one or more devices from the **Registered** tab.
+
+**To move devices in between deployment rings:**
+
+> [!NOTE]
+> You can only move devices to other deployment rings when they're in an active state in the **Registered** tab.
+
+1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** in the left pane.
+1. In the **Windows Autopatch** section, select **Devices**.
+1. In the **Registered** tab, select one or more devices you want to assign. All selected devices will be assigned to the deployment ring you specify.
+1. Select **Device actions** from the menu.
+1. Select **Assign device group**. A fly-in opens.
+1. Use the dropdown menu to select the deployment ring to move devices to, and then select Save. The Ring assigned by column will change to Pending.
+1. When the assignment is complete, the **Ring assigned by** column changes to Admin (which indicates that you made the change) and the **Ring** column shows the new deployment ring assignment.
+
+If you don't see the Ring assigned by column change to **Pending** in Step 5, check to see whether the device exists in Microsoft Intune or not by searching for it in its device blade. For more information, see [Device details in Intune](/mem/intune/remote-actions/device-inventory).
+
+> [!WARNING]
+> Moving devices between deployment rings through directly changing Azure AD group membership isn't supported and may cause unintended configuration conflicts within the Windows Autopatch service. To avoid service interruption to devices, use the **Assign device to ring** action described previously to move devices between deployment rings.
+
+## Automated deployment ring remediation functions
+
+Windows Autopatch monitors device membership in its deployment rings, except for the **Modern Workplace Devices-Windows Autopatch-Test**, **Windows Autopatch – Test** and **Windows Autopatch – Last** rings, to provide automated deployment ring remediation functions to mitigate the risk of not having its managed devices being part of one of its deployment rings. These automated functions help mitigate risk of potentially having devices in a vulnerable state, and exposed to security threats in case they're not receiving update deployments due to either:
+
+- Changes performed by the IT admin on objects created by the Windows Autopatch tenant enrollment process, or
+- An issue occurred which prevented devices from getting a deployment ring assigned during the device registration process.
+
+There are two automated deployment ring remediation functions:
+
+| Function | Description |
+| ----- | ----- |
+| Check device deployment ring membership | Every hour, Windows Autopatch checks to see if any of its managed devices aren't part of one of the deployment rings. If a device isn't part of a deployment ring, Windows Autopatch randomly assigns the device to one of its deployment rings (except for the **Modern Workplace Devices-Windows Autopatch-Test**, **Windows Autopatch – Test and Windows Autopatch – Last** rings). |
+| Multi-deployment ring device remediator | Every hour, Windows Autopatch checks to see if any of its managed devices are part of multiple deployment rings (except for the **Modern Workplace Devices-Windows Autopatch-Test**, **Windows Autopatch – Test** and **Windows Autopatch – Last** rings). If a device is part of multiple deployment rings, Windows Autopatch randomly removes the device until the device is only part of one deployment ring. |
+
+> [!IMPORTANT]
+> Windows Autopatch automated deployment ring functions don’t assign or remove devices to or from the following deployment rings:**Modern Workplace Devices-Windows Autopatch-Test****Windows Autopatch – Test****Windows Autopatch – Last**
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md
new file mode 100644
index 0000000000..85e9177b85
--- /dev/null
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md
@@ -0,0 +1,160 @@
+---
+title: Manage Windows Autopatch groups
+description: This article explains how to manage Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Manage Windows Autopatch groups (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Autopatch groups help Microsoft Cloud-Managed services meet organizations where they are in their update management journey.
+
+Autopatch groups is a logical container or unit that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates policy for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates).
+
+## Autopatch groups prerequisites
+
+Before you start managing Autopatch groups, ensure you’ve met the following prerequisites:
+
+- Review [Windows Autopatch groups overview documentation](../deploy/windows-autopatch-groups-overview.md) to understand [key benefits](../deploy/windows-autopatch-groups-overview.md#key-benefits), [concepts](../deploy/windows-autopatch-groups-overview.md#key-concepts) and [common ways to use Autopatch groups](../deploy/windows-autopatch-groups-overview.md#common-ways-to-use-autopatch-groups) within your organization.
+- Ensure the following Azure AD assigned groups are in your tenant before using Autopatch groups. **Don’t** modify the Azure AD group membership types (Assigned or Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups and causes the Autopatch groups feature and other service-related operations to not work properly.
+ - Modern Workplace Devices-Windows Autopatch-Test
+ - Modern Workplace Devices-Windows Autopatch-First
+ - Modern Workplace Devices-Windows Autopatch-Fast
+ - Modern Workplace Devices-Windows Autopatch-Broad
+ - Windows Autopatch – Test
+ - Windows Autopatch – Ring1
+ - Windows Autopatch – Ring2
+ - Windows Autopatch – Ring3
+ - Windows Autopatch – Last
+- Additionally, **don't** modify the Azure AD group ownership of any of the groups above otherwise, Autopatch groups device registration process won't be able to add devices into these groups.
+ - For more information, see [assign an owner of member of a group in Azure AD](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group) on how to remediate Azure Azure AD group ownership.
+- Make sure you have [app-only auth turned on in your Windows Autopatch tenant](../operate/windows-autopatch-maintain-environment.md#windows-autopatch-tenant-actions). Otherwise, the Autopatch groups functionality won’t work properly. Autopatch uses app-only auth to:
+ - Read device attributes to successfully register devices.
+ - Manage all configurations related to the operation of the service.
+- Make sure that all device-based Azure AD groups you intend to use with Autopatch groups are created prior to using the feature.
+ - Review your existing Azure AD group dynamic queries and direct device memberships to avoid having device membership overlaps in between device-based Azure AD groups that are going to be used with Autopatch groups. This can help prevent device conflicts within an Autopatch group or across several Autopatch groups. **Autopatch groups doesn't support user-based Azure AD groups**.
+- Ensure devices used with your existing Azure AD groups meet [device registration prerequisite checks](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) when being registered with the service. Autopatch groups register devices on your behalf, and devices can be moved to **Registered** or **Not registered** tabs in the Devices blade accordingly.
+
+> [!NOTE]
+> During the public preview, Autopatch groups opt-in page will show a banner to let you know when one or more prerequisites are failing. Once you remediate the issue to meet the prerequisites, it can take up to an hour for your tenant to have the "Use preview" button available.
+
+## Create a Custom Autopatch group
+
+> [!NOTE]
+> The Default Autopatch group is recommended for organizations that can meet their business needs using the pre-configured five deployment ring composition.
+
+**To create a Custom Autopatch group:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release management** blade, select **Autopatch groups (preview)**.
+1. Only during the public preview:
+ 1. Review the [Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md) and the [Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md).
+ 1. Select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Autopatch groups. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+1. In the **Autopatch groups** blade, select **Create**.
+1. In **Basics** page, enter a **name** and a **description** then select **Next: Deployment rings**.
+ 1. Enter up to 64 characters for the Autopatch group name and 150 characters maximum for the description. The Autopatch group name is appended to both the update rings and the DSS policy names that get created once the Custom Autopatch group is created.
+1. In **Deployment rings** page, select **Add deployment ring** to add the number of deployment rings to the Custom Autopatch group.
+1. Each new deployment ring added must have either an Azure AD device group assigned to it, or an Azure AD group that is dynamically distributed across your deployments rings using defined percentages.
+ 1. In the **Dynamic groups** area, select **Add groups** to select one or more existing device-based Azure AD groups to be used for Dynamic group distribution.
+ 1. In the **Dynamic group distribution** column, select the desired deployment ring checkbox. Then, either:
+ 1. Enter the percentage of devices that should be added from the Azure AD groups selected in step 9. The percentage calculation for devices must equal to 100%, or
+ 1. Select **Apply default dynamic group distribution** to use the default values.
+1. In the **Assigned group** column, select **Add group to ring** to add an existing Azure AD group to any of the defined deployment rings. The **Test** and **Last** deployment rings only support Assigned group distribution. These deployment rings don't support Dynamic distribution.
+1. Select **Next: Windows Update settings**.
+1. Select the **horizontal ellipses (…)** > **Manage deployment cadence** to [customize your gradual rollout of Windows quality and feature updates](../operate/windows-autopatch-windows-update.md). Select **Save**.
+1. Select the **horizontal ellipses (…)** > **Manage notifications** to customize the end-user experience when receiving Windows updates. Select **Save**.
+1. Select **Review + create** to review all changes made.
+1. Once the review is done, select **Create** to save your custom Autopatch group.
+
+> [!CAUTION]
+> A device-based Azure AD group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Azure AD group that’s been already used, you'll receive an error that prevents you from finish creating or editing the Autopatch group (Default or Custom).
+
+> [!IMPORTANT]
+> Windows Autopatch creates the device-based Azure AD assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience.
+
+## Edit the Default or a Custom Autopatch group
+
+**To edit either the Default or a Custom Autopatch group:**
+
+1. Select the **horizontal ellipses (…)** > **Edit** for the Autopatch group you want to edit.
+1. You can only modify the **description** of the Default or a Custom Autopatch group. You **can’t** modify the name. Once the description is modified, select **Next: Deployment rings**.
+1. Make the necessary changes in the **Deployment rings** page, then select **Next: Windows Update settings**.
+1. Make the necessary changes in the **Windows Update settings** page, then select **Next: Review + save**.
+1. Select **Review + create** to review all changes made.
+1. Once the review is done, select **Save** to finish editing the Autopatch group.
+
+> [!IMPORTANT]
+> Windows Autopatch creates the device-based Azure AD assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience.
+
+## Delete a Custom Autopatch group
+
+You **can’t** delete the Default Autopatch group. However, you can delete a Custom Autopatch group.
+
+**To delete a Custom Autopatch group:**
+
+1. Select the **horizontal ellipses (…)** > **Delete** for the Custom Autopatch group you want to delete.
+1. Select **Yes** to confirm you want to delete the Custom Autopatch group.
+
+> [!CAUTION]
+> You can’t delete a Custom Autopatch group when it’s being used as part of one or more active or paused feature update releases. However, you can delete a Custom Autopatch group when the release for either Windows quality or feature updates have either the **Scheduled** or **Paused** statuses.
+
+## Manage device conflict scenarios when Autopatch groups
+
+Overlap in device membership is a common scenario when working with device-based Azure AD groups since sometimes dynamic queries can be large in scope or the same assigned device membership can be used across different Azure AD groups.
+
+Since Autopatch groups allow you to use your existing Azure AD groups to create your own deployment ring composition, the service takes on the responsibility of monitoring and automatically solving some of the device conflict scenarios that may occur.
+
+> [!CAUTION]
+> A device-based Azure AD group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Azure AD group that’s been already used, you'll receive an error that prevents you from creating or editing the Autopatch group (Default or Custom).
+
+### Device conflict in deployment rings within an Autopatch group
+
+Autopatch groups uses the following logic to solve device conflicts on your behalf within an Autopatch group:
+
+| Step | Description |
+| ----- | ----- |
+| Step 1: Checks for the deployment ring distribution type (**Assigned** or **Dynamic**) that the device belongs to. | For example, if a device is part of one deployment ring with **Dynamic** distribution (Ring3), and one deployment ring with **Assigned** distribution (Test,) within the same Autopatch group, the deployment ring with **Assigned** distribution (Test) takes precedence over the one with the **Dynamic** distribution type (Ring3). |
+| Step 2: Checks for deployment ring ordering when device belongs to one or more deployment ring with the same distribution type (**Assigned** or **Dynamic**) | For example, if a device is part of one deployment ring with **Assigned** distribution (Test), and in another deployment ring with **Assigned** distribution (Ring3) within the **same** Autopatch group, the deployment ring that comes later (Ring3) takes precedence over the deployment ring that comes earlier (Test) in the deployment ring order. |
+
+> [!IMPORTANT]
+> When a device belongs to a deployment ring that has combined distribution types (**Assigned** and **Dynamic**), and a deployment ring that has only the **Dynamic** distribution type, the deployment ring with the combined distribution types takes precedence over the one with only the **Dynamic** distribution. If a device belongs to two deployment rings that have combined distribution types (**Assigned** and **Dynamic**), the deployment ring that comes later takes precedence over the deployment ring that comes earlier in the deployment ring order.
+
+### Device conflict across different Autopatch groups
+
+Device conflict across different deployment rings in different Autopatch groups may occur, review the following examples about how the Windows Autopatch services handles the following scenarios:
+
+#### Default to Custom Autopatch group device conflict
+
+| Conflict scenario | Conflict resolution |
+| ----- | ----- |
+| You, the IT admin at Contoso Ltd., starts using only the Default Autopatch group, but later decides to create an Autopatch group called “Marketing”.However, you notice that the same devices that belong to the deployment rings in the Default Autopatch group are now also part of the new deployment rings in the Marketing Autopatch group.
| Autopatch groups automatically resolve this conflict on your behalf.In this example, devices that belong to the deployment rings as part of the “Marketing” Autopatch group take precedence over devices that belong to the deployment ring in the Default Autopatch group, because you, the IT admin, demonstrated clear intent on managing deployment rings using a Custom Autopatch group outside the Default Autopatch group.
|
+
+#### Custom to Custom Autopatch group device conflict
+
+| Conflict scenario | Conflict resolution |
+| ----- | ----- |
+| You, the IT admin at Contoso Ltd., are using several Custom Autopatch groups. While navigating through devices in the Windows Autopatch Devices blade (**Not ready** tab), you notice that the same device is part of different deployment rings across several different Custom Autopatch groups. | You must resolve this conflict.Autopatch groups informs you about the device conflict in the **Devices** > **Not ready** tab. You’re required to manually indicate which of the existing Custom Autopatch groups the device should exclusively belong to.
|
+
+#### Device conflict prior device registration
+
+When you create or edit the Custom or Default Autopatch group, Windows Autopatch checks if the devices that are part of the Azure AD groups, used in Autopatch groups’ deployment rings, are registered with the service.
+
+| Conflict scenario | Conflict resolution |
+| ----- | ----- |
+| Devices are in the Custom-to-Custom Autopatch group device conflict scenario | You must resolve this conflict.Devices will fail to register with the service and will be sent to the **Not registered** tab. You’re required to make sure the Azure AD groups that are used with the Custom Autopatch groups don’t have device membership overlaps.
|
+
+#### Device conflict post device registration
+
+Autopatch groups will keep monitoring for all device conflict scenarios listed in the [Manage device conflict scenarios when using Autopatch groups](#manage-device-conflict-scenarios-when-autopatch-groups) section even after devices were successfully registered with the service.
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md
new file mode 100644
index 0000000000..b87fdbe930
--- /dev/null
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md
@@ -0,0 +1,250 @@
+---
+title: Windows Autopatch groups overview
+description: This article explains what Autopatch groups are
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Windows Autopatch groups overview (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+As organizations move to a managed-service model where Microsoft manages update processes on their behalf, they’re challenged with having the right representation of their organizational structures followed by their own deployment cadence. Windows Autopatch groups helps organizations manage updates in a way that makes sense for their businesses with no extra cost or unplanned disruptions.
+
+## What are Windows Autopatch groups?
+
+Autopatch groups is a logical container or unit that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates).
+
+## Key benefits
+
+Autopatch groups help Microsoft Cloud-Managed services meet organizations where they are in their update management journey. Key benefits include:
+
+| Benefit | Description |
+| ----- | ----- |
+| Replicating your organizational structure | You can set up Autopatch groups to replicate your organizational structures represented by your existing device-based Azure AD group targeting logic. |
+| Having a flexible number of deployments | Autopatch groups give you the flexibility of having the right number of deployment rings that work within your organization. You can set up to 15 deployment rings per Autopatch group. |
+| Deciding which device(s) belong to deployment rings | Along with using your existing device-based Azure AD groups and choosing the number of deployment rings, you can also decide which devices belong to deployment rings during the device registration process when setting up Autopatch groups. |
+| Choosing the deployment cadence | You choose the right software update deployment cadence for your business. |
+
+## High-level architecture diagram overview
+
+:::image type="content" source="../media/windows-autopatch-groups-high-level-architecture-diagram.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-groups-high-level-architecture-diagram.png":::
+
+Autopatch groups is a function app that is part of the device registration micro service within the Windows Autopatch service. The following table explains the high-level workflow:
+
+| Step | Description |
+| ----- | ----- |
+| Step 1: Create an Autopatch group | Create an Autopatch group. |
+| Step 2: Windows Autopatch uses Microsoft Graph to create Azure AD and policy assignments | Windows Autopatch service uses Microsoft Graph to coordinate the creation of:- Azure AD groups
- Software update policy assignments with other Microsoft services, such as Azure AD, Intune, and Windows Update for Business (WUfB) based on IT admin choices when you create or edit an Autopatch group.
|
+| Step 3: Intune assigns software update policies | Once Azure AD groups are created in the Azure AD service, Intune is used to assign the software update policies to these groups and provide the number of devices that need the software update policies to the Windows Update for Business (WUfB) service. |
+| Step 4: Windows Update for Business responsibilities | Windows Update for Business (WUfB) is the service responsible for:- Delivering those update policies
- Retrieving update deployment statuses back from devices
- Sending back the status information to Microsoft Intune, and then to the Windows Autopatch service
|
+
+## Key concepts
+
+There are a few key concepts to be familiar with before using Autopatch groups.
+
+### About the Default Autopatch group
+
+> [!NOTE]
+> The Default Autopatch group is recommended for organizations that can meet their business needs using the pre-configured five deployment ring composition.
+
+The Default Autopatch group uses Windows Autopatch’s default update management process recommendation. The Default Autopatch group contains:
+
+- A set of **[five deployment rings](#default-deployment-ring-composition)**
+- A default update deployment cadence for both [Windows quality](../operate/windows-autopatch-groups-windows-quality-update-overview.md) and [feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md).
+
+The Default Autopatch group is intended to serve organizations that are looking to:
+
+- Enroll into the service
+- Align to Windows Autopatch’s default update management process without requiring additional customizations.
+
+The Default Autopatch group **can’t** be deleted or renamed. However, you can customize its deployment ring composition to add and/or remove deployment rings, and you can also customize the update deployment cadences for each deployment ring within it.
+
+#### Default deployment ring composition
+
+By default, the following [software update-based deployment rings](#software-based-deployment-rings), represented by Azure AD assigned groups, are used:
+
+- Windows Autopatch – Test
+- Windows Autopatch – Ring1
+- Windows Autopatch – Ring2
+- Windows Autopatch – Ring3
+- Windows Autopatch – Last
+
+**Windows Autopatch – Test** and **Last** can be only used as **Assigned** device distributions. **Windows Autopatch – Ring1**, **Ring2** and **Ring3** can be used with either **Assigned** or **Dynamic** device distributions, or have a combination of both device distribution types.
+
+> [!TIP]
+> For more information about the differences between **Assigned** and **Dynamic** deployment ring distribution types, see [about deployment rings](#about-deployment-rings). Only deployment rings that are placed in between the **Test** and the **Last** deployment rings can be used with the **Dynamic** deployment ring distributions.
+
+> [!CAUTION]
+> These and other Azure AD assigned groups created by Autopatch groups **can't** be missing in your tenant, otherwise, Autopatch groups might not function properly.
+
+The **Last** deployment ring, the fifth deployment ring in the Default Autopatch group, is intended to provide coverage for scenarios where a group of specialized devices and/or VIP/Executive users. They must receive software update deployments after the organization’s general population to mitigate disruptions to your organization’s critical businesses.
+
+#### Default update deployment cadences
+
+The Default Autopatch group provides a default update deployment cadence for its deployment rings except for the **Last** (fifth) deployment ring.
+
+##### Update rings policy for Windows 10 and later
+
+Autopatch groups set up the [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) for each of its deployment rings in the Default Autopatch group. See the following default policy values:
+
+| Policy name | Azure AD group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch Update Policy - default - Test | Windows Autopatch - Test | 0 | 0 | 30 | 0 | 5 | 0 | Yes |
+| Windows Autopatch Update Policy - default - Ring1 | Windows Autopatch - Ring1 | 1 | 0 | 30 | 2 | 5 |2 | Yes |
+| Windows Autopatch Update Policy - default - Ring2 | Windows Autopatch - Ring2 | 6 | 0 | 30 | 2 | 5 | 2 | Yes |
+| Windows Autopatch Update Policy - default - Ring3 | Windows Autopatch - Ring3 | 9 | 0 | 30 | 5 | 5 | 2 | Yes |
+| Windows Autopatch Update Policy - default - Last | Windows Autopatch - Last | 11 | 0 | 30 | 3 | 5 | 2 | Yes |
+
+##### Feature update policy for Windows 10 and later
+
+Autopatch groups set up the [feature updates for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates) for each of its deployment rings in the Default Autopatch group, see the following default policy values:
+
+| Policy name | Azure AD group assignment |Feature update version | Rollout options | First deployment ring availability | Final deployment ring availability | Day between deployment rings | Support end date |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch - DSS Policy [Test] | Windows Autopatch - Test | Windows 10 20H2 | Make update available as soon as possible | N/A | N/A | N/A | May 8, 2023; 7:00PM |
+| Windows Autopatch - DSS Policy [Ring1] | Windows Autopatch - Ring1 | Windows 10 20H2 | Make update available as soon as possible | N/A | N/A | N/A | May 8, 2023; 7:00PM |
+| Windows Autopatch - DSS Policy [Ring2] | Windows Autopatch - Ring2 | Windows 10 20H2 | Make update available as soon as possible | December 14, 2022 | December 21, 2022 | 1 | May 8, 2023; 7:00PM |
+| Windows Autopatch - DSS Policy [Ring3] | Windows Autopatch - Ring3 | Windows 10 20H2 | Make update available as soon as possible | December 15, 2022 | December 29, 2022 | 1 | May 8, 2023; 7:00PM |
+| Windows Autopatch - DSS Policy [Last] | Windows Autopatch - Last | Windows 10 20H2 | Make update available as soon as possible | December 15, 2022 | December 29, 2022 | 1 | May 8, 2023; 7:00PM |
+
+### About Custom Autopatch groups
+
+> [!NOTE]
+> The [Default Autopatch group](#about-the-default-autopatch-group) is recommended for organizations that can meet their business needs using the pre-configured five deployment ring composition.
+
+Custom Autopatch groups are intended to help organizations that require a more precise representation of their organization's structures along with their own update deployment cadence in the service.
+
+By default, a Custom Autopatch group has the Test and Last deployment rings automatically present. For more information, see [Test and Last deployment rings](#about-the-test-and-last-deployment-rings).
+
+### About deployment rings
+
+Deployment rings make it possible for an Autopatch group to have software update deployments sequentially delivered in a gradual rollout within the Autopatch group.
+
+Windows Autopatch aligns with Azure AD and Intune terminology for device group management. There are two types of deployment ring group distribution in Autopatch groups:
+
+| Deployment ring distribution | Description |
+| ----- | ----- |
+| Dynamic | You can use one or more device-based Azure AD groups, either dynamic query-based or assigned to use in your deployment ring composition.Azure AD groups that are used with the Dynamic distribution type can be used to distribute devices across several deployment rings based on percentage values that can be customized.
|
+| Assigned | You can use one single device-based Azure AD group, either dynamic query-based, or assigned to use in your deployment ring composition. |
+| Combination of Dynamic and Assigned | To provide a greater level of flexibility when working on deployment ring compositions, you can combine both device distribution types in Autopatch groups.The combination of Dynamic and Assigned device distribution is **not** supported for the Test and Last deployment ring in Autopatch groups.
|
+
+#### About the Test and Last deployment rings
+
+Both the **Test** and **Last** deployment rings are default deployment rings that are automatically present in the Default Autopatch group and Custom Autopatch groups. These default deployment rings provide the recommended minimum number of deployment rings that an Autopatch group should have.
+
+If you only keep Test and Last deployment rings in your Default Autopatch group, or you don't add more deployment rings when creating a Custom Autopatch group, the Test deployment ring can be used as the pilot deployment ring and Last can be used as the production deployment ring.
+
+> [!IMPORTANT]
+> Both the **Test** and **Last** deployment rings **can't** be removed or renamed from the Default or Custom Autopatch groups. Autopatch groups don't support the use of one single deployment ring as part of its deployment ring composition because you need at least two deployment rings for their gradual rollout. If you must implement a specific scenario with a single deployment ring, and gradual rollout isn’t required, consider managing these devices outside Windows Autopatch.
+
+> [!TIP]
+> Both the **Test** and **Last** deployment rings only support one single Azure AD group assignment at a time. If you need to assign more than one Azure AD group, you can nest the other Azure AD groups under the ones you plan to use with the **Test** and **Last** deployment rings. Only one level of Azure AD group nesting is supported.
+
+#### Service-based versus software update-based deployment rings
+
+Autopatch groups creates two different layers. Each layer contains its own deployment ring set.
+
+> [!IMPORTANT]
+> Both service-based and software update-based deployment ring sets are, by default, assigned to devices that successfully register with Windows Autopatch.
+
+##### Service-based deployment rings
+
+The service-based deployment ring set is exclusively used to keep Windows Autopatch updated with both service and device-level configuration policies, apps and APIs needed for core functions of the service.
+
+The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups cannot be deleted or renamed:
+
+- Modern Workplace Devices-Windows Autopatch-Test
+- Modern Workplace Devices-Windows Autopatch-First
+- Modern Workplace Devices-Windows Autopatch-Fast
+- Modern Workplace Devices-Windows Autopatch-Broad
+
+> [!CAUTION]
+> **Don’t** modify the Azure AD group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly. Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Azure AD group created by Autopatch groups.
+
+##### Software-based deployment rings
+
+The software-based deployment ring set is exclusively used with software update management policies, such as the Windows update ring and feature update policies, in the Default Windows Autopatch group.
+
+The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups cannot be deleted or renamed:
+
+- Windows Autopatch - Test
+- Windows Autopatch – Ring1
+- Windows Autopatch – Ring2
+- Windows Autopatch – Ring3
+- Windows Autopatch – Last
+
+> [!IMPORTANT]
+> Additional Azure AD assigned groups are created and added to list when you add more deployment rings to the Default Autopatch group.
+
+> [!CAUTION]
+> **Don’t** modify the Azure AD group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly. Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Azure AD group created by Autopatch groups.
+
+### About device registration
+
+Autopatch groups register devices with the Windows Autopatch service when you either [create](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) or [edit a Custom Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group), and/or when you [edit the Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to use your existing Azure AD groups instead of the Windows Autopatch Device Registration group provided by the service.
+
+## Common ways to use Autopatch groups
+
+The following are three common uses for using Autopatch groups.
+
+### Use case #1
+
+> [!NOTE]
+> The [Default Autopatch group](#about-the-default-autopatch-group) is recommended for organizations that can meet their business needs using the pre-configured five deployment ring composition.
+
+| Scenario | Solution |
+| ----- | ----- |
+| You’re working as the IT admin at Contoso Ltd. And manage several Microsoft and non-Microsoft cloud services. You don’t have extra time to spend setting up and managing several Autopatch groups.Your organization currently operates its update management by using five deployment rings, but there’s an opportunity to have flexible deployment cadences if it’s pre-communicated to your end-users.
| If you don’t have thousands of devices to manage, use the Default Autopatch group for your organization. You can edit the Default Autopatch group to include additional deployment rings and/or slightly modify some of its default deployment cadences.The Default Autopatch group is pre-configured and doesn’t require extra configurations when registering devices with the Windows Autopatch service.
The following is a visual representation of a gradual rollout for the Default Autopatch group pre-configured and fully managed by the Windows Autopatch service.
|
+
+:::image type="content" source="../media/autopatch-groups-default-autopatch-group.png" alt-text="Default Autopatch group" lightbox="../media/autopatch-groups-default-autopatch-group.png":::
+
+### Use case #2
+
+| Scenario | Solution |
+| ----- | ----- |
+| You’re working as the IT admin at Contoso Ltd. Your organization needs to plan a gradual rollout of software updates within specific critical business units or departments to help mitigate the risk of end-user disruption. | You can create a Custom Autopatch group for each of your business units, for example, the finance department and breakdown the deployment ring composition per the different user personas or based on how critical certain user groups can be for the department and subsequently for the business.The following is a visual representation of a gradual rollout for Contoso’s Finance department.
|
+
+:::image type="content" source="../media/autopatch-groups-finance-department-example.png" alt-text="Finance department example" lightbox="../media/autopatch-groups-finance-department-example.png":::
+
+> [!IMPORTANT]
+> Once Autopatch groups are setup, the release of either Windows quality or feature updates will be deployed sequentially through its deployment rings.
+
+### Use case #3
+
+| Scenario | Solution |
+| ----- | ----- |
+| You’re working as the IT admin at Contoso Ltd. Your branch location in Chicago needs to plan a gradual rollout of software updates within specific departments to make sure the Chicago office doesn’t experience disruptions in its operations. | You can create a Custom Autopatch group for the branch location in Chicago and breakdown the deployment ring composition per the departments within the branch location.The following is a visual representation of a gradual rollout for the Contoso Chicago branch location.
|
+
+:::image type="content" source="../media/autopatch-groups-contoso-chicago-example.png" alt-text="Contoso Chicago example" lightbox="../media/autopatch-groups-contoso-chicago-example.png":::
+
+> [!IMPORTANT]
+> Once Autopatch groups are setup, the release of either Windows quality or feature updates will be deployed sequentially through its deployment rings.
+
+## Supported configurations
+
+The following configurations are supported when using Autopatch groups.
+
+### Software update workloads
+
+Autopatch groups works with the following software update workloads:
+
+- [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md)
+- [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
+
+> [!IMPORTANT]
+> [Microsoft Edge](../operate/windows-autopatch-edge.md) and [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md) are supported through the (classic) service-based deployment rings. Other software update workloads aren’t currently supported.
+
+### Maximum number of Autopatch groups
+
+Windows Autopatch will support up to 50 Autopatch groups in your tenant. You can create up to 49 [Custom Autopatch groups](#about-custom-autopatch-groups) in addition to the [Default Autopatch group](#about-the-default-autopatch-group). Each Autopatch group supports up to 15 deployment rings.
+
+To manage your Autopatch groups, see [Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md).
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md
index 209062f4b0..55ddc49938 100644
--- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md
@@ -1,7 +1,7 @@
---
title: Register your devices
description: This article details how to register devices in Autopatch
-ms.date: 04/24/2023
+ms.date: 05/01/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: how-to
@@ -20,14 +20,25 @@ Before Microsoft can manage your devices in Windows Autopatch, you must have dev
Windows Autopatch can take over software update management control of devices that meet software-based prerequisites as soon as an IT admin decides to have their tenant managed by the service. The Windows Autopatch software update management scope includes the following software update workloads:
-- [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md)
-- [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md)
-- [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
-- [Microsoft Edge updates](../operate/windows-autopatch-edge.md)
-- [Microsoft Teams updates](../operate/windows-autopatch-teams.md)
+- Windows quality updates
+ - [Autopatch groups experience](../operate/windows-autopatch-groups-windows-quality-update-overview.md)
+ - [Classic experience](../operate/windows-autopatch-windows-quality-update-overview.md)
+- Windows feature updates
+ - [Autopatch groups experience](../operate/windows-autopatch-groups-windows-feature-update-overview.md)
+ - [Classic experience](../operate/windows-autopatch-windows-feature-update-overview.md)
+- The following software update workloads use the Classic experience:
+ - [Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md)
+ - [Microsoft Edge updates](../operate/windows-autopatch-edge.md)
+ - [Microsoft Teams updates](../operate/windows-autopatch-teams.md)
### About the use of an Azure AD group to register devices
+Windows Autopatch provides two methods of registering devices with its service, the [Classic](#classic-device-registration-method) and the Autopatch groups device registration method.
+
+#### Classic device registration method
+
+This method is intended to help organizations that don’t require the use of [Custom Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups) or additional customizations to the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) to register devices.
+
You must choose what devices to manage with Windows Autopatch by adding them to the **Windows Autopatch Device Registration** Azure AD assigned group. Devices can be added using the following methods:
- Direct membership
@@ -36,17 +47,31 @@ You must choose what devices to manage with Windows Autopatch by adding them to
Windows Autopatch automatically runs its discover devices function every hour to discover new devices added to this group. Once new devices are discovered, Windows Autopatch attempts to register these devices.
-> [!NOTE]
-> Devices that are intended to be managed by the Windows Autopatch service **must** be added into the **Windows Autopatch Device Registration** Azure AD assigned group. Devices can only be added to this group if they have an Azure AD device ID. Windows Autopatch scans the Azure AD group hourly to discover newly added devices to be registered. You can also use the **Discover devices** button in either the **Ready** or **Not ready** tab to register devices on demand.
+You can also use the **Discover devices** button in either the Registered or Not ready tab to register devices on demand. The **Discover devices** button scans for devices to be registered in the **Windows Autopatch Device Registration** or any other Azure AD group used with either the Default or Custom Autopatch groups.
-#### Supported scenarios when nesting other Azure AD groups
+#### Windows Autopatch groups device registration method
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+This method is intended to help organizations that require the use of [Custom Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups) or additional customizations to the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group).
+
+When you either create/edit a Custom Autopatch group or edit the Default Autopatch group to add or remove deployment rings, the device-based Azure AD groups you use when setting up your deployment rings are scanned to see if devices need to be registered with the Windows Autopatch service.
+
+If devices aren’t registered, Autopatch groups starts the device registration process by using your existing device-based Azure AD groups instead of the Windows Autopatch Device Registration group.
+
+For more information, see [create Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) and [edit Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to register devices using the Autopatch groups device registration method.
+
+##### Supported scenarios when nesting other Azure AD groups
Windows Autopatch also supports the following Azure AD nested group scenarios:
Azure AD groups synced up from:
-- On-premises Active Directory groups (Windows Server AD).
-- [Configuration Manager collections](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_aadcollsync).
+- On-premises Active Directory groups (Windows Server AD)
+- [Configuration Manager collections](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_aadcollsync)
+
+The Azure AD groups apply to both the [Classic](#classic-device-registration-method) and the [Autopatch group device registration](#windows-autopatch-groups-device-registration-method) methods.
> [!WARNING]
> It isn't recommended to sync Configuration Manager collections straight to the **Windows Autopatch Device Registration** Azure AD group. Use a different Azure AD group when syncing Configuration Manager collections to Azure AD groups then you can nest this or these groups into the **Windows Autopatch Device Registration** Azure AD group.
@@ -63,10 +88,13 @@ In the dual state, you end up having two Azure AD device records with different
It's recommended to detect and clean up stale devices in Azure AD before registering devices with Windows Autopatch, see [How To: Manage state devices in Azure AD](/azure/active-directory/devices/manage-stale-devices).
> [!WARNING]
-> If you don't clean up stale devices in Azure AD before registering devices with Windows Autopatch, you might end up seeing devices failing to meet the **Intune or Cloud-Attached (Device must be either Intune-managed or Co-managed)** pre-requisite check in the **Not ready** tab because it's expected that these stale Azure AD devices are not enrolled into the Intune service anymore.
+> If you don't clean up stale devices in Azure AD before registering devices with Windows Autopatch, you might end up seeing devices failing to meet the **Intune or Cloud-Attached (Device must be either Intune-managed or Co-managed)** pre-requisite check in the **Not ready** tab because it's expected that these stale Azure AD devices aren't enrolled into the Intune service anymore.
## Prerequisites for device registration
+> [!IMPORTANT]
+> The following prerequisites apply to both the [Classic](#classic-device-registration-method) and the [Autopatch groups device registration](#windows-autopatch-groups-device-registration-method) methods.
+
To be eligible for Windows Autopatch management, devices must meet a minimum set of required software-based prerequisites:
- Windows 10 (1809+)/11 Enterprise or Professional editions (only x64 architecture).
@@ -88,26 +116,29 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set
For more information, see [Windows Autopatch Prerequisites](../prepare/windows-autopatch-prerequisites.md).
-## About the Ready, Not ready and Not registered tabs
+## About the Registered, Not ready and Not registered tabs
-Windows Autopatch has three tabs within its device blade. Each tab is designed to provide a different set of device readiness statuses so IT admin knows where to go to monitor, and fix potential device health issues.
+> [!IMPORTANT]
+> Devices registered through either the [Classic](#classic-device-registration-method) or the [Autopatch groups device registration method](#windows-autopatch-groups-device-registration-method) can appear in the Registered, Not ready, or Not registered tabs. When devices successfully register with the service, the devices are listed in the Registered tab. However, even if the device(s)is successfully registered, they can be part of Not ready tab. If devices fail to register, the devices are listed in the Not registered tab.
+
+Windows Autopatch has three tabs within its device blade. Each tab is designed to provide a different set of device readiness statuses so the IT admin knows where to go to monitor, and fix potential device health issues.
| Device blade tab | Purpose | Expected device readiness status |
| ----- | ----- | ----- |
-| Ready | The purpose of this tab is to show devices that were successfully registered with the Windows Autopatch service. | Active |
+| Registered | The purpose of this tab is to show devices that were successfully registered with the Windows Autopatch service. | Active |
| Not ready | The purpose of this tab is to help you identify and remediate devices that failed to pass one or more post-device registration readiness checks. Devices showing up in this tab were successfully registered with Windows Autopatch. However, these devices aren't ready to have one or more software update workloads managed by the service. | Readiness failed and/or Inactive |
-| Not registered | The purpose of this tab is to help you identify and remediate devices that don't meet one or more prerequisite checks to successfully register with the Windows Autopatch service. | Pre-requisites failed |
+| Not registered | The purpose of this tab is to help you identify and remediate devices that don't meet one or more prerequisite checks to successfully register with the Windows Autopatch service. | Prerequisites failed |
## Device readiness statuses
-See all possible device readiness statuses in Windows Autopatch:
+The following are the possible device readiness statuses in Windows Autopatch:
| Readiness status | Description | Device blade tab |
| ----- | ----- | ----- |
-| Active | Devices with this status successfully passed all prerequisite checks and then successfully registered with Windows Autopatch. Additionally, devices with this status successfully passed all post-device registration readiness checks. | Ready |
+| Active | Devices with this status successfully passed all prerequisite checks and then successfully registered with Windows Autopatch. Additionally, devices with this status successfully passed all post-device registration readiness checks. | Registered |
| Readiness failed | Devices with this status haven't passed one or more post-device registration readiness checks. These devices aren't ready to have one or more software update workloads managed by Windows Autopatch. | Not ready |
| Inactive | Devices with this status haven't communicated with Microsoft Intune in the last 28 days. | Not ready |
-| Pre-requisites failed | Devices with this status haven't passed one or more pre-requisite checks and haven't successfully registered with Windows Autopatch | Not registered |
+| Prerequisites failed | Devices with this status haven't passed one or more prerequisite checks and haven't successfully registered with Windows Autopatch | Not registered |
## Built-in roles required for device registration
@@ -120,7 +151,7 @@ For more information, see [Azure AD built-in roles](/azure/active-directory/role
If you want to assign less-privileged user accounts to perform specific tasks in the Windows Autopatch portal, such as register devices with the service, you can add these user accounts into one of the two Azure AD groups created during the [tenant enrollment](../prepare/windows-autopatch-enroll-tenant.md) process:
-| Role | Discover devices | Modify columns | Refresh device list | Export to .CSV | Device actions |
+| Azure AD Group name | Discover devices | Modify columns | Refresh device list | Export to .CSV | Device actions |
| ----- | ----- | ----- | ----- | ----- | ----- |
| Modern Workplace Roles - Service Administrator | Yes | Yes | Yes | Yes | Yes |
| Modern Workplace Roles - Service Reader | No | Yes | Yes | Yes | No |
@@ -133,30 +164,36 @@ If you want to assign less-privileged user accounts to perform specific tasks in
Registering your devices with Windows Autopatch does the following:
1. Makes a record of devices in the service.
-2. Assign devices to the [deployment rings](../operate/windows-autopatch-update-management.md) and other groups required for software update management.
+2. Assign devices to the [two deployment ring sets](../deploy/windows-autopatch-groups-overview.md#about-deployment-rings) and other groups required for software update management.
For more information, see [Device registration overview](../deploy/windows-autopatch-device-registration-overview.md).
-## Steps to register devices
+## Steps to register devices using the classic method
+
+> [!IMPORTANT]
+> For more information, see [Create Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) and [Edit Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) on how to register devices using the Autopatch groups device registration method.
+
+Any device (either physical or virtual) that contains an Azure AD device ID, can be added into the **Windows Autopatch Device Registration** Azure AD group through either direct membership or by being part of another Azure AD group (either dynamic or assigned) that's nested to this group, so it can be registered with Windows Autopatch. The only exception is new Windows 365 Cloud PCs, as these virtual devices should be registered with Windows Autopatch from the Windows 365 provisioning policy.
+
+For more information, see [Windows Autopatch on Windows 365 Enterprise Workloads](#windows-autopatch-on-windows-365-enterprise-workloads).
-Any device (either physical or virtual) that contains an Azure AD device ID, can be added into the **Windows Autopatch Device Registration** Azure AD group through either direct membership or by being part of another Azure AD group (either dynamic or assigned) that's nested to this group, so it can be registered with Windows Autopatch. The only exception is new Windows 365 Cloud PCs, as these virtual devices should be registered with Windows Autopatch from the Windows 365 provisioning policy. For more information, see [Windows Autopatch on Windows 365 Enterprise Workloads](#windows-autopatch-on-windows-365-enterprise-workloads).
Since existing Windows 365 Cloud PCs already have an existing Azure AD device ID, these devices can be added into the **Windows Autopatch Device Registration** Azure group through either direct membership or by being part of another Azure AD group (either dynamic or assigned) that's nested to this group.
-**To register devices with Windows Autopatch:**
+**To register devices with Windows Autopatch using the classic method:**
1. Go to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
2. Select **Devices** from the left navigation menu.
3. Under the **Windows Autopatch** section, select **Devices**.
-4. Select either the **Ready** or the **Not registered** tab, then select the **Windows Autopatch Device Registration** hyperlink. The Azure Active Directory group blade opens.
+4. Select either the **Registered** or the **Not registered** tab, then select the **Windows Autopatch Device Registration** hyperlink. The Azure Active Directory group blade opens.
5. Add either devices through direct membership, or other Azure AD dynamic or assigned groups as nested groups in the **Windows Autopatch Device Registration** group.
> [!NOTE]
-> The **Windows Autopatch Device Registration** hyperlink is in the center of the Ready tab when there's no devices registered with the Windows Autopatch service. Once you have one or more devices registered with the Windows Autopatch service, the **Windows Autopatch Device registration** hyperlink is at the top of both **Ready** and **Not registered** tabs.
+> The **Windows Autopatch Device Registration** hyperlink is in the center of the Registered tab when there's no devices registered with the Windows Autopatch service. Once you have one or more devices registered with the Windows Autopatch service, the **Windows Autopatch Device registration** hyperlink is at the top of both **Registered** and **Not registered** tabs.
Once devices or other Azure AD groups (either dynamic or assigned) containing devices are added to the **Windows Autopatch Device Registration** group, Windows Autopatch's device discovery hourly function discovers these devices, and runs software-based prerequisite checks to try to register them with its service.
> [!TIP]
-> You can also use the **Discover Devices** button in either one of the **Ready**, **Not ready**, or **Not registered** device blade tabs to discover devices from the **Windows Autopatch Device Registration** Azure AD group on demand. On demand means you don't have to wait for Windows Autopatch to discover devices from the Azure AD group on your behalf.
+> You can also use the **Discover Devices** button in either one of the **Registered**, **Not ready**, or **Not registered** device blade tabs to discover devices from the **Windows Autopatch Device Registration** Azure AD group on demand. On demand means you don't have to wait for Windows Autopatch to discover devices from the Azure AD group on your behalf.
### Windows Autopatch on Windows 365 Enterprise Workloads
@@ -177,11 +214,14 @@ Windows 365 Enterprise gives IT admins the option to register devices with the W
For more information, see [Create a Windows 365 Provisioning Policy](/windows-365/enterprise/create-provisioning-policy).
+> [!IMPORTANT]
+> Starting in May 2023, Windows 365 Cloud PC devices are assigned to two deployment ring sets, the service-based and the software-based deployment rings. Additionally, once registered with Windows Autopatch, Windows 365 Cloud PC devices are automatically added to the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group). For more information, see [service-based versus software update-based deployment ring sets](../deploy/windows-autopatch-groups-overview.md#service-based-versus-software-update-based-deployment-rings).
+
### Windows Autopatch on Azure Virtual Desktop workloads
-Windows Autopatch is available for your Azure Virtual Desktop workloads. Enterprise admins can provision their Azure Virtual Desktop workloads to be managed by Windows Autopatch using the existing [device registration process](#steps-to-register-devices).
+Windows Autopatch is available for your Azure Virtual Desktop workloads. Enterprise admins can provision their Azure Virtual Desktop workloads to be managed by Windows Autopatch using the existing device registration process.
-Windows Autopatch provides the same scope of service with virtual machines as it does with [physical devices](#steps-to-register-devices). However, Windows Autopatch defers any Azure Virtual Desktop specific support to [Azure support](#contact-support-for-device-registration-related-incidents), unless otherwise specified.
+Windows Autopatch provides the same scope of service with virtual machines as it does with [physical devices](#steps-to-register-devices-using-the-classic-method). However, Windows Autopatch defers any Azure Virtual Desktop specific support to [Azure support](#contact-support-for-device-registration-related-incidents), unless otherwise specified.
#### Prerequisites
@@ -199,7 +239,7 @@ The following Azure Virtual Desktop features aren’t supported:
#### Deploy Autopatch on Azure Virtual Desktop
-Azure Virtual Desktop workloads can be registered into Windows Autopatch by using the same method as your [physical devices](#steps-to-register-devices). For more information, see [Register your devices](#steps-to-register-devices).
+Azure Virtual Desktop workloads can be registered into Windows Autopatch by using the same method as your [physical devices](#steps-to-register-devices-using-the-classic-method).
For ease of deployment, we recommend nesting a dynamic device group in your Autopatch device registration group. The dynamic device group would target the **Name** prefix defined in your session host, but **exclude** any Multi-Session Session Hosts. For example:
diff --git a/windows/deployment/windows-autopatch/media/autopatch-groups-contoso-chicago-example.png b/windows/deployment/windows-autopatch/media/autopatch-groups-contoso-chicago-example.png
new file mode 100644
index 0000000000..44580586e9
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/autopatch-groups-contoso-chicago-example.png differ
diff --git a/windows/deployment/windows-autopatch/media/autopatch-groups-default-autopatch-group.png b/windows/deployment/windows-autopatch/media/autopatch-groups-default-autopatch-group.png
new file mode 100644
index 0000000000..73a32e8635
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/autopatch-groups-default-autopatch-group.png differ
diff --git a/windows/deployment/windows-autopatch/media/autopatch-groups-finance-department-example.png b/windows/deployment/windows-autopatch/media/autopatch-groups-finance-department-example.png
new file mode 100644
index 0000000000..259dcafcdf
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/autopatch-groups-finance-department-example.png differ
diff --git a/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-1.png b/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-1.png
new file mode 100644
index 0000000000..fe35744633
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-1.png differ
diff --git a/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-2.png b/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-2.png
new file mode 100644
index 0000000000..bd2b2ec92c
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/autopatch-groups-manage-feature-release-case-2.png differ
diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-overview.png b/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-overview.png
index a2e0785741..f77684b8c4 100644
Binary files a/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-overview.png and b/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-overview.png differ
diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-workflow-diagram.png b/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-workflow-diagram.png
index f5a8284a8c..abd0c884b1 100644
Binary files a/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-workflow-diagram.png and b/windows/deployment/windows-autopatch/media/windows-autopatch-device-registration-workflow-diagram.png differ
diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-groups-high-level-architecture-diagram.png b/windows/deployment/windows-autopatch/media/windows-autopatch-groups-high-level-architecture-diagram.png
new file mode 100644
index 0000000000..1be4b61b37
Binary files /dev/null and b/windows/deployment/windows-autopatch/media/windows-autopatch-groups-high-level-architecture-diagram.png differ
diff --git a/windows/deployment/windows-autopatch/media/windows-feature-release-process-timeline.png b/windows/deployment/windows-autopatch/media/windows-feature-release-process-timeline.png
deleted file mode 100644
index 17b51a71f8..0000000000
Binary files a/windows/deployment/windows-autopatch/media/windows-feature-release-process-timeline.png and /dev/null differ
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md
new file mode 100644
index 0000000000..789a3b23e3
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md
@@ -0,0 +1,103 @@
+---
+title: Device alerts
+description: Provide notifications and information about the necessary steps to keep your devices up to date.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Device alerts (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Windows Autopatch and Windows Updates use Device alerts to provide notifications and information about the necessary steps to keep your devices up to date. In Windows Autopatch reporting, every device is provided with a section for alerts. If no alerts are listed, no action is needed. Navigate to **Reports** > **Quality update status** or **Feature update status** > **Device** > select the **Device alerts** column. The provided information will help you understand:
+
+- The action(s) that have either been performed by Microsoft and/or Windows Autopatch to keep the device properly updated.
+- The actions you must perform so the device can properly be updated.
+
+> [!NOTE]
+> At any given point, one or both of these actions can be present in your tenant.
+
+## Windows Autopatch alerts
+
+Windows Autopatch alerts are alerts specific to the Windows Autopatch service. These alerts include:
+
+- [Post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md)
+- [Policy health and remediation](../operate/windows-autopatch-policy-health-and-remediation.md)
+
+## Windows quality and feature update alerts
+
+These alerts represent data reported to the Windows Update service related to Windows quality and feature updates. These alerts can help identify actions that must be performed if an update doesn't apply as expected. Alerts are only provided by device that actively reports to the Windows Update service.
+
+## Customer and Microsoft Actions
+
+Windows Autopatch assigns alerts to either Microsoft Action or Customer Action. These assignments give a clear understanding of who has the responsibility to remediate the alert.
+
+| Assignment | Description |
+| ----- | ----- |
+| Microsoft Action | Refers to the responsibility of the Windows Autopatch service to remediate. The actions are performed by Windows Autopatch automatically. |
+| Customer Action | Refers to your responsibility to carry out the appropriate action(s) to resolve the reported alert. |
+
+## Alert resolutions
+
+Alert resolutions are provided through the Windows Update service and provide the reason why an update didn’t perform as expected. The recommended actions are general recommendations and if additional assistance is needed, [submit a support request](../operate/windows-autopatch-support-request.md)
+
+| Alert message | Description | Windows Autopatch recommendation(s) |
+| ----- | ----- | ----- |
+| `CancelledByUser` | User canceled the update | The Windows Update service has reported the update was canceled by the user.It's recommended to work with the end user to allow updates to execute as scheduled.
|
+| `DamagedMedia` | The update file or hard drive is damaged | The Windows Update service has indicated the update payload might be damaged or corrupt. It's recommended to run `Chkdsk /F` on the device with administrator privileges, then retry the update. For more information, see [chkdsk](/windows-server/administration/windows-commands/chkdsk?tabs=event-viewer).
|
+| `DeploymentConflict` | Device is in more than one deployment of the same update type. Only the first deployment assigned is effective. | The Windows Update service has reported a policy conflict.For more information, see the [Windows Autopatch Policy Health dashboard](../operate/windows-autopatch-policy-health-and-remediation.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DeviceRegistrationInvalidAzureADDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Azure AD Device ID. | The Windows Update service has reported a device registration issue.For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DeviceRegistrationInvalidGlobalDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Global Device ID. |The Windows Update service has reported that the MSA Service may be disabled preventing Global Device ID assignment.Check that the MSA Service is running or able to run on device.
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DeviceRegistrationIssue` | The device isn't able to register or authenticate properly with Windows Update. | The Windows Update service has reported a device registration issue.For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DeviceRegistrationNoTrustType` | The device isn't able to register or authenticate properly with Windows Update because it can't establish Trust. | The Windows Update service has reported a device registration issue.For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DiskFull` | The installation couldn't be completed because the Windows partition is full. | The Windows Update service has reported there's insufficient disk space to perform the update. Free up disk space on the Windows partition and retry the installation.For more information, see [Free up space for Windows Updates](/windows/free-up-space-for-windows-updates-429b12ba-f514-be0b-4924-ca6d16fa1d65#:~:text=Here%E2%80%99s%20how%20to%20get%20more%20storage%20space%20on,to%20Windows%20needs%20space%20to%20update.%20More%20items).
|
+| `DownloadCancelled` | Windows Update couldn't download the update because the update server stopped the connection. | The Windows Update service has reported an issue with your update server. Validate your network is working and retry the download. If the alert persists, review your network configuration to make sure that this computer can access the internet.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).
|
+| `DownloadConnectionIssue` | Windows Update couldn't connect to the update server and the update couldn't download. | The Windows Update service has reported an issue connecting to Windows Update. Review your network configuration, and to make sure that this computer can access the internet and Windows Update Online.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadCredentialsIssue` | Windows Update couldn't download the file because the Background Intelligent Transfer Service (BITS) couldn't connect to the internet. A proxy server or firewall on your network might require credentials. | The Windows Update service Windows has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client. Retry the download.Review your network configuration to make sure that this computer can access the internet. Validate and/or allowlist Windows Update and Delivery Optimization endpoint.
For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadIssue` | There was an issue downloading the update. | The Windows Update service has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadIssueServiceDisabled` | There was a problem with the Background Intelligent Transfer Service (BITS). The BITS service or a service it depends on might be disabled. | The Windows Updates service has reported that the BITS service is disabled. In the local client services, make sure that the Background Intelligent Transfer Service is enabled. If the service isn't running, try starting it manually. For more information, see [Issues with BITS](/security-updates/WindowsUpdateServices/18127392).If it will not start, check the event log for errors or [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadTimeout` | A timeout occurred while Windows tried to contact the update service or the server containing the update's payload. | The Windows Update service has reported it attempted to download the payload and the connection timed out.Retry downloading the payload. If not successful, review your network configuration to make sure that this computer can access the internet.
For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5). |
+| `EndOfService` | The device is on a version of Windows that has passed its end of service date. | Windows Update service has reported the current version is past End of Service. Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).
|
+| `EndOfServiceApproaching` | The device is on a version of Windows that is approaching its end of service date. | Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).
|
+| `FailureResponseThreshold` | The failure response threshold setting was met for a deployment to which the device belongs. | The Windows Update service has reported the client has hit the Failure Response Threshold. Consider pausing the deployment and assess for issues. If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md). |
+| `FileNotFound` | The downloaded update files can't be found. The Disk Cleanup utility or a non-Microsoft software cleaning tool might have removed the files during cleanup. | Windows Update has reported that the update files couldn't be found, download the update again, and then retry the installation.This can often occur with third party security products. For more information, see [Virus scanning recommendations for Enterprise computers that are running Windows or Windows Server (KB822158)](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-windows-or-windows-server-kb822158-c067a732-f24a-9079-d240-3733e39b40bc).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `Incompatible` | The system doesn't meet the minimum requirements to install the update. | The Windows Update service has reported the update is incompatible with this device for more details please review the `ScanResult.xml` file in the `C:\WINDOWS\PANTHER folder for "Block Type=Hard`.If this is occurring on a Windows Autopatch managed device, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `IncompatibleArchitecture` | This update is for a different CPU architecture. | The Windows Update service has reported the update architecture doesn't match the destination architecture, make sure the target operating system architecture matches the host operating system architecture.This is **not** typical for Windows Update based environments.
If this is occurring on a Windows Autopatch managed device, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `IncompatibleServicingChannel` | Device is in a servicing channel that is incompatible with a deployment to which the device belongs. | The Windows Update service has reported the servicing channel on the client isn't compatible with the targeted payload.We recommend configuring the device's servicing channel to the [Semi-Annual Enterprise Channel](/windows-server/get-started/servicing-channels-comparison#semi-annual-channel).
|
+| `InstallAccessDenied` | Installer doesn't have permission to access or replace a file. The installer might have tried to replace a file that an antivirus, anti-malware, or a backup program is currently scanning. | The Windows Update service has reported it couldn't access the necessary system locations, ensure no other service has a lock or handle on the windows update client folders and retry the installation.This can often occur with third party security products. For more information, see [Virus scanning recommendations for Enterprise computers that are running Windows or Windows Server (KB822158)](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-windows-or-windows-server-kb822158-c067a732-f24a-9079-d240-3733e39b40bc).
|
+| `InstalledCancelled` | The installation was canceled. | The Windows Update service has reported the update was canceled by the user.It's recommended to work with the end user to allow updates to execute as scheduled.
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `InstallFileLocked` | Installer couldn't access a file that is already in use. The installer might have tried to replace a file that an antivirus, anti-malware, or backup program is currently scanning. | The Windows Update service has reported it couldn't access the necessary system locations.Check the files under the `%SystemDrive%\$Windows.~bt` directory and retry the installation.
This can often occur with third party security products. For more information, see [Virus scanning recommendations for Enterprise computers that are running Windows or Windows Server (KB822158)](https://support.microsoft.com/topic/virus-scanning-recommendations-for-enterprise-computers-that-are-running-windows-or-windows-server-kb822158-c067a732-f24a-9079-d240-3733e39b40bc).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `InstallIssue` | There was an issue installing the update. | The Windows Update service has reported the update installation has failed.If the alert persists, run "`dism /online /cleanup-image /restorehealth`" on the device with administrator privileges, then retry the update.
For more information, see [Repair a Windows Image](/windows-hardware/manufacture/desktop/repair-a-windows-image) if the command fails. A reinstall of Windows may be required.
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `InstallIssueRedirection` | A known folder that doesn't support redirection to another drive might have been redirected to another drive. | The Windows Update service has reported that the Windows Update file location may be redirected to an invalid location. Check your Windows Installation, and retry the update.If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `InstallMissingInfo` | Windows Update doesn't have the information it needs about the update to finish the installation. | The Windows Update service has reported that another update may have replaced the one you're trying to install. Check the update, and then try reinstalling it. |
+| `InstallOutOfMemory` | The installation couldn't be completed because Windows ran out of memory. | The Windows Update service has reported the system doesn't have sufficient system memory to perform the update.Restart Windows, then try the installation again.
If it still fails, allocate more memory to the device, or increase the size of the virtual memory pagefile(s). For more information, see [How to determine the appropriate page file size for 64-bit versions of Windows](/troubleshoot/windows-client/performance/how-to-determine-the-appropriate-page-file-size-for-64-bit-versions-of-windows).
|
+| `InstallSetupError` | Windows Setup encountered an error while installing. | The Windows Update service has reported an error during installation.Review the last reported HEX error code in [Quality update status report](../operate/windows-autopatch-groups-windows-quality-update-status-report.md) to further investigate.If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `PolicyConflict` | There are client policies (MDM, GP) that conflict with Windows Update settings. | The Windows Update service has reported a policy conflict. Review the [Windows Autopatch Policy Health dashboard](../operate/windows-autopatch-policy-health-and-remediation.md).If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `PolicyConflictDeferral` | The Deferral Policy configured on the device is preventing the update from installing. | The Windows Update service has reported a policy conflict. Review the [Windows Autopatch Policy Health dashboard](../operate/windows-autopatch-policy-health-and-remediation.md).If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `PolicyConflictPause` | Updates are paused on the device, preventing the update from installing. | The Windows Update service has reported a policy conflict. Review the [Windows Autopatch Policy Health dashboard](../operate/windows-autopatch-policy-health-and-remediation.md).If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `PostRestartIssue` | Windows Update couldn't determine the results of installing the update. The error is usually false, and the update probably succeeded. | The Windows Update Service has reported the update you're trying to install isn't available.No action is required.
If the update is still available, retry the installation.
|
+| `RollbackInitiated` | A rollback was started on this device, indicating a catastrophic issue occurred during the Windows Setup install process. | The Windows Update service has reported a failure with the update. Run the Setup Diagnostics Tool on the Device or review the HEX error in [Quality update status report](../operate/windows-autopatch-groups-windows-quality-update-status-report.md). **Don’t** retry the installation until the impact is understood.For more information, see [SetupDiag - Windows Deployment](/windows/deployment/upgrade/setupdiag).
|
+| `SafeguardHold` | Update can't install because of a known Safeguard Hold. | The Windows Update Service has reported a [Safeguard Hold](/windows/deployment/update/update-compliance-feature-update-status#safeguard-holds) which applies to this device.For more information about safeguards, see [Windows 10/11 release information for the affected version(s)](/windows/release-health/release-information).
|
+| `UnexpectedShutdown` | The installation was stopped because a Windows shutdown or restart was in progress. | The Windows Update service has reported Windows was unexpectedly restarted during the update process.No action is necessary the update should retry when windows is available.
If the alert persists, ensure the device remains on during Windows installation.
|
+| `VersionMismatch` | Device is on a version of Windows that wasn't intended by Windows Update. | The Windows Update service has reported that the version of Windows wasn't intended.Confirm whether the device is on the intended version.
|
+| `WindowsRepairRequired` | The current version of Windows needs to be repaired before it can be updated. | The Windows Update service has indicated that the service is in need of repair. Run the Startup Repair Tool on this device.For more information, see [Windows boot issues – troubleshooting](/troubleshoot/windows-client/performance/windows-boot-issues-troubleshooting#method-1-startup-repair-tool).
|
+| `WUBusy` | Windows Update can't do this task because it's busy. | The Windows Update service has reported that Windows Update is busy. No action is needed. Restart Windows should and retry the installation. |
+| `WUComponentMissing` | Windows Update might be missing a component, or the update file might be damaged. | The Windows Update service has reported key components for windows update are missing.Run "`dism /online /cleanup-image /restorehealth`" on the device with administrator privileges, to repair these components. Then retry the update.
For more information, see [Repair a Windows Image](/windows-hardware/manufacture/desktop/repair-a-windows-image) if the command fails. A reinstall of Windows may be required.
|
+| `WUDamaged` | Windows Update or the update file might be damaged. | The Windows Update service has reported key components for windows update are missing.Run "`dism /online /cleanup-image /restorehealth`" on the device with administrator privileges to repair these components. Then retry the update.
For more information, see [Repair a Windows Image](/windows-hardware/manufacture/desktop/repair-a-windows-image) if the command fails. A reinstall of Windows may be required.
|
+| `WUDecryptionIssue` | Windows Update couldn't decrypt the encrypted update file because it couldn't find the proper key. | The Windows Update service has reported it couldn't decrypt the update payload.This alert could be a network transit error and may be resolved on its own. If the alert persists, validate any network Riverbeds, Application or http proxies and retry.
|
+| `WUDiskError` | Windows Update encountered an error while reading or writing to the system drive. | The Windows Update service has reported an alert reading or writing to the system disk. This alert is often a client issue with the target system. We recommend running the Windows Update Troubleshooter on the device. Retry the installation.For more information, see [Windows Update Troubleshooter](https://support.microsoft.com/windows/windows-update-troubleshooter-19bc41ca-ad72-ae67-af3c-89ce169755dd).
|
+| `WUIssue` | Windows Update couldn't understand the metadata provided by the update service. This error usually indicates a problem with the update. | The Windows Update service has reported an issue with the Update payload. This could be a transient alert.If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+
+## Additional resources
+
+- [Troubleshoot problems updating Windows](https://support.microsoft.com/windows/troubleshoot-problems-updating-windows-188c2b0f-10a7-d72f-65b8-32d177eb136c)
+- [How to use the PC Health Check app](https://support.microsoft.com/windows/how-to-use-the-pc-health-check-app-9c8abd9b-03ba-4e67-81ef-36f37caa7844)
+- [Windows Update Troubleshooter](https://support.microsoft.com/windows/windows-update-troubleshooter-19bc41ca-ad72-ae67-af3c-89ce169755dd)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md
new file mode 100644
index 0000000000..5552fe0c6d
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-manage-windows-feature-update-release.md
@@ -0,0 +1,213 @@
+---
+title: Manage Windows feature update releases
+description: This article explains how you can manage Windows feature updates with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Manage Windows feature update releases: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+You can create custom releases for Windows feature update deployments in Windows Autopatch.
+
+## Before you begin
+
+Before you start managing custom Windows feature update releases, consider the following:
+
+- If you’re planning on using either the [Default or Custom Autopatch groups](../deploy/windows-autopatch-groups-overview.md#key-concepts) ensure:
+ - The Default Autopatch group has all deployment rings and deployment cadences you need.
+ - You have created all your Custom Autopatch groups prior to creating custom releases.
+- Review [Windows feature update prerequisites](/mem/intune/protect/windows-10-feature-updates#prerequisites).
+- Review the [Windows feature updates policy limitations](/mem/intune/protect/windows-10-feature-updates#limitations-for-feature-updates-for-windows-10-and-later-policy).
+
+## About the auto-populate automation for release phases
+
+By default, the deployment rings of each Autopatch group will be sequentially assigned to a phase. For example, the first deployment ring of each Autopatch group is assigned to Phase 1, and the second deployment ring of each Autopatch group is assigned to Phase 2, etc.
+
+The following table explains the auto-populating assignment of your deployments rights if you have two Autopatch groups. One Autopatch group is named Finance and the other is named Marketing; each Autopatch group has four (Finance) and five (Marketing) deployment rings respectively.
+
+| Phases | Finance | Marketing
+| ----- | ----- | ----- |
+| Phase 1 | Test | Test |
+| Phase 2 | Ring1 | Ring1 |
+| Phase 3 | Ring2 | Ring2 |
+| Phase 4 | Last | Ring3 |
+
+If the Autopatch groups are edited after a release is created (Active status), the changes to the Autopatch group won’t be reflected unless you create a new custom release.
+
+If you wish to change the auto-populating assignment of your deployment rings to release phases, you can do so by adding, removing, or editing the auto-populated phases.
+
+### More information about the completion date of a phase
+
+The goal completion date of a phase is calculated using the following formula:
+
+` + ( – 1) * Days in between groups (7) + Deadline for feature updates (5 days) + Grace Period (2 days).`
+
+This formula is only applicable for **Deadline-driven** not for Scheduled-driven deployment cadences. For more information, see [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md).
+
+> [!IMPORTANT]
+> By default, both the **Deadline for feature updates** and the **Grace period** values are set by Windows Autopatch in every [Update rings for Windows 10 and later policy](/mem/intune/protect/windows-10-update-rings) created by Autopatch groups.
+
+### How to use the Windows feature update blade
+
+Use the Windows feature update blade to check in the overall status of the [default release](../operate/windows-autopatch-groups-windows-feature-update-overview.md#default-release) and the custom ones you create.
+
+**To access the Windows feature update blade:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release management** blade, under the **Release schedule** tab, select **Windows feature updates**.
+1. In the **Windows feature updates** blade, you can see all the information about the releases. The columns are described in the following table:
+
+| Status | Description |
+| ----- | ----- |
+| Release name | Name of the release |
+| Version to deploy | Version to deploy for the applicable release or phase |
+| Status | Status of the applicable release or phase:- Scheduled
- Active
- Inactive
- Paused
- Canceled
|
+| First deployment |- The date the deployment for the applicable release or phase will begin.
- Feature update policy for Windows 10 and later is created 24 hours prior to the first deployment date. The service automation runs twice a day at 4:00AM and 4:00PM (UTC).
- Not all devices within a phase will be offered the feature update on the same date when using gradual rollout.
|
+| Goal completion date | The date the devices within the release or phases are expected to finish updating. The completion date is calculated using the following formula:` + ( - 1) * Days in between groups (7) + Deadline for feature updates (5) + Grace Period (2)`
|
+
+#### About release and phase statuses
+
+##### Release statuses
+
+A release is made of one or more phases. The release status is based on the calculation and consolidation of each phase status.
+
+The release statuses are described in the following table:
+
+| Release status | Definition | Options |
+| ----- | ----- | ----- |
+| Scheduled | Release is scheduled and not all phases have yet created its Windows feature update policies |- Releases with the **Scheduled status** can't be canceled but can have its deployment cadence edited as not all phases have yet created its Windows feature update policies.
- Autopatch groups and its deployment rings that belong to a **Scheduled** release can't be assigned to another release.
|
+| Active | All phases in the release are active. This means all phases have reached their first deployment date, which created the Windows feature update policies. |- Release can be paused but can't be edited or canceled since the Windows feature update policy was already created for its phases.
- Autopatch groups and their deployment rings can be assigned to another release.
|
+| Inactive | All the Autopatch groups within the release have been assigned to a new release. As a result, the Windows feature update policies were unassigned from all phases from within the release. |- Release can be viewed as a historical record.
- Releases can't be deleted, edited, or canceled.
|
+| Paused | All phases in the release are paused. The release will remain paused until you resume it. | - Releases with Paused status can't be edited or canceled since the Windows feature update policy was already created for its phases.
- Release can be resumed.
|
+
+##### Phase statuses
+
+A phase is made of one or more Autopatch group deployment rings. Each phase reports its status to its release.
+
+> [!IMPORTANT]
+> The determining factor that makes a phase status transition from **Scheduled** to **Active** is when the service automatically creates the Windows feature update policy for each Autopatch group deployment ring. Additionally, the phase status transition from **Active** to **Inactive** occurs when Windows feature update policies are unassigned from the Autopatch groups that belong to a phase. This can happen when an Autopatch group and its deployment rings are re-used as part of a new release.
+
+| Phase status | Definition |
+| ----- | ----- |
+| Scheduled | The phase is scheduled but hasn’t reached its first deployment date yet. The Windows feature update policy hasn’t been created for the respective phase yet. |
+| Active | The first deployment date has been reached. The Windows feature update policy has been created for the respective phase. |
+| Inactive | All Autopatch groups within the phase were re-assigned to a new release. All Windows feature update policies were unassigned from the Autopatch groups. |
+| Paused | Phase is paused. You must resume the phase. |
+
+#### Details about Windows feature update policies
+
+Windows Autopatch creates one Windows feature update policy per phase using the following naming convention:
+
+`Windows Autopatch – DSS policy – – Phase `
+
+These policies can be viewed in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+
+The following table is an example of the Windows feature update policies that were created for phases within a release:
+
+| Policy name | Feature update version | Rollout options | First deployment date| Final deployment date availability | Day between groups | Support end date |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch - DSS Policy - My feature update release – Phase 1 | Windows 10 21H2 | Make update available as soon as possible | April 24, 2023 | April 24, 2023 | N/A | June 10, 2024 |
+| Windows Autopatch - DSS Policy - My feature update release – Phase 2 | Windows 10 21H2 | Make update available as soon as possible | June 26, 2023 | July 17, 2023 | 7 | June 10, 2024 |
+| Windows Autopatch - DSS Policy - My feature update release – Phase 3 | Windows 10 21H2 | Make update available as soon as possible | July 24, 2023 | August 14, 2023 | 7 | June 10, 2024 |
+| Windows Autopatch - DSS Policy - My feature update release – Phase 4 | Windows 10 21H2 | Make update available as soon as possible | August 28, 2023 | September 10, 2023 | 7 | June 10, 2024 |
+| Windows Autopatch - DSS Policy - My feature update release – Phase 5 | Windows 10 21H2 | Make update available as soon as possible | September 25, 2023 | October 16, 2023 | 7 | June 10, 2024 |
+
+## Create a custom release
+
+**To create a custom release:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release management** blade, select **Release schedule**, then **Windows feature updates**.
+1. In the **Windows feature updates** blade, select **New release**.
+1. In the **Basics** page:
+ 1. Enter a **Name** for the custom release.
+ 2. Select the **Version** to deploy.
+ 3. Enter a **Description** for the custom release.
+ 4. Select **Next**.
+1. In the **Autopatch groups** page, choose one or more existing Autopatch groups you want to include in the custom release, then select Next.
+1. You can't choose Autopatch groups that are already part of an existing custom release. Select **Autopatch groups assigned to other releases** to review existing assignments.
+1. In the Release phases page, review the number of auto-populated phases. You can Edit, Delete and Add phase based on your needs. Once you’re ready, select **Next**. **Before you proceed to the next step**, all deployment rings must be assigned to a phase, and all phases must have deployment rings assigned.
+1. In the **Release schedule** page, choose **First deployment date**, and the number of **Gradual rollout groups**, then select **Next**. **You can only select the next day**, not the current day, as the first deployment date. The service creates feature update policy for Windows 10 and later twice a day at 4:00AM and 4:00PM (UTC) and can’t guarantee that the release will start at the current day given the UTC variance across the globe.
+ 1. The **Goal completion date** only applies to the [Deadline-driven deployment cadence type](../operate/windows-autopatch-groups-windows-update.md#deadline-driven). The Deadline-drive deployment cadence type can be specified when you configure the Windows Updates settings during the Autopatch group creation/editing flow.
+ 2. Additionally, the formula for the goal completion date is ` + ( – 1) * Days in between groups (7) + Deadline for feature updates (5 days) + Grace Period (2 days)`.
+1. In the **Review + create** page, review all settings. Once you’re ready, select **Create**.
+
+## Edit a release
+
+> [!NOTE]
+> Only custom releases that have the **Scheduled** status can be edited. A release phase can only be edited prior to reaching its first deployment date. Additionally, you can only edit the deployment dates when editing a release.
+
+**To edit a custom release:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release schedule** tab, select **Windows feature updates**.
+1. In the **Windows feature updates** blade, select the **horizontal ellipses (…)** > Edit to customize your gradual rollout of your feature updates release, then select **Save**.
+ 1. Only the release schedule can be customized when using the edit function. You can't add or remove Autopatch groups or modify the phase order when editing a release.
+1. Select **Review + Create**.
+1. Select **Apply** to save your changes.
+
+## Pause and resume a release
+
+> [!CAUTION]
+> You should only pause and resume [Windows quality](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release) and [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md) on Windows Autopatch managed devices using the Windows Autopatch Release management blade. Do **not** use the Microsoft Intune end-user experience flows to pause or resume Windows Autopatch managed devices.
+
+> [!IMPORTANT]
+> Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its device management solution and that's the average frequency Windows devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates. For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).
+
+**To pause or resume a release:**
+
+> [!NOTE]
+> If you've paused an update, the specified release will have the **Paused** status. The Windows Autopatch service can't overwrite IT admin's pause. You must select **Resume** to resume the update. The **Paused by Service Pause** status **only** applies to Windows quality updates. Windows Autopatch doesn't pause Windows feature updates on your behalf.
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release schedule** tab, select **Windows feature updates**.
+1. In the **Windows feature updates** blade, select the **horizontal ellipses (…)** > **Pause** or **Resume** to pause or resume your feature updates release.
+1. Select a reason from the dropdown menu.
+1. Optional. Enter details about why you're pausing or resuming the selected update.
+1. If you're resuming an update, you can select one or more deployment rings.
+1. Select **Pause deployment** or **Resume deployment** to save your changes.
+
+## Cancel a release
+
+> [!IMPORTANT]
+> You can only cancel a release under the Scheduled status. You cannot cancel a release under the **Active**, **Inactive** or **Paused** statuses.
+
+**To cancel a release:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release schedule** tab, select **Windows feature updates**.
+1. In the **Windows feature updates** blade, select the **horizontal ellipses (…)** > **Cancel** to cancel your feature updates release.
+1. Select a reason for cancellation from the dropdown menu.
+1. Optional. Enter details about why you're pausing or resuming the selected update.
+1. Select **Cancel deployment** to save your changes.
+
+## Roll back a release
+
+> [!CAUTION]
+> Do **not** use Microsoft Intune’s end-user flows to rollback Windows feature update deployments for Windows Autopatch managed devices. If you need assistance with rolling back deployments, [submit a support request](../operate/windows-autopatch-support-request.md).
+
+Windows Autopatch **doesn’t** support the rollback of Windows feature updates through its end-user experience flows.
+
+## Contact support
+
+If you’re experiencing issues related to Windows feature update deployments, [submit a support request](../operate/windows-autopatch-support-request.md).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md
new file mode 100644
index 0000000000..e6730c53fb
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md
@@ -0,0 +1,61 @@
+---
+title: Software update management for Autopatch groups
+description: This article provides an overview of how updates are handled with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: overview
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Software update management: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Keeping your devices up to date is a balance of speed and stability. Windows Autopatch connects all devices to a modern cloud-based infrastructure to manage updates on your behalf.
+
+## Software update workloads
+
+| Software update workload | Description |
+| ----- | ----- |
+| Windows quality update | Windows Autopatch uses four deployment rings to manage Windows quality updates. For more detailed information, see:- [Windows Autopatch groups experience](../operate/windows-autopatch-groups-windows-quality-update-overview.md)
- [Classic experience](../operate/windows-autopatch-windows-quality-update-overview.md) |
+| Windows feature update | Windows Autopatch uses four deployment rings to manage Windows feature updates. For more detailed information, see:
- [Windows Autopatch groups experience](windows-autopatch-groups-windows-feature-update-overview.md)
- [Classic experience](windows-autopatch-windows-feature-update-overview.md)
|
+| Anti-virus definition | Updated with each scan. |
+| Microsoft 365 Apps for enterprise | For more information, see [Microsoft 365 Apps for enterprise](windows-autopatch-microsoft-365-apps-enterprise.md). This software update workload uses the classic experience. |
+| Microsoft Edge | For more information, see [Microsoft Edge](../operate/windows-autopatch-edge.md). This software update workload uses the classic experience. |
+| Microsoft Teams | For more information, see [Microsoft Teams](../operate/windows-autopatch-teams.md). This software update workload uses the classic experience. |
+
+## Autopatch groups
+
+Autopatch groups help Microsoft Cloud-Managed services meet all organizations where they are at in their update management journey.
+
+Autopatch groups is a logical container that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as Windows Update rings and feature update policies, together.
+
+For more information on key benefits and how to use Autopatch groups, see [Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md).
+
+## Windows quality updates
+
+Windows Autopatch deploys the [Monthly security update releases](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-quality-updates-primer/ba-p/2569385) that are released on the second Tuesday of each month.
+
+To release updates to devices in a gradual manner, Windows Autopatch deploys a set of mobile device management (MDM) policies to each update deployment ring to control the rollout. For more information, see [Windows quality updates overview](../operate/windows-autopatch-groups-windows-quality-update-overview.md).
+
+## Windows feature updates
+
+You’re in control of telling Windows Autopatch when your organization is ready to move to the next Windows OS version.
+
+The Window feature update release management experience makes it easier and less expensive for you to keep your Windows devices up to date. You can focus on running your core businesses while Windows Autopatch runs update management on your behalf.
+
+For more information, see [Windows feature updates overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).
+
+## Reports
+
+Using [Windows quality and feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md), you can monitor and remediate Windows Autopatch managed devices that are Not up to Date and resolve any device alerts to bring Windows Autopatch managed devices back into compliance.
+
+## Policy health and remediation
+
+Windows Autopatch deploys Intune policies for Windows quality and feature update management. Windows Update policies must remain healthy for devices to receive Windows updates and stay up to date. We continuously monitor the health of the policies and raise alerts and provide remediation actions. For more information, see [Policy health and remediation](../operate/windows-autopatch-policy-health-and-remediation.md) and [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md
new file mode 100644
index 0000000000..6e84d0f62b
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md
@@ -0,0 +1,160 @@
+---
+title: Windows feature updates overview with Autopatch groups
+description: This article explains how Windows feature updates are managed with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Windows feature updates overview: Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Microsoft provides robust mobile device management (MDM) solutions such as Microsoft Intune, Windows Update for Business, Configuration Manager etc. However, the administration of these solutions to keep Windows devices up to date with the latest Windows feature releases rests on your organization’s IT admins. The Windows feature update process is considered one of the most expensive and time consuming tasks for IT since it requires incremental rollout and validation.
+
+Windows feature updates consist of:
+
+- Keeping Windows devices protected against behavioral issues.
+- Providing new features to boost end-user productivity.
+
+Windows Autopatch makes it easier and less expensive for you to keep your Windows devices up to date. You can focus on running your core businesses while Windows Autopatch runs update management on your behalf.
+
+## Service level objective
+
+Windows Autopatch’s service level objective for Windows feature updates aims to keep **95%** of eligible devices on the targeted Windows OS version [currently serviced](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) for its default and global releases maintained by the service, and custom releases created and managed by you.
+
+## Device eligibility criteria
+
+Windows Autopatch’s device eligibility criteria for Windows feature updates aligns with [Windows Update for Business and Microsoft Intune’s device eligibility criteria](/mem/intune/protect/windows-10-feature-updates#prerequisites).
+
+> [!IMPORTANT]
+> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC.
+
+## Key benefits
+
+- A release is made of one or more deployment phases and contains the required OS version to be gradually rolled out throughout its deployment phases.
+- A phase (deployment phase) is made of one or more Autopatch group deployment rings. A phase:
+ - Works as an additional layer of deployment cadence settings that can be defined by IT admins (only for Windows feature updates) on top of Autopatch group deployment rings (Windows update rings policies).
+ - Deploys Windows feature updates across one or more Autopatch groups.
+- There are three types of releases:
+ - Default
+ - Global
+ - Custom
+
+### Default release
+
+Windows Autopatch’s default Windows feature update release is a service-driven release that enforces the minimum Windows OS version currently serviced by the Windows servicing channels for the deployment rings in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group).
+
+> [!TIP]
+> Windows Autopatch allows you to [create custom Windows feature update releases](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#create-a-custom-release).
+
+When devices are registered by manually adding them to the Windows Autopatch Device Registration Azure AD assigned group, devices are assigned to deployment rings as part of the default Autopatch group. Each deployment ring has its own Windows feature update policy assigned to them. This is intended to minimize unexpected Windows OS upgrades once new devices register with the service.
+
+The policies:
+
+- Contain the minimum Windows 10 version currently serviced by the [Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2). The current minimum Windows OS version is **Windows 10 21H2**.
+- Set a bare minimum Windows OS version required by the service once devices are registered with the service.
+
+If the device is registered with Windows Autopatch, and the device is:
+
+- Below the service's currently targeted Windows feature update, that device will be automatically upgraded to the service's target version when the device meets the [device eligibility criteria](#device-eligibility-criteria).
+- On, or above the currently targeted Windows feature update version, there won't be any Windows OS upgrades available to that device.
+
+#### Policy configuration for the default release
+
+If your tenant is enrolled with Windows Autopatch, you can see the following default policies created by the service in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431):
+
+| Policy name | Feature update version | Rollout options | First deployment ring availability | Final deployment ring availability | Day between deployment rings | Support end date |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch – DSS Policy [Test] | Windows 10 21H2 | Make update available as soon as possible | May 9, 2023 | N/A | N/A | June 10, 2024 |
+| Windows Autopatch – DSS Policy [Ring1] | Windows 10 21H2 | Make update available as soon as possible | May 16, 2023 | N/A | N/A | June 10, 2024 |
+| Windows Autopatch – DSS Policy [Ring2] | Windows 10 21H2 | Make update available as soon as possible | May 23, 2023 | N/A | N/A | June 10, 2024 |
+| Windows Autopatch – DSS Policy [Ring3] | Windows 10 21H2 | Make update available as soon as possible | May 30, 2023 | N/A | N/A | June 10, 2024 |
+
+> [!NOTE]
+> Gradual rollout settings aren't configured in the default Windows Update feature policy. If the date of the final group availability is changed to a past date, all remaining devices are offered the update as soon as possible. For more information, see [rollout options for Windows Updates in Microsoft Intune](/mem/intune/protect/windows-update-rollout-options#make-updates-available-gradually).
+
+### Global release
+
+Windows Autopatch’s global Windows feature update release is a service-driven release. Like the [default release](#default-release), the Global release enforces the [minimum Windows OS version currently serviced by the Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2).
+
+There are two scenarios that the Global release is used:
+
+| Scenario | Description |
+| ----- | ----- |
+| Scenario #1 | You assign Azure AD groups to be used with the deployment ring (Last) or you add additional deployment rings when you customize the [Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group).A global Windows feature update policy is automatically assigned behind the scenes to the newly added deployment rings or when you assigned Azure AD groups to the deployment ring (Last) in the Default Autopatch group.
|
+| Scenario #2 | You create new [Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group).The global Windows feature policy is automatically assigned behind the scenes to all deployment rings as part of the Custom Autopatch groups you create.
|
+
+#### Policy configuration values
+
+See the following table on how Windows Autopatch configures the values for its global Windows feature update policy. If your tenant is enrolled with Windows Autopatch, you can see the following default policies created by the service in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431):
+
+| Policy name | Feature update version | Rollout options | First deployment ring availability | Final deployment ring availability | Day between deployment rings | Support end date |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch – Global DSS Policy [Test] | Windows 10 21H2 | Make update available as soon as possible | N/A | N/A | N/A | June 10, 2024 |
+
+> [!NOTE]
+> Gradual rollout settings aren't configured in the default Windows Update feature policy. If the date of the final group availability is changed to be a past date, all remaining devices are offered the update as soon as possible. For more information, see [rollout options for Windows Updates in Microsoft Intune](/mem/intune/protect/windows-update-rollout-options#make-updates-available-gradually).
+
+### Differences between the default and global Windows feature update policies
+
+> [!IMPORTANT]
+> Once you create a custom Windows feature update release, both the global and the default Windows feature update policies are unassigned from Autopatch group’s deployment rings behind the scenes.
+
+The differences in between the global and the default Windows feature update policy values are:
+
+| Default Windows feature update policy | Global Windows feature update policy |
+| ----- | ----- |
+| - Set by default with the Default Autopatch group and assigned to Test, Ring1, Ring2, Ring3. The default policy isn't automatically assigned to the Last ring in the Default Autopatch group.
- The Windows Autopatch service keeps its minimum Windows OS version updated following the recommendation of minimum Windows OS version [currently serviced by the Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2).
| - Set by default and assigned to all new deployment rings added as part of the Default Autopatch group customization.
- Set by default and assigned to all deployment rings created as part of Custom Autopatch groups.
+
+### Custom release
+
+A custom release is the release that you create to tell Windows Autopatch how you want the service to manage Windows OS upgrades on your behalf.
+
+Custom releases gives you flexibility to do Windows OS upgrades on your pace, but still relying on Windows Autopatch to give you insights of how your OS upgrades are going and additional deployment controls through the Windows feature updates release management experience.
+
+When a custom release is created and assigned to Autopatch groups, either the default or global releases are unassigned to avoid feature update policy for Windows 10 and later conflicts.
+
+For more information on how to create a custom release, see [Manage Windows feature update release](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#create-a-custom-release).
+
+### About Windows Update rings policies
+
+Feature update policies work with Windows Update rings policies. Windows Update rings policies are created for each deployment ring for the [Default or a Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#key-concepts) based on the deployment settings you define. The policy name convention is `Windows Autopatch Update Policy – – `.
+
+The following table details the default Windows Update rings policy values that affect either the default or custom Windows feature updates releases:
+
+| Policy name | Azure AD group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline |
+| ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- |
+| Windows Autopatch Update Policy - default - Test | Windows Autopatch - Test | 0 | 0 | 30 | 0 | 5 | 0 | Yes |
+| Windows Autopatch Update Policy - default - Ring1 | Windows Autopatch - Ring1 | 1 | 0 | 30 | 2 | 5 |2 | Yes |
+| Windows Autopatch Update Policy - default - Ring2 | Windows Autopatch - Ring2 | 6 | 0 | 30 | 2 | 5 | 2 | Yes |
+| Windows Autopatch Update Policy - default - Ring3 | Windows Autopatch - Ring3 | 9 | 0 | 30 | 5 | 5 | 2 | Yes |
+| Windows Autopatch Update Policy - default - Last | Windows Autopatch - Last | 11 | 0 | 30 | 3 | 5 | 2 | Yes |
+
+> [!IMPORTANT]
+> When you create a custom Windows feature update release, new Windows feature update policies are:- Created corresponding to the settings you defined while creating the release.
- Assigned to the Autopatch group’s deployment rings you select to be included in the release.
+
+## Common ways to manage releases
+
+### Use case #1
+
+| Scenario | Solution |
+| ----- | ----- |
+| You’re working as the IT admin at Contoso Ltd., and you need to gradually rollout of Windows 11’s latest version to several business units across your organization. | Custom Windows feature update releases deliver OS upgrades horizontally, through phases, to one or more Autopatch groups.
Phases:- Set your organization’s deployment cadence.
- Work like deployment rings on top of Autopatch group’s deployment rings. Phases group one or more deployment rings across one or more Autopatch groups.
See the following visual for a representation of Phases with custom releases. |
+
+:::image type="content" source="../media/autopatch-groups-manage-feature-release-case-1.png" alt-text="Manage Windows feature update release use case one" lightbox="../media/autopatch-groups-manage-feature-release-case-1.png":::
+
+### Use case #2
+
+| Scenario | Solution |
+| ----- | ----- |
+| You’re working as the IT admin at Contoso Ltd. and your organization isn’t ready to upgrade its devices to either Windows 11 or the newest Windows 10 OS versions due to conflicting project priorities within your organization.However, you want to keep Windows Autopatch managed devices supported and receiving monthly updates that are critical to security and the health of the Windows ecosystem.
| Default Windows feature update releases deliver the minimum Windows OS upgrade vertically to each Windows Autopatch group (either [Default](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) or [Custom](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)). The Default Windows Autopatch group is pre-configured with the [default Windows feature update release](#default-release) and no additional configuration is required from IT admins as Autopatch manages the default release on your behalf.If you decide to edit the default Windows Autopatch group to add additional deployment rings, these rings receive a [global Windows feature update policy](#global-release) set to offer the minimum Windows OS version [currently serviced](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) to devices. Every custom Autopatch group you create gets a [global Windows feature update policy](#global-release) that enforces the minimum Windows OS version [currently serviced](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2).
See the following visual for a representation of default releases.
|
+
+:::image type="content" source="../media/autopatch-groups-manage-feature-release-case-2.png" alt-text="Manage Windows feature update release use case two" lightbox="../media/autopatch-groups-manage-feature-release-case-2.png":::
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md
new file mode 100644
index 0000000000..fc177682b7
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md
@@ -0,0 +1,76 @@
+---
+title: Feature update status report
+description: Provides a per device view of the current Windows OS upgrade status for all devices registered with Windows Autopatch.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Feature update status report (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+The Feature update status report provides a per device view of the current Windows OS upgrade status for all devices registered with Windows Autopatch.
+
+**To view the Feature update status report:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Reports** > **Windows Autopatch** > **Windows feature updates (preview)**.
+1. Select the **Reports** tab.
+1. Select **Feature update status**.
+
+## Report information
+
+### Default columns
+
+The following information is available as default columns in the Feature update status report:
+
+| Column name | Description |
+| ----- | ----- |
+| Device name | The name of the device. |
+| Deployment ring | The currently assigned Windows Autopatch deployment ring for the device. |
+| Update status | The current update status for the device. For more information, see [Windows feature update statuses](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-and-feature-update-statuses). |
+| Pause status | The current pause status whether Customer or Service initiated. For more information, see [Pause and resume a release](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#pause-and-resume-a-release). |
+| Current version | The current version or build number of the device. For more information, see [Windows Versions](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2). |
+| Readiness | The device readiness evaluation status. For more information, see [Post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md). |
+| Alerts | The summary of any alerts affecting the device. For more information, see [Device alerts](../operate/windows-autopatch-device-alerts.md). |
+
+### Optional columns
+
+The following information is available as optional columns in the Feature update status report:
+
+| Column name | Description |
+| ----- | ----- |
+| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device |
+| Serial number | The current Intune recorded serial number for the device |
+| Intune last check in time | The last time the device checked in to Intune |
+| Service State | The Service State provided from Windows Update |
+| Service Substate | The Service Substate provided from Windows Update |
+| Client State | The Client State provided from Windows Update |
+| Client Substate | The Client Substate provided from Windows Update |
+| Servicing Channel | The Servicing Channel provided from Windows Update |
+| User Last Logged On | The last user who logged on as reported from Intune |
+| Primary User UPN | The Primary User UPN as reported from Intune |
+| Hex Error Code | The hex error provided from Windows Update |
+
+> [!NOTE]
+> The Service State, Service Substate, Client State, Client Substate, Servicing Channel, and Hex Error Code columns may not display any values. These columns are supplemental and might not display for all devices
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Search | Use to search by device name, Azure AD device ID or serial number |
+| Sort | Select the **column headings** to sort the report data in ascending and descending order. |
+| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. |
+| Filter | Select either the **Add filters** or at the top of the report to filter the results. |
+| Columns | Select a column to add or remove the column from the report. |
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md
new file mode 100644
index 0000000000..63c6483b4d
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md
@@ -0,0 +1,52 @@
+---
+title: Windows feature update summary dashboard
+description: Provides a broader view of the current Windows OS upgrade status for all devices registered with Windows Autopatch.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Windows feature update summary dashboard (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+The summary dashboard provides a broader view of the current Windows OS update status for all devices registered with Windows Autopatch.
+
+The first part of the summary dashboard provides you with an all-devices trend report where you can follow the deployment trends within your organization. You can view if updates were successfully installed, failing, in progress, not ready or have their Windows feature update paused.
+
+**To view a generated summary dashboard for your Windows feature update deployments:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Reports** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Windows feature updates (preview)**.
+
+## Report information
+
+The following information is available in the summary dashboard:
+
+| Column name | Description |
+| ----- | ----- |
+| Release | The release name and its phases. For more information, see [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md). |
+| Version to deploy | The version being deployed to the device based on which Windows feature update release the device is assigned. |
+| Device count | Total device count per Autopatch group or deployment ring. |
+| Up to date | Total device count reporting a status of Up to date. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
+| Not up to Date | Total device count reporting a status of Not Up to date. For more information, see [Not Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+| In progress | Total device counts reporting the In progress status. For more information, see [In progress](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-sub-statuses). |
+| Paused | Total device count reporting the status of the pause whether it’s Service or Customer initiated. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
+| Not ready | Total device count reporting the Not ready status. For more information, see [Not ready](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Refresh | The option to **Refresh** the summary dashboard is available at the top of the page. This process will ensure that the summary dashboard view is updated to the latest available dataset from within the last 24-hour period. |
+| Summary links | Each column represents the summary of included devices. Select the hyperlinked number to produce a filtered report in a new browser tab. |
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md
new file mode 100644
index 0000000000..d6c6955600
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-trending-report.md
@@ -0,0 +1,42 @@
+---
+title: Feature update trending report
+description: Provides a visual representation of Windows OS upgrade trends for all devices over the last 90 days.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Feature update trending report (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Windows Autopatch provides a visual representation of Windows OS upgrade trends for all devices over the last 90 days.
+
+**To view the Feature update trending report:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Reports** > **Windows Autopatch** > **Windows feature updates (public preview)**.
+1. Select the **Reports** tab.
+1. Select **Feature update trending**.
+
+> [!NOTE]
+> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page.
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. |
+| By percentage | Select **by percentage** to show your trending graphs and indicators by percentage. |
+| By device count | Select **by device count** to show your trending graphs and indicators by numeric value. |
+
+For a description of the displayed device status trends, see [Windows feature update statuses](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-and-feature-update-statuses).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md
new file mode 100644
index 0000000000..8f10b41042
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md
@@ -0,0 +1,109 @@
+---
+title: Windows quality and feature update reports overview with Windows Autopatch Groups experience
+description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Windows quality and feature update reports overview: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+## Windows quality reports
+
+The Windows quality reports provide you with information about:
+
+Quality update device readiness
+Device update health
+Device update alerts
+Together, these reports provide insight into the quality update state and compliance of Windows devices that are enrolled into Windows Autopatch.
+
+The Windows quality report types are organized into the following focus areas:
+
+| Focus area | Description |
+| ----- | ----- |
+| Organizational | The [Summary dashboard](../operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md) provide the current update status summary for all devices.The [Quality update status report](../operate/windows-autopatch-groups-windows-quality-update-status-report.md) provides the current update status of all devices at the device level. |
+| Device trends | The [Quality update trending report](../operate/windows-autopatch-groups-windows-quality-update-trending-report.md) provides the update status trend of all devices over the last 90 days. |
+
+## Windows feature update reports
+
+The Windows feature update reports monitor the health and activity of your deployments and help you understand if your devices are maintaining update compliance targets.
+
+If update deployments aren’t successful, Windows Autopatch provides information on update deployment failures and who needs to remediate. Certain update deployment failures might require either Windows Autopatch to act on your behalf or you to fix the issue.
+
+The Windows feature update report types are organized into the following focus areas:
+
+| Focus area | Description |
+| ----- | ----- |
+| Organizational | The [Summary dashboard](../operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md) provides a broader view of the current Windows OS upgrade status for all devices registered with Windows Autopatch. |
+| Operational | The [Feature update status report](../operate/windows-autopatch-groups-windows-feature-update-status-report.md) provides a per device view of the current Windows OS update status for all devices registered with Windows Autopatch. |
+| Device trends | The [Quality update trending report](../operate/windows-autopatch-groups-windows-feature-update-trending-report.md) provides a visual representation of Windows OS upgrade trends for all devices over the last 90 days. |
+
+## Who can access the reports?
+
+Users with the following permissions can access the reports:
+
+- Global Administrator
+- Intune Service Administrator
+- Global Reader
+- Services Support Administrator
+
+## About data latency
+
+The data source for these reports is Windows [diagnostic data](../overview/windows-autopatch-privacy.md#microsoft-windows-1011-diagnostic-data). The data typically uploads from enrolled devices once per day. Then, the data is processed in batches before being made available in Windows Autopatch. The maximum end-to-end latency is approximately 48 hours.
+
+## Windows quality and feature update statuses
+
+The following statuses are used throughout the Windows Autopatch reporting suite to describe the quality update status for devices:
+
+- [Up to Date devices](#up-to-date-devices)
+- [Not up to Date devices](#not-up-to-date-devices)
+- [Not Ready devices](#not-ready-devices)
+
+Each status has its own set of sub statuses to further describe the status.
+
+### Up to Date devices
+
+Up to date devices are devices that meet all of the following prerequisites:
+
+- [Prerequisites](../prepare/windows-autopatch-prerequisites.md)
+- [Prerequisites for device registration](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration)
+- [Windows quality and feature update device readiness](../deploy/windows-autopatch-post-reg-readiness-checks.md)
+- [Post-device readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md)
+- Have applied the current monthly cumulative updates
+
+> [!NOTE]
+> [Up to Date devices](#up-to-date-devices) will remain with the **In Progress** status for the 21-day service level objective period until the device either applies the current monthly cumulative update or receives an [alert](../operate/windows-autopatch-device-alerts.md). If the device receives an alert, the device’s status will change to [Not up to Date](#not-up-to-date-devices).
+
+#### Up to Date sub statuses
+
+| Sub status | Description |
+| ----- | ----- |
+| In Progress | Devices are currently installing the latest [quality update](../operate/windows-autopatch-groups-windows-quality-update-overview.md#release-schedule) or [feature update](../operate/windows-autopatch-groups-windows-feature-update-overview.md#default-release) deployed through the Windows Autopatch release schedule. |
+| Paused | Devices that are currently paused due to a Windows Autopatch or customer-initiated Release management pause. For more information, see pausing and resuming a [Windows quality update](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release) or [Windows feature update](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#pause-and-resume-a-release). |
+
+### Not up to Date devices
+
+Not Up to Date means a device isn’t up to date when the:
+
+- Quality or feature update is out of date, or the device is on the previous update.
+- Device is more than 21 days overdue from the last release.
+- Device has an [alert](../operate/windows-autopatch-device-alerts.md) resulting in an error and action must be taken.
+
+### Not Ready devices
+
+Not Ready refers to the responsibility of the designated IT administrator to carry out the appropriate action to resolve the reported device sub status.
+
+Within each 24-hour reporting period, devices that are Not Ready are reevaluated using the [Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
+
+## Data export
+
+Select **Export devices** to export data for each report type. Only selected columns will be exported.
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md
new file mode 100644
index 0000000000..cd1653f964
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-communications.md
@@ -0,0 +1,69 @@
+---
+title: Windows quality update communications for Autopatch groups
+description: This article explains Windows quality update communications for Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: hathind
+---
+
+# Windows quality update communications: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.
The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+
+There are three categories of communication that are sent out during a Windows quality and feature update:
+
+- [Standard communications](#standard-communications)
+- [Communications during release](#communications-during-release)
+- [Incident communications](#incident-communications)
+
+Communications are posted to, as appropriate for the type of communication, to the:
+
+- Message center
+- Service health dashboard
+- Windows Autopatch messages section of the Microsoft Intune admin center
+
+:::image type="content" source="../media/update-communications.png" alt-text="Update communications timeline" lightbox="../media/update-communications.png":::
+
+## Standard communications
+
+| Communication | Location | Timing | Description |
+| ----- | ----- | ----- | ----- |
+| Release schedule | - Messages blade
- Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)
| At least seven days prior to the second Tuesday of the month| Notification of the planned release window for each ring. |
+| Release start | Same as release schedule | The second Tuesday of every month. | Notification that the update is now being released into your environment. |
+| Release summary | Same as release schedule | The fourth Tuesday of every month. | Informs you of the percentage of eligible devices that were patched during the release. |
+
+### Opt out of receiving emails for standard communications
+
+> [!IMPORTANT]
+> This feature is in **public preview**. This feature is being actively developed and may not be complete. You can test and use these features in production environments and provide feedback.
+
+If you don't want to receive standard communications for Windows Updates releases via email, you can choose to opt out.
+
+**To opt out of receiving emails for standard communications:**
+
+1. Go to the **[Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)**.
+2. Go to **Windows Autopatch** > **Tenant administration** > select **Admin contacts**.
+3. Select the admin contact you want to opt out for.
+4. Select **Edit Contact**.
+5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane.
+6. Select **Save** to apply the changes.
+
+## Communications during release
+
+The most common type of communication during a release is a customer advisory. Customer advisories are posted to both Message center and the Messages blade of the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) shortly after Autopatch becomes aware of the new information.
+
+There are some circumstances where Autopatch will need to change the release schedule based on new information.
+
+For example, new threat intelligence may require us to expedite a release, or we may pause due to user experience concerns. If the schedule of a quality update is changed, paused, resumed, or expedited, we'll inform you as quickly as possible so that you can adapt to the new information.
+
+## Incident communications
+
+Despite the best intentions, every service should plan for failure and success. When there's an incident, timely and transparent communication is key to building and maintaining your trust. If insufficient numbers of devices have been updated to meet the service level objective, devices will experience an interruption to productivity, and an incident will be raised. Microsoft will update the status of the incident at least once every 24 hours.
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md
new file mode 100644
index 0000000000..25705531f4
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md
@@ -0,0 +1,69 @@
+---
+title: Windows quality update end user experience for Autopatch groups
+description: This article explains the Windows quality update end user experience using the Autopatch groups exp
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Windows quality update end user experience: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+## User notifications
+
+In this section we'll review what an end user would see in the following three scenarios:
+
+1. Typical update experience
+2. Quality update deadline forces an update
+3. Quality update grace period
+
+> [!NOTE]
+> The "It's almost time to restart" and "Your organization requires your device to restart" notifications won't disappear until the user interacts with the notification.
+
+### Typical update experience
+
+The Windows quality update is published and devices in the Broad ring have a deferral period of nine days. Devices will wait nine days before downloading the latest quality update.
+
+Once the deferral period has passed, the device will download the update and notify the end user that updates are ready to install. The end user can either:
+
+- Restart immediately to install the updates
+- Schedule the installation, or
+- Snooze the device will attempt to install outside of [active hours](/windows/client-management/mdm/policy-csp-update#activehoursstart).
+
+In the following example, the user schedules the restart and is notified 15 minutes prior to the scheduled restart time. The user can reschedule, if necessary, but isn't able to reschedule past the deadline.
+
+:::image type="content" source="../media/windows-quality-typical-update-experience.png" alt-text="Typical windows quality update experience" lightbox="../media/windows-quality-typical-update-experience.png":::
+
+### Quality update deadline forces an update
+
+In the following example, the user:
+
+- Ignores the notification and selects snooze.
+- Further notifications are received, which the user ignores.
+- The device is unable to install the updates outside of active hours.
+
+The deadline specified in the update policy is five days. Therefore, once this deadline is passed, the device will ignore the [active hours](/windows/client-management/mdm/policy-csp-update#activehoursstart) and force a restart to complete the update installation. The user will receive a 15-minute warning, after which, the device will install the update and restart.
+
+:::image type="content" source="../media/windows-quality-force-update.png" alt-text="Force Windows quality update" lightbox="../media/windows-quality-force-update.png":::
+
+### Quality update grace period
+
+In the following example, the user is on holiday and the device is offline beyond the quality update deadline. The user then returns to work and the device is turned back on.
+
+Since the deadline has already passed, the device is granted a two-day grace period to install the update and restart. The user will be notified of a pending installation and given options to choose from. Once the two-day grace period has expired, the user is forced to restart with a 15-minute warning notification.
+
+:::image type="content" source="../media/windows-quality-update-grace-period.png" alt-text="Windows quality update grace period" lightbox="../media/windows-quality-update-grace-period.png":::
+
+## Minimize user disruption due to updates
+
+Windows Autopatch understands the importance of not disrupting end users but also updating the devices quickly. To achieve this goal, updates are automatically downloaded and installed at an optimal time determined by the device. By default, [Active hours](/windows/client-management/mdm/policy-csp-update#activehoursstart) are configured dynamically based on device usage patterns. Device restarts occur outside of active hours until the deadline is reached.
+
+Windows Autopatch understands the importance of not disrupting critical devices but also updating the devices quickly. If you wish to configure a specific installation time or [Active hours](/windows/client-management/mdm/policy-csp-update#activehoursstart), use the [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md), and select the [**ScheduledInstall**](../operate/windows-autopatch-groups-windows-update.md#scheduled-install) option. Using this option removes the deadline enforced for a device restart. Devices with this configuration will also **not** be counted towards the [service level objective](../operate/windows-autopatch-groups-windows-quality-update-overview.md#service-level-objective).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md
new file mode 100644
index 0000000000..559e317784
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-overview.md
@@ -0,0 +1,133 @@
+---
+title: Windows quality updates overview with Autopatch groups experience
+description: This article explains how Windows quality updates are managed with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Windows quality updates: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Windows Autopatch deploys the [Monthly security update releases](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-quality-updates-primer/ba-p/2569385) that are released on the second Tuesday of each month.
+
+To release updates to devices in a gradual manner, Windows Autopatch deploys a set of mobile device management (MDM) policies to each update deployment ring to control the rollout. There are three primary policies that are used to control Windows quality updates:
+
+| Policy | Description |
+| ----- | ----- |
+| [Deferrals](/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays) | Deferral policies delay the time the update is offered to the device by a specific number of days. The "offer" date for Windows quality updates is equal to the number of days specified in the deferral policy after the second Tuesday of each month. |
+| [Deadlines](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours. After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. The deadline for a specific device is set to be the specified number of days after the update is offered to the device. |
+| [Grace periods](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod) | This policy specifies a minimum number of days after an update is downloaded until the device is automatically restarted. This policy overrides the deadline policy so that if a user comes back from vacation, it prevents the device from forcing a restart to complete the update as soon as it comes online. |
+
+For devices in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group), Windows Autopatch configures these policies differently across deployment rings to gradually release the update. Devices in the Test ring receive changes first and devices in the Last ring receive changes last. For more information about the Test and Last deployment rings, see [About the Test and Last deployment rings in Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-the-test-and-last-deployment-rings). With Windows Autopatch groups you can also customize the [Default Deployment Group’s deployment ring composition](../deploy/windows-autopatch-groups-overview.md#default-deployment-ring-composition) to add and/or remove deployment rings and can customize the update deployment cadences for each deployment ring. To learn more about customizing Windows Quality updates deployment cadence, see [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md).
+
+> [!IMPORTANT]
+> Deploying deferral, deadline, or grace period policies which conflict with Autopatch's policies will cause a device to be considered ineligible for management, it will still receive policies from Windows Autopatch that are not in conflict, but may not function as designed. These devices will be marked as ineligible in our device reporting and will not count towards our [service level objective](#service-level-objective).
+
+## Service level objective
+
+Windows Autopatch aims to keep at least 95% of eligible devices on the latest Windows quality update 21 days after release. Note that devices that have cadence type set to Schedule install won't be eligible for Windows quality update SLO. For more information about the Schedule Install cadence type, see [Deployment cadence types](../operate/windows-autopatch-groups-windows-update.md#deployment-cadence).
+
+> [!IMPORTANT]
+> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC.
+
+## Release management
+
+> [!NOTE]
+> To access the Release management blade, you must have the correct [role-based access control](../deploy/windows-autopatch-register-devices.md#built-in-roles-required-for-device-registration).
+
+In the Release management blade, you can:
+
+- Track the [Windows quality update schedule](#release-schedule).
+- [Turn off expedited Windows quality updates](#turn-off-service-driven-expedited-quality-update-releases).
+- Review release announcements and knowledge based articles for regular and [Out of Band (OOB) Windows quality updates](#out-of-band-releases).
+
+### Release schedule
+
+For each [deployment ring](windows-autopatch-update-management.md#windows-autopatch-deployment-rings), the **Release schedule** tab contains:
+
+- The status of the update. Releases will appear as **Active**. The update schedule is based on the values of the [Windows 10 Update Ring policies](/mem/intune/protect/windows-update-for-business-configure), which have been configured on your behalf.
+- The date the update is available.
+- The target completion date of the update.
+- In the **Release schedule** tab, you can either [**Pause** and/or **Resume**](#pause-and-resume-a-release) a Windows quality update release.
+
+### Expedited releases
+
+Threat and vulnerability information about a new revision of Windows becomes available on the second Tuesday of each month. Windows Autopatch assesses that information shortly afterwards. If the service determines that it's critical to security, it may be expedited. The quality update is also evaluated on an ongoing basis throughout the release and Windows Autopatch may choose to expedite at any time during the release.
+
+When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update quickly.
+
+| Release type | Group | Deferral | Deadline | Grace period |
+| ----- | ----- | ----- | ----- | ----- |
+| Expedited release | All devices | 0 | 1 | 1 |
+
+#### Turn off service-driven expedited quality update releases
+
+Windows Autopatch provides the option to turn off of service-driven expedited quality updates.
+
+By default, the service expedites quality updates as needed. For those organizations seeking greater control, you can disable expedited quality updates for Windows Autopatch-enrolled devices using Microsoft Intune.
+
+**To turn off service-driven expedited quality updates:**
+
+1. Go to **[Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Devices**.
+2. Under **Windows Autopatch** > **Release management**, go to the **Release settings** tab and turn off the **Expedited quality updates** setting.
+
+> [!NOTE]
+> Windows Autopatch doesn't allow customers to request expedited releases.
+
+### Out of Band releases
+
+Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule.
+
+For the deployment rings that have passed quality updates deferral date, the OOB release schedule will be expedited and deployed on the same day. For the deployment rings that have deferral upcoming, OOBs will be released as per the set deferral dates.
+
+**To view deployed Out of Band quality updates:**
+
+1. Go to [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Devices** > **Windows Autopatch** > **Release management**.
+2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and regular Windows quality updates. You can also view the schedules for OOB update releases in the Release Schedule tab.
+
+> [!NOTE]
+> Announcements abd OOB update schedules will be **removed** from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a deployment ring, the OOB updates will also be paused.
+
+### Pause and resume a release
+
+> [!CAUTION]
+> You should only pause and resume [Windows quality](#pause-and-resume-a-release) and [Windows feature updates](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#pause-and-resume-a-release) on Windows Autopatch managed devices using the Windows Autopatch Release management blade. Do **not** use the Microsoft Intune end-user experience flows to pause or resume Windows Autopatch managed devices.
+
+The service-level pause is driven by the various software update deployment-related signals Windows Autopatch receives from Windows Update for Business, and several other product groups within Microsoft.
+
+If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-groups-windows-quality-update-signals.md), we may decide to pause that release.
+
+> [!IMPORTANT]
+> Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its device management solution and that's the average frequency Windows devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).
+
+**To pause or resume a Windows quality update:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Devices** from the left navigation menu.
+1. Under the **Windows Autopatch** section, select **Release management**.
+1. In the **Release management** blade, got to the **Release schedule** tab and select **Windows quality updates**.
+1. Select the Autopatch group that you want to pause or resume. Select either: **Pause** or **Resume**. Alternatively, you can select the **horizontal ellipses (...)** of the Autopatch group you want to pause or resume. Select, **Pause** or **Resume** from the dropdown menu.
+1. Select a reason from the dropdown menu.
+1. Optional. Enter details about why you're pausing or resuming the selected update.
+1. If you're resuming an update, you can select one or more deployment rings.
+1. Select **Okay**.
+
+The three following statuses are associated with paused quality updates:
+
+| Status | Description |
+| ----- | ------ |
+| Paused by Service | If the Windows Autopatch service has paused an update, the release will have the **Paused by Service** status. The Paused by Service only applies to rings that aren't Paused by the Tenant. |
+| Paused by Tenant | If you've paused an update, the release will have the **Paused by Tenant** status. The Windows Autopatch service can't overwrite a tenant pause. You must select **Resume** to resume the update. |
+
+## Remediating Not ready and/or Not up to Date devices
+
+To ensure your devices receive Windows quality updates, Windows Autopatch provides information on how you can [remediate Windows Autopatch device alerts](../operate/windows-autopatch-device-alerts.md).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md
new file mode 100644
index 0000000000..556a292eb3
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-signals.md
@@ -0,0 +1,62 @@
+---
+title: Windows quality update release signals with Autopatch groups
+description: This article explains the Windows quality update release signals with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: conceptual
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: hathind
+---
+
+# Windows quality update signals: Windows Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+Windows Autopatch monitors a specific set of signals and aims to release the monthly security update both quickly and safely. The service doesn't comprehensively monitor every use case in Windows.
+
+If there's a scenario that is critical to your business, which isn't monitored by Windows Autopatch, you're responsible for testing and taking any follow-up actions, like requesting to pause the release.
+
+## Pre-release signals
+
+Before being released to the Test ring in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group), Windows Autopatch reviews several data sources to determine if we need to send any customer advisories or need to pause the update. Situations where Windows Autopatch doesn't release an update to the Test ring are seldom occurrences.
+
+| Pre-release signal | Description |
+| ----- | ----- |
+| Windows Payload Review | The contents of the monthly security update release are reviewed to help focus your update testing on areas that have changed. If any relevant changes are detected, a [customer advisory](../operate/windows-autopatch-groups-windows-quality-update-communications.md#communications-during-release) will be sent out. |
+| Optional non-security preview release review - Internal Signals | Windows Autopatch reviews active incidents associated with the previous optional non-security preview release to understand potential risks in the monthly security update release. |
+| Optional non-security preview release review - Social Signals | Windows Autopatch monitors social signals to better understand potential risks associated with the monthly security update release. |
+
+## Early signals
+
+The update is released to the Test ring in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) on the second Tuesday of the month. Those test devices will update, allowing you to conduct early testing of critical scenarios in your environment. There are also several Microsoft internal signals that are monitored throughout the release.
+
+| Device reliability signal | Description | Microsoft will |
+| ----- | ----- | ----- |
+| Security Risk Profile | As soon as the update is released, the criticality of the security content is assessed. | - Consider expediting the release
- Update customers with a risk profile
+| B-Release - Internal Signals | Windows Autopatch reviews any active incidents associated with the current release. | - Determine if a customer advisory is necessary
- Pause the release if there's significant user impact
|
+| B-Release - Social Signals | Windows Autopatch monitors social signals to understand risks associated with the release. | Determine if a customer advisory is necessary |
+
+## Device reliability signals
+
+Windows Autopatch monitors devices for a set of core reliability metrics as a part of the service.
+
+The service then uses statistical models to assess if there are significant differences between the two Windows versions. To make a statistically significant assessment, Windows Autopatch requires that at least 500 devices in your tenant have upgraded to the new version.
+
+As more devices update, the confidence of the analysis increases and gives us a clearer picture of release quality. If we determine that the user experience is impaired, Autopatch will either post a customer advisory or pause the release, depending on the criticality of the update.
+
+Autopatch monitors the following reliability signals:
+
+| Device reliability signal | Description |
+| ----- | ----- |
+| Blue screens | These events are highly disruptive to end users. These events are closely monitored. |
+| Overall app reliability | Tracks the total number of app crashes and freezes on a device. A known limitation with this measure is that if one app becomes 10% more reliable and another becomes 10% less reliable then it shows up as a flat line in the measure. |
+| Microsoft Office reliability | Tracks the number of Office crashes and freezes per application per device. |
+| Microsoft Edge reliability | Tracks the number of Microsoft Edge crashes and freezes per device. |
+| Microsoft Teams reliability | Tracks the number of Microsoft Teams crashes and freezes per device. |
+
+When the update is released to the First ring in the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group), the service crosses the 500 device threshold. Therefore, Autopatch can detect regressions that are common to all customers. At this point in the release, we'll decide if we need to expedite the release schedule or pause for all customers.
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md
new file mode 100644
index 0000000000..4cd9aa18af
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md
@@ -0,0 +1,79 @@
+---
+title: Quality update status report
+description: Provides a per device view of the current update status for all Windows Autopatch enrolled devices with Autopatch groups.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Quality update status report (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+The Quality update status report provides a per device view of the current update status for all Windows Autopatch enrolled devices.
+
+**To view the Quality update status report:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Reports** > **Windows Autopatch** > **Windows quality updates**.
+1. Select the **Reports** tab.
+1. Select **Quality update status**.
+
+> [!NOTE]
+> The data in this report is refreshed every 24 hours with data received by your Windows Autopatch managed devices. The last refreshed on date/time can be seen at the top of the page. For more information about how often Windows Autopatch receives data from your managed devices, see [Data latency](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#about-data-latency).
+
+## Report information
+
+### Default columns
+
+The following information is available as default columns in the Quality update status report:
+
+| Column name | Description |
+| ----- | ----- |
+| Device name | The name of the device. |
+| Deployment ring | The currently assigned Windows Autopatch deployment ring for the device. |
+| Update status | The current update status for the device. For more information, see [Windows quality update statuses](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-and-feature-update-statuses). |
+| Pause status | The current pause status whether Customer or Service initiated. For more information, see [Pause and resume a release](../operate/windows-autopatch-groups-windows-quality-update-overview.md#pause-and-resume-a-release). |
+| Current version | The current version or build number of the device. For more information, see [Windows Versions](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2). |
+| Readiness | The device readiness evaluation status. For more information, see [Post registration device readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md). |
+| Alerts | The summary of any alerts affecting the device. For more information, see [Device alerts](../operate/windows-autopatch-device-alerts.md). |
+
+### Optional columns
+
+The following information is available as optional columns in the Quality update status report:
+
+| Column name | Description |
+| ----- | ----- |
+| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device |
+| Serial number | The current Intune recorded serial number for the device |
+| Intune last check in time | The last time the device checked in to Intune |
+| Service State | The Service State provided from Windows Update |
+| Service Substate | The Service Substate provided from Windows Update |
+| Client State | The Client State provided from Windows Update |
+| Client Substate | The Client Substate provided from Windows Update |
+| Servicing Channel | The Servicing Channel provided from Windows Update |
+| User Last Logged On | The last user who logged on as reported from Intune |
+| Primary User UPN | The Primary User UPN as reported from Intune |
+| Hex Error Code | The hex error provided from Windows Update |
+
+> [!NOTE]
+> The Service State, Service Substate, Client State, Client Substate, Servicing Channel, and Hex Error Code columns may not display any values. These columns are supplemental and might not display for all devices
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Search | Use to search by device name, Azure AD device ID or serial number |
+| Sort | Select the **column headings** to sort the report data in ascending and descending order. |
+| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. |
+| Filter | Select either the **Add filters** or at the top of the report to filter the results. |
+| Columns | Select a column to add or remove the column from the report. |
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md
new file mode 100644
index 0000000000..31ca5e6fac
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md
@@ -0,0 +1,51 @@
+---
+title: Windows quality update summary dashboard
+description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Windows quality update summary dashboard (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+The summary dashboard provides a summary view of the current update status for all devices enrolled into Windows Autopatch.
+
+**To view the current update status for all your enrolled devices:**
+
+1. Sign into the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Reports** > **Windows Autopatch** > **Windows quality updates**.
+
+> [!NOTE]
+> The data in this report is refreshed every 24 hours with data received by your Windows Autopatch managed devices. The last refreshed on date/time can be seen at the top of the page. For more information about how often Windows Autopatch receives data from your managed devices, see [Data latency](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#about-data-latency).
+
+## Report information
+
+The following information is available in the summary dashboard:
+
+| Column name | Description |
+| ----- | ----- |
+| Autopatch group | The Autopatch group and deployment ring. For more information, see [Windows Autopatch groups](../deploy/windows-autopatch-groups-overview.md). |
+| Device count | Total device count per Autopatch group or deployment ring. |
+| Up to date | Total device count reporting a status of Up to date. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
+| Not up to Date | Total device count reporting a status of Not Up to date. For more information, see [Not Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+| In progress | Total device counts reporting the In progress status. For more information, see [In progress](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-sub-statuses). |
+| Paused | Total device count reporting the status of the pause whether it’s Service or Customer initiated. For more information, see [Up to Date](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices). |
+| Not ready | Total device count reporting the Not ready status. For more information, see [Not ready](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices). |
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Refresh | The option to **Refresh** the summary dashboard is available at the top of the page. This process will ensure that the summary dashboard view is updated to the latest available dataset from within the last 24-hour period. |
+| Summary links | Each column represents the summary of included devices. Select the hyperlinked number to produce a filtered report in a new browser tab. |
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md
new file mode 100644
index 0000000000..935bb616af
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md
@@ -0,0 +1,42 @@
+---
+title: Quality update trending report
+description: Provides a visual representation of the update status trend for all devices over the last 90 days with Autopatch groups.
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: adnich
+---
+
+# Quality update trending report (public preview)
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+The Quality update trending report provides a visual representation of the update status trend for all devices over the last 90 days.
+
+**To view the Quality update trending report:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**.
+1. Select the **Reports** tab.
+1. Select **Quality update trending**.
+
+> [!NOTE]
+> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page.
+
+## Report options
+
+The following options are available:
+
+| Option | Description |
+| ----- | ----- |
+| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. |
+| By percentage | Select **by percentage** to show your trending graphs and indicators by percentage. |
+| By device count | Select **by device count** to show your trending graphs and indicators by numeric value. |
+
+For a description of the displayed device status trends, see [Windows quality update statuses](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#windows-quality-and-feature-update-statuses).
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md
new file mode 100644
index 0000000000..7d03bd8c1e
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-update.md
@@ -0,0 +1,125 @@
+---
+title: Customize Windows Update settings Autopatch groups experience
+description: How to customize Windows Updates with Autopatch groups
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: rekhanr
+---
+
+# Customize Windows Update settings: Autopatch groups experience (public preview)
+
+> [!IMPORTANT]
+> This feature is in **public preview**. The feature is being actively developed, and may not be complete. You can test and use these features in production environments and provide feedback.
+
+> [!IMPORTANT]
+> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.
**To opt-in to use Windows Autopatch groups:**- Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.
- Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.
- Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).
+
+You can customize the Windows Update deployment schedule for each deployment ring in Windows Autopatch groups per your business and organizational needs. This capability is allowed for both [Default](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) and [Custom Autopatch groups](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups). However, we recommend that you remain within service defined boundaries to maintain compliance.
+
+When the deployment cadence is customized, Windows Autopatch will override our service defaults with your preferred deployment cadence. Depending on the selected options, devices with [customized schedules](#scheduled-install) may not count towards the Windows Autopatch [Windows quality update service level objective](../operate/windows-autopatch-groups-windows-quality-update-overview.md#service-level-objective).
+
+## Deployment cadence
+
+### Cadence types
+
+For each tenant, at the deployment ring level, there are two cadence types to configure and manage your Windows Update deployments for all the devices in those deployment rings:
+
+- [Deadline-driven](#deadline-driven)
+- [Scheduled install](#scheduled-install)
+
+> [!NOTE]
+> Windows Autopatch uses the [Update rings policy for Windows 10 and later in Microsoft Intune](/mem/intune/protect/windows-10-update-rings) to apply either **Deadline-driven** or **Scheduled install** cadence types. Microsoft Intune implements [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) using the settings available in the [Update policy CSP](/windows/client-management/mdm/policy-csp-update).
+
+#### Deadline-driven
+
+With the deadline-drive cadence type, you can control and customize the deferral, deadline, and grace period to meet your specific business needs and organizational requirements.
+
+There are certain limits that Windows Autopatch defines and you'll only be able to make changes with those boundaries. The following boundaries are implemented so that Windows Autopatch can maintain update compliance.
+
+| Boundary | Description |
+| ----- | ----- |
+| Deferrals and deadlines | Windows Autopatch will enforce that deadline plus deferral days for a deployment ring to be less than or equal to 14 days. |
+| Grace period | The permitted customization range is zero to seven days. |
+
+> [!NOTE]
+> The configured grace period will apply to both Windows quality updates and Windows feature updates.
+
+Each deployment ring can be scheduled independent of the others, and there are no dependencies that the previous deployment ring must be scheduled before the next ring. Further, if the cadence type is set as **Deadline-driven**, the automatic update behavior setting, **Reset to default** in the Windows Update for Business policy, will be applied.
+
+It's possible for you to change the cadence from the Windows Autopatch Release management blade while update deployments are in progress. Windows Autopatch will abide by the principle to always respect your preferences over service-defined values.
+
+However, if an update has already started for a particular deployment ring, Windows Autopatch won't be able to change the cadence for that ring during that ongoing update cycle. The changes will only be effective in the next update cycle.
+
+#### Scheduled install
+
+> [!NOTE]
+>If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-groups-windows-quality-update-overview.md#service-level-objective).
+
+While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will minimize disruptions by preventing forced restarts and interruptions to critical business activities for end users. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. Devices will only update and restart according to the time specified.
+
+If other applications force a device to restart outside of the specified time and a Windows Update is pending a restart, the Windows Update will complete its installation at this time. For this reason, ensure that you consider your update and restart scenarios for devices running business critical activities, or restart sensitive workloads before using the Scheduled Install option.
+
+> [!NOTE]
+> The compliance deadline and grace period for Windows quality updates won't be configured for the Scheduled Install cadence type.
+
+Devices **must** be active and available at the time when the device is scheduled for installation to ensure the optimal experience. If the device is consistently unavailable during the scheduled install time, the device can remain unprotected and unsecured, or the device may have the Windows Update scan and install during active hours.
+
+##### Scheduled install types
+
+> [!NOTE]
+> For devices with **Active hours** configured, if the device is consistently unavailable, Windows will attempt to keep the devices up to date, including installation of updates during Active hours.For Windows 10 devices, Windows Update can start 30 minutes prior to the specified install time. If the installation start time is specified at 2:00 AM, some of the devices may start the installation 30 mins prior.
+
+The Scheduled install cadence has two options:
+
+| Option | Description |
+| ----- | ----- |
+| Active hours | The period (daily) that the user normally does their work, or the device is busy performing business critical actions.The time outside of active hours is when the device is available for Windows to perform an update and restart the device (daily). The max range for Active hours is 18 hours. The six-hour period outside of the active hours is the deployment period, when Windows Update for Business will scan, install and restart the device.
+| Schedule install and restart | Use this option to prevent the service from installing Windows Updates except during the specified start time. You can specify the following occurrence options:Select a time when the device has low activity for the updates to complete. Ensure that the Windows Update has three to four hours to complete the installation and restart the device.
|
+
+> [!NOTE]
+> Changes made in one deployment ring won't impact other rings in your tenant.Configured **Active hours** and **Scheduled install and restart** options will apply to both Windows quality updates and Windows feature updates.
+
+### User notifications
+
+In addition to the cadence type, you can also manage the end user notification settings. End users will receive all update notifications by default. For critical devices or devices where notifications need to be hidden, use the **Manage notifications** option to configure notifications. For each tenant, at the deployment ring level, there are four options for you to configure end user update notification settings:
+
+- Not configured
+- Use the default Windows Update notifications
+- Turn off all notifications excluding restart warnings
+- Turn off all notifications including restart warnings
+
+For more information, see [Windows Update settings you can manage with Intune update ring policies for Windows 10/11 devices](/mem/intune/protect/windows-update-settings).
+
+## Customize the Windows Update deployment cadence
+
+> [!IMPORTANT]
+> The Windows update setting customizations can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its device management solution and that's the average frequency Windows devices take to communicate back to Microsoft Intune with new instructions to apply new software update settings.For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).
+
+**To customize the Windows Update deployment cadence:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+2. Navigate to **Devices** > **Windows Autopatch** > **Release management** > **Release settings** select **Autopatch groups**. Select the **horizontal ellipses (…)** > **Edit** for the Autopatch group you want to edit.
+3. Select the **horizontal ellipses (…)** across each ring to manage the deployment cadence or notification settings.
+4. Select **Next** to navigate to the Windows update settings page. The page lists the existing settings for each of the deployment rings in the Autopatch group.
+5. Select [**Manage deployment cadence**](#cadence-types) to customize Windows Update settings.
+ 1. Select one of the cadence types for the ring:
+ 1. Select **Deadline-driven** to configure the deferral, deadline, and grace periods. This option will enforce forced restarts based on the selected deadline and grace period. In the event you want to switch back to the service recommended defaults, for each of the settings, select the option tagged as "default".
+ 1. Select **Scheduled install** to opt-out of deadline-based forced restart.
+ 1. Select either **Active hours** or **Schedule install and restart time**.
+ 2. Select **Save**.
+6. Select **Manage notifications**. A fly-in pane opens.
+ 1. Select one of following [Windows Update restart notifications](#user-notifications) for your devices that are part of the selected deployment ring. By default, Windows Autopatch recommends that you enable all notifications.
+ 1. Not configured
+ 1. Use the default Windows Update notifications
+ 1. Turn off all notifications excluding restart warnings
+ 1. Turn off all notifications included restart warnings
+ 1. Select **Save** once you select the preferred setting.
+7. Repeat the same process to customize each of the rings. Once done, select **Next**.
+8. In **Review + apply**, you’ll be able to review the selected settings for each of the rings.
+9. Select **Apply** to apply the changes to the ring policy. Once the settings are applied, the saved changes can be verified in the **Release schedule** tab. The Windows quality update schedule on the **Release schedule** tab will be updated as per the customized settings.
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md
new file mode 100644
index 0000000000..803ffa0560
--- /dev/null
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-policy-health-and-remediation.md
@@ -0,0 +1,106 @@
+---
+title: policy health and remediation
+description: Describes what Autopatch does it detects policies in the tenant are either missing or modified to states that affect the service
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: rekhanr
+---
+
+# Policy health and remediation (public preview)
+
+> [!IMPORTANT]
+> This feature is in **public preview**. This feature is being actively developed and may not be complete. You can test and use these features in production environments and provide feedback.
+
+Windows Autopatch uses Microsoft Intune policies to set configurations and deliver the service. Windows Autopatch continuously monitors the policies and maintains all configurations related to the operation of the service.
+
+> [!IMPORTANT]
+> Don't change, edit, add to, or remove any of the Windows Autopatch policies or groups. Doing so can cause unintended configuration changes and impact the Windows Autopatch service. For more information about Windows Autopatch configurations, see [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md).
+
+When Windows Autopatch detects policies in the tenant are either missing or modified that affects the service, Windows Autopatch will raise alerts and detailed recommended actions to ensure healthy operation of the service.
+
+IT admins must respond to the service-generated alerts to ensure that Autopatch services can be delivered, and devices remain eligible for the service.
+
+With this feature, IT admins can:
+
+- View alerts, in line with the features you commonly use:
+ - Windows Update related alerts in the Release management blade.
+ - Device configuration alerts in the **Tenant management** > **Alert actions** tab.
+- Initiate action for the Autopatch service to restore policies without having to raise an incident.
+- Initiate action for the Autopatch service to restore the deployment rings without having to raise an incident.
+
+> [!NOTE]
+> You can rename your policies to meet your organization’s requirements. Do **not** rename the underlying Autopatch deployment groups.
+
+## Check policy health
+
+Alerts are raised when deployment rings don't have the required policies and the settings that impact devices within the ring. The remediation actions from the displayed alerts are intended to keep the deployment rings in a healthy state. Devices in each ring may continue to report different states, including errors and conflicts. This occurs due to multiple policies targeted at the same device or other conditions on the device. Policy conflicts and other device errors aren't addressed by these alerts.
+
+## Built-in roles required for remediation actions
+
+The minimum role required to restore configurations is **Intune Service Administrator**. You can also perform these actions in the Global administrator role.
+
+## Restore device configuration policy
+
+**To initiate remediation action for device configuration alerts:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Tenant administration** > **Tenant management** > **Alerts**.
+1. Select **Restore missing policy** to launch the workflow.
+1. Review the message and select **Restore policy**.
+1. If the **Change modified policy alert** appears, select this alert to launch the workflow.
+1. Select **Submit changes** to restore to service required values.
+
+There will be an alert for each policy that is missing or has deviated from the service defined values.
+
+## Restore Windows update policies
+
+**To initiate remediation actions for Windows quality update policies:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Devices** > **Windows Autopatch** > **Release management** > **Release schedule** > **Windows quality updates** > **Status**.
+1. Select **Policy Error** to launch the Policy error workflow.
+1. Review the message:
+ 1. If this is a missing policy error, select **Restore policy** to complete the workflow.
+ 2. If this is a modified policy, select **Submit changes** to restore to service required values.
+
+**To initiate remediation actions for Windows feature update policies:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Devices** > **Windows Autopatch** > **Release management** > **Release schedule** > **Windows feature updates** > **Status**.
+1. Select **Policy Error** to launch the Policy error workflow.
+1. Review the message.
+ 1. If this is a missing policy error, select **Restore policy** to complete the workflow.
+ 2. If this is a modified policy, select **Submit changes** to restore to service required values.
+
+## Restore deployment groups
+
+**To initiate remediation action for missing groups:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Navigate to **Tenant administration** > **Tenant management** > **Alerts**.
+1. Select **Restore missing group** to launch the workflow.
+1. Review the message and select **Restore group**.
+
+When a missing deployment group is restored, the policies will be reassigned back to the deployment groups. In the Release management blade, the service will raise a Policy Error that you'll need to complete to repair Windows Update policies. Due to the asynchronous run of service detectors, it may take up to four (4) hours for this error to be displayed.
+
+> [!NOTE]
+> While Windows Autopatch continuously monitors the policies, all policy alerts are raised within four (4) hours of detection.Alerts will remain active until an IT admin completes the action to restore them to a healthy state.
+
+There are no Autopatch reports for policy alerts and actions at this time.
+
+## Use audit logs to track actions in Microsoft Intune
+
+You can review audit logs in Intune to review the activities completed on the tenant.
+
+**To review audit logs in Intune:**
+
+1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Select **Tenant administration** > **Audit logs**.
+
+The entries with enterprise application name, Modern Workplace Management, are the actions requested by Windows Autopatch.
diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md
index d185fe21d6..3525a20488 100644
--- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md
+++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md
@@ -45,8 +45,8 @@ This article outlines your responsibilities and Windows Autopatch's responsibili
| [Turn on or off expedited Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#expedited-releases) | :heavy_check_mark: | :x: |
| [Allow or block Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates) | :heavy_check_mark: | :x: |
| [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | :heavy_check_mark: | :x: |
-| [Register devices/add devices to the Windows Autopatch Device Registration group](../deploy/windows-autopatch-register-devices.md#steps-to-register-devices) | :heavy_check_mark: | :x: |
-| [Run the pre-registration device readiness checks](../deploy/windows-autopatch-register-devices.md#about-the-ready-not-ready-and-not-registered-tabs) | :x: | :heavy_check_mark: |
+| [Register devices/add devices to the Windows Autopatch Device Registration group](../deploy/windows-autopatch-register-devices.md#steps-to-register-devices-using-the-classic-method) | :heavy_check_mark: | :x: |
+| [Run the pre-registration device readiness checks](../deploy/windows-autopatch-register-devices.md#about-the-registered-not-ready-and-not-registered-tabs) | :x: | :heavy_check_mark: |
| [Automatically assign devices to First, Fast & Broad deployment rings at device registration](../operate/windows-autopatch-update-management.md#deployment-ring-calculation-logic) | :x: | :heavy_check_mark: |
| [Manually override device assignments to First, Fast & Broad deployment rings](../operate/windows-autopatch-update-management.md#moving-devices-in-between-deployment-rings) | :heavy_check_mark: | :x: |
| [Remediate devices displayed in the **Not ready** tab](../deploy/windows-autopatch-post-reg-readiness-checks.md#about-the-three-tabs-in-the-devices-blade) | :heavy_check_mark: | :x: |
diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md
index 7e202554d2..4ca771cece 100644
--- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md
+++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enroll-tenant.md
@@ -52,7 +52,6 @@ The following are the Microsoft Intune settings:
| Check | Description |
| ----- | ----- |
| Deployment rings for Windows 10 or later | Verifies that Intune's deployment rings for Windows 10 or later policy doesn't target all users or all devices. Policies of this type shouldn't target any Windows Autopatch devices. For more information, see [Configure deployment rings for Windows 10 and later in Intune](/mem/intune/protect/windows-10-update-rings). |
-| Unlicensed admin | Verifies that this setting is enabled to avoid a "lack of permissions" error when we interact with your Azure Active Directory (AD) organization. For more information, see [Unlicensed admins in Microsoft Intune](/mem/intune/fundamentals/unlicensed-admins). |
### Azure Active Directory settings
diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md
index a180a874ec..413d997112 100644
--- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md
+++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md
@@ -37,14 +37,6 @@ For each check, the tool will report one of four possible results:
You can access Intune settings at the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
-### Unlicensed admins
-
-This setting must be turned on to avoid a "lack of permissions" error when we interact with your Azure Active Directory (AD) organization.
-
-| Result | Meaning |
-| ----- | ----- |
-| Not ready | Allow access to unlicensed admins should be turned on. Without this setting enabled, errors can occur when we try to access your Azure AD organization for service. You can safely enable this setting without worrying about security implications. The scope of access is defined by the roles assigned to users, including our operations staff.For more information, see [Unlicensed admins](/mem/intune/fundamentals/unlicensed-admins). |
-
### Update rings for Windows 10 or later
Your "Update rings for Windows 10 or later" policy in Intune must not target any Windows Autopatch devices.
diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md
index bf23950f18..a1fd2c87e2 100644
--- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md
+++ b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md
@@ -74,10 +74,10 @@ The following groups target Windows Autopatch configurations to devices and mana
| Policy name | Policy description | OMA | Value |
| ----- | ----- | ----- | ----- |
-| Modern Workplace Update Policy [Test]-[Windows Autopatch | Windows Update for Business Configuration for the Test Ring
Assigned to:
- Modern Workplace Devices-Windows Autopatch-Test
|- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
|- 0
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 0
- 0
- False
- False
|
-| Modern Workplace Update Policy [First]-[Windows Autopatch] | Windows Update for Business Configuration for the First Ring Assigned to:
- Modern Workplace Devices-Windows Autopatch-First
|- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
|- 1
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 2
- 2
- False
- False
|
-| Modern Workplace Update Policy [Fast]-[Windows Autopatch] | Windows Update for Business Configuration for the Fast RingAssigned to:
- Modern Workplace Devices-Windows Autopatch-Fast
|- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
|- 6
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 2
- 2
- False
- False
|
-| Modern Workplace Update Policy [Broad]-[Windows Autopatch] | Windows Update for Business Configuration for the Broad RingAssigned to:
- Modern Workplace Devices-Windows Autopatch-Broad
|- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
|- 9
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 5
- 2
- False
- False
|
+| Modern Workplace Update Policy [Test]-[Windows Autopatch | Windows Update for Business Configuration for the Test RingAssigned to:
- Modern Workplace Devices-Windows Autopatch-Test
|- MicrosoftProductUpdates
- EnablePrereleasebuilds
- UpgradetoLatestWin11
- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
- RestartChecks
- SetDisablePauseUXAccess
- SetUXtoCheckforUpdates
|- Allow
- Not Configured
- No
- 0
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 0
- 0
- False
- False
- Allow
- Disable
- Enable
|
+| Modern Workplace Update Policy [First]-[Windows Autopatch] | Windows Update for Business Configuration for the First Ring Assigned to:
- Modern Workplace Devices-Windows Autopatch-First
|- MicrosoftProductUpdates
- EnablePrereleasebuilds
- UpgradetoLatestWin11
- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
- RestartChecks
- SetDisablePauseUXAccess
- SetUXtoCheckforUpdates
|- Allow
- Not Configured
- No
- 1
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 2
- 2
- False
- False
- Allow
- Disable
- Enable
|
+| Modern Workplace Update Policy [Fast]-[Windows Autopatch] | Windows Update for Business Configuration for the Fast RingAssigned to:
- Modern Workplace Devices-Windows Autopatch-Fast
|- MicrosoftProductUpdates
- EnablePrereleasebuilds
- UpgradetoLatestWin11
- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
- RestartChecks
- SetDisablePauseUXAccess
- SetUXtoCheckforUpdates
|- Allow
- Not Configured
- No
- 6
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 2
- 2
- False
- False
- Allow
- Disable
- Enable
|
+| Modern Workplace Update Policy [Broad]-[Windows Autopatch] | Windows Update for Business Configuration for the Broad RingAssigned to:
- Modern Workplace Devices-Windows Autopatch-Broad
|- MicrosoftProductUpdates
- EnablePrereleasebuilds
- UpgradetoLatestWin11
- QualityUpdatesDeferralPeriodInDays
- FeatureUpdatesDeferralPeriodInDays
- FeatureUpdatesRollbackWindowInDays
- BusinessReadyUpdatesOnly
- AutomaticUpdateMode
- InstallTime
- DeadlineForFeatureUpdatesInDays
- DeadlineForQualityUpdatesInDays
- DeadlineGracePeriodInDays
- PostponeRebootUntilAfterDeadline
- DriversExcluded
- RestartChecks
- SetDisablePauseUXAccess
- SetUXtoCheckforUpdates
|- Allow
- Not Configured
- No
- 9
- 0
- 30
- All
- WindowsDefault
- 3
- 5
- 5
- 2
- False
- False
- Allow
- Disable
- Enable
|
## Windows feature update policies
diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md b/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md
new file mode 100644
index 0000000000..29795eceb9
--- /dev/null
+++ b/windows/deployment/windows-autopatch/references/windows-autopatch-groups-public-preview-addendum.md
@@ -0,0 +1,29 @@
+---
+title: Autopatch groups Public Preview Addendum
+description: Addendum for Windows Autopatch groups public preview
+ms.date: 05/01/2023
+ms.prod: windows-client
+ms.technology: itpro-updates
+ms.topic: how-to
+ms.localizationpriority: medium
+author: tiaraquan
+ms.author: tiaraquan
+manager: dougeby
+ms.reviewer: andredm7
+---
+
+# Windows Autopatch groups Public Preview Addendum
+
+**This is the Autopatch groups Public Preview Addendum ("Addendum") to the Microsoft Product Terms’ Universal License Terms for Online Services** (as provided at: [Microsoft Product Terms](https://www.microsoft.com/licensing/terms/product/ForallOnlineServices/all) (the "**Product Terms**")) is entered into between Microsoft Corporation, a Washington corporation having its principal place of business at One Microsoft Way, Redmond, Washington, USA 98052-6399 (or based on where Customer lives, one of Microsoft's affiliates) ("**Microsoft**"), and you ("**Customer**").
+
+For good and valuable consideration, the receipt and sufficiency of which is acknowledged, the parties agree as follows:
+
+Microsoft desires to preview the Autopatch groups service it is developing ("**Autopatch groups Preview**”) in order to evaluate it. Customer would like to particulate this Autopatch groups Preview under the Product Terms and this Addendum. Autopatch groups Preview consists of features and services that are in preview, beta, or other pre-release form. Autopatch groups Preview is subject to the "preview" terms set forth in the Product Terms’ Universal License Terms for Online Services.
+
+## Definitions
+
+Capitalized terms used but not defined herein have the meanings given in the Product Terms.
+
+## Data Handling
+
+Autopatch groups Preview integrates Customer Data from other Products, including Windows, Microsoft Intune, Azure Active Directory, and Office (collectively for purposes of this provision "Windows Autopatch Input Services"). Once Customer Data from Windows Autopatch Input Services is integrated into Autopatch groups Preview, only the Product Terms and [DPA provisions](https://www.microsoft.com/licensing/terms/product/Glossary/all) applicable to Autopatch groups Preview apply to that data.
diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
index 04d0ae58bc..a279da8f47 100644
--- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
+++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
@@ -1,7 +1,7 @@
---
title: What's new 2023
description: This article lists the 2023 feature releases and any corresponding Message center post numbers.
-ms.date: 04/18/2023
+ms.date: 05/01/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: whats-new
@@ -18,8 +18,43 @@ This article lists new and updated feature releases, and service releases, with
Minor corrections such as typos, style, or formatting issues aren't listed.
+## May 2023
+
+### May 2023 feature release
+
+| Article | Description |
+| ----- | ----- |
+| [Device registration overview](../deploy/windows-autopatch-device-registration-overview.md) | Updated article to include Windows Autopatch groups. The Windows Autopatch groups feature is in public preview |
+| [Register your devices](../deploy/windows-autopatch-register-devices.md) | Updated article to include Windows Autopatch groups. The Windows Autopatch groups feature is in public preview |
+| [Windows Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Software update management](../operate/windows-autopatch-groups-update-management.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update overview](../operate/windows-autopatch-groups-windows-quality-update-overview.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update end user experience](../operate/windows-autopatch-groups-windows-quality-update-end-user-exp.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update signals](../operate/windows-autopatch-groups-windows-quality-update-signals.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update communications](../operate/windows-autopatch-groups-windows-quality-update-communications.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Manage Windows feature update](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality and feature update reports overview](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update summary dashboard](../operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update status report](../operate/windows-autopatch-groups-windows-quality-update-status-report.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality update trending report](../operate/windows-autopatch-groups-windows-quality-update-trending-report.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows feature update summary dashboard](../operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows feature update status report](../operate/windows-autopatch-groups-windows-feature-update-status-report.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows feature update trending report](../operate/windows-autopatch-groups-windows-feature-update-trending-report.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Windows quality and feature update device alerts](../operate/windows-autopatch-device-alerts.md) | New article for the Windows Autopatch groups experience. Windows Autopatch groups is in public preview |
+| [Policy health and remediation](../operate/windows-autopatch-policy-health-and-remediation.md) | Add new Policy health and remediation feature. This feature is in public preview |
+| [Windows Autopatch groups public preview addendum](../references/windows-autopatch-groups-public-preview-addendum.md) | Added addendum for the Windows Autopatch groups public preview |
+
## April 2023
+### April feature releases or updates
+
+| Article | Description |
+| ----- | ----- |
+| [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) | Updated the [Deployment rings for Windows 10 and later](../references/windows-autopatch-changes-to-tenant.md#deployment-rings-for-windows-10-and-later) section |
+
### April 2023 service release
| Message center post number | Description |
diff --git a/windows/deployment/windows-autopilot/images/all-groups.png b/windows/deployment/windows-autopilot/images/all-groups.png
deleted file mode 100644
index 6ae904ed62..0000000000
Binary files a/windows/deployment/windows-autopilot/images/all-groups.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png b/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png
deleted file mode 100644
index 0f458e9306..0000000000
Binary files a/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/ap-ts-1.png b/windows/deployment/windows-autopilot/images/ap-ts-1.png
deleted file mode 100644
index 5f4c33fd51..0000000000
Binary files a/windows/deployment/windows-autopilot/images/ap-ts-1.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/ap-ts.png b/windows/deployment/windows-autopilot/images/ap-ts.png
deleted file mode 100644
index 7c343176d0..0000000000
Binary files a/windows/deployment/windows-autopilot/images/ap-ts.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg b/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg
deleted file mode 100644
index 3a16c0f219..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-aad-configure.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg
deleted file mode 100644
index 3a8f1578cb..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png
deleted file mode 100644
index 1533f68c7c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg b/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg
deleted file mode 100644
index 137b6ca431..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-devices-add.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg
deleted file mode 100644
index bc4bed8920..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-add.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg
deleted file mode 100644
index 7604382113..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-assign.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg
deleted file mode 100644
index c3c5307ce4..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-intune-profile-configure.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg b/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg
deleted file mode 100644
index a2717c68be..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-intune-sync.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg b/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg
deleted file mode 100644
index bb2d641155..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-oobe.jpg and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-reset-customlogin.png b/windows/deployment/windows-autopilot/images/autopilot-reset-customlogin.png
deleted file mode 100644
index d86cb57895..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-reset-customlogin.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-reset-lockscreen.png b/windows/deployment/windows-autopilot/images/autopilot-reset-lockscreen.png
deleted file mode 100644
index f6fa6d3467..0000000000
Binary files a/windows/deployment/windows-autopilot/images/autopilot-reset-lockscreen.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/bitlocker-encryption.png b/windows/deployment/windows-autopilot/images/bitlocker-encryption.png
deleted file mode 100644
index 96e2d94fb3..0000000000
Binary files a/windows/deployment/windows-autopilot/images/bitlocker-encryption.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/choice.png b/windows/deployment/windows-autopilot/images/choice.png
deleted file mode 100644
index 881744eec5..0000000000
Binary files a/windows/deployment/windows-autopilot/images/choice.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/connector-fail.png b/windows/deployment/windows-autopilot/images/connector-fail.png
deleted file mode 100644
index 2d8abb5785..0000000000
Binary files a/windows/deployment/windows-autopilot/images/connector-fail.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp1.png b/windows/deployment/windows-autopilot/images/csp1.png
deleted file mode 100644
index 81e59080c8..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp1.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp2.png b/windows/deployment/windows-autopilot/images/csp2.png
deleted file mode 100644
index 06cc80fe95..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp3.png b/windows/deployment/windows-autopilot/images/csp3.png
deleted file mode 100644
index 8b0647e4b4..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp3.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp3a.png b/windows/deployment/windows-autopilot/images/csp3a.png
deleted file mode 100644
index 3fb1291370..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp3a.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp3b.png b/windows/deployment/windows-autopilot/images/csp3b.png
deleted file mode 100644
index c2034c1ebc..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp3b.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp4.png b/windows/deployment/windows-autopilot/images/csp4.png
deleted file mode 100644
index ddada725b2..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp4.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp5.png b/windows/deployment/windows-autopilot/images/csp5.png
deleted file mode 100644
index f43097c62b..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp5.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp6.png b/windows/deployment/windows-autopilot/images/csp6.png
deleted file mode 100644
index 8b0647e4b4..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp6.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/csp7.png b/windows/deployment/windows-autopilot/images/csp7.png
deleted file mode 100644
index 608128e5ab..0000000000
Binary files a/windows/deployment/windows-autopilot/images/csp7.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device3.png b/windows/deployment/windows-autopilot/images/delete-device3.png
deleted file mode 100644
index a2daa1c39a..0000000000
Binary files a/windows/deployment/windows-autopilot/images/delete-device3.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device4.png b/windows/deployment/windows-autopilot/images/delete-device4.png
deleted file mode 100644
index c0119fbc39..0000000000
Binary files a/windows/deployment/windows-autopilot/images/delete-device4.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device5.png b/windows/deployment/windows-autopilot/images/delete-device5.png
deleted file mode 100644
index 33b539d33c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/delete-device5.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device6.png b/windows/deployment/windows-autopilot/images/delete-device6.png
deleted file mode 100644
index 23cbcb7c44..0000000000
Binary files a/windows/deployment/windows-autopilot/images/delete-device6.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device7.png b/windows/deployment/windows-autopilot/images/delete-device7.png
deleted file mode 100644
index dcdeee5205..0000000000
Binary files a/windows/deployment/windows-autopilot/images/delete-device7.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles.png b/windows/deployment/windows-autopilot/images/deployment-profiles.png
deleted file mode 100644
index 7888da55d1..0000000000
Binary files a/windows/deployment/windows-autopilot/images/deployment-profiles.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles2.png b/windows/deployment/windows-autopilot/images/deployment-profiles2.png
deleted file mode 100644
index 6ff9fbb89e..0000000000
Binary files a/windows/deployment/windows-autopilot/images/deployment-profiles2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/device-import.png b/windows/deployment/windows-autopilot/images/device-import.png
deleted file mode 100644
index 3be4cff996..0000000000
Binary files a/windows/deployment/windows-autopilot/images/device-import.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/device2.png b/windows/deployment/windows-autopilot/images/device2.png
deleted file mode 100644
index 6f7d1a5df0..0000000000
Binary files a/windows/deployment/windows-autopilot/images/device2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/device3.png b/windows/deployment/windows-autopilot/images/device3.png
deleted file mode 100644
index adf9c7a875..0000000000
Binary files a/windows/deployment/windows-autopilot/images/device3.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/devices.png b/windows/deployment/windows-autopilot/images/devices.png
deleted file mode 100644
index a5b0dd1899..0000000000
Binary files a/windows/deployment/windows-autopilot/images/devices.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/dfci.png b/windows/deployment/windows-autopilot/images/dfci.png
deleted file mode 100644
index 6c68ed8b80..0000000000
Binary files a/windows/deployment/windows-autopilot/images/dfci.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/enabled-device.png b/windows/deployment/windows-autopilot/images/enabled-device.png
deleted file mode 100644
index 96dc935309..0000000000
Binary files a/windows/deployment/windows-autopilot/images/enabled-device.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/enrollment-status-page.png b/windows/deployment/windows-autopilot/images/enrollment-status-page.png
deleted file mode 100644
index 9bb550c20b..0000000000
Binary files a/windows/deployment/windows-autopilot/images/enrollment-status-page.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/esp-config.png b/windows/deployment/windows-autopilot/images/esp-config.png
deleted file mode 100644
index eb9f94661f..0000000000
Binary files a/windows/deployment/windows-autopilot/images/esp-config.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/esp-settings.png b/windows/deployment/windows-autopilot/images/esp-settings.png
deleted file mode 100644
index df0fe655e9..0000000000
Binary files a/windows/deployment/windows-autopilot/images/esp-settings.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/hh.png b/windows/deployment/windows-autopilot/images/hh.png
deleted file mode 100644
index 98fbc3cd7b..0000000000
Binary files a/windows/deployment/windows-autopilot/images/hh.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/hwid-csv.png b/windows/deployment/windows-autopilot/images/hwid-csv.png
deleted file mode 100644
index ac177e0b5a..0000000000
Binary files a/windows/deployment/windows-autopilot/images/hwid-csv.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/image1.png b/windows/deployment/windows-autopilot/images/image1.png
deleted file mode 100644
index e5bd9e3cba..0000000000
Binary files a/windows/deployment/windows-autopilot/images/image1.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/image2.png b/windows/deployment/windows-autopilot/images/image2.png
deleted file mode 100644
index 9790d50b35..0000000000
Binary files a/windows/deployment/windows-autopilot/images/image2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/import-vm.png b/windows/deployment/windows-autopilot/images/import-vm.png
deleted file mode 100644
index 5fb97cda5d..0000000000
Binary files a/windows/deployment/windows-autopilot/images/import-vm.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/include-group.png b/windows/deployment/windows-autopilot/images/include-group.png
deleted file mode 100644
index fb7bca7efa..0000000000
Binary files a/windows/deployment/windows-autopilot/images/include-group.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/include-group2.png b/windows/deployment/windows-autopilot/images/include-group2.png
deleted file mode 100644
index 585d006bac..0000000000
Binary files a/windows/deployment/windows-autopilot/images/include-group2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/intune-devices.png b/windows/deployment/windows-autopilot/images/intune-devices.png
deleted file mode 100644
index bc29c76511..0000000000
Binary files a/windows/deployment/windows-autopilot/images/intune-devices.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/landing.png b/windows/deployment/windows-autopilot/images/landing.png
deleted file mode 100644
index 13dea20b07..0000000000
Binary files a/windows/deployment/windows-autopilot/images/landing.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-config.png b/windows/deployment/windows-autopilot/images/mdm-config.png
deleted file mode 100644
index 0b2dd14a53..0000000000
Binary files a/windows/deployment/windows-autopilot/images/mdm-config.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-intune.png b/windows/deployment/windows-autopilot/images/mdm-intune.png
deleted file mode 100644
index db9b144fad..0000000000
Binary files a/windows/deployment/windows-autopilot/images/mdm-intune.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage2.png b/windows/deployment/windows-autopilot/images/msfb-manage2.png
deleted file mode 100644
index 406aaf5948..0000000000
Binary files a/windows/deployment/windows-autopilot/images/msfb-manage2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage3.png b/windows/deployment/windows-autopilot/images/msfb-manage3.png
deleted file mode 100644
index bf5fb1ccf9..0000000000
Binary files a/windows/deployment/windows-autopilot/images/msfb-manage3.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/new-group.png b/windows/deployment/windows-autopilot/images/new-group.png
deleted file mode 100644
index c18c1865f6..0000000000
Binary files a/windows/deployment/windows-autopilot/images/new-group.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/notepad.png b/windows/deployment/windows-autopilot/images/notepad.png
deleted file mode 100644
index 0f243f95d6..0000000000
Binary files a/windows/deployment/windows-autopilot/images/notepad.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/pc-01a.png b/windows/deployment/windows-autopilot/images/pc-01a.png
deleted file mode 100644
index a3d0f4cdea..0000000000
Binary files a/windows/deployment/windows-autopilot/images/pc-01a.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/pc-01b.png b/windows/deployment/windows-autopilot/images/pc-01b.png
deleted file mode 100644
index 07eda6e4bb..0000000000
Binary files a/windows/deployment/windows-autopilot/images/pc-01b.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/pwd.png b/windows/deployment/windows-autopilot/images/pwd.png
deleted file mode 100644
index c9b0e7837c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/pwd.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/reset.png b/windows/deployment/windows-autopilot/images/reset.png
deleted file mode 100644
index 0619b7fa03..0000000000
Binary files a/windows/deployment/windows-autopilot/images/reset.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/sc.png b/windows/deployment/windows-autopilot/images/sc.png
deleted file mode 100644
index bb326e6406..0000000000
Binary files a/windows/deployment/windows-autopilot/images/sc.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/sc1.png b/windows/deployment/windows-autopilot/images/sc1.png
deleted file mode 100644
index 380887a45c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/sc1.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/self-deploy-welcome.png b/windows/deployment/windows-autopilot/images/self-deploy-welcome.png
deleted file mode 100644
index 3ab1e4b304..0000000000
Binary files a/windows/deployment/windows-autopilot/images/self-deploy-welcome.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/up-1.PNG b/windows/deployment/windows-autopilot/images/up-1.PNG
deleted file mode 100644
index c1284c53d2..0000000000
Binary files a/windows/deployment/windows-autopilot/images/up-1.PNG and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/up-2.PNG b/windows/deployment/windows-autopilot/images/up-2.PNG
deleted file mode 100644
index 4891a3873a..0000000000
Binary files a/windows/deployment/windows-autopilot/images/up-2.PNG and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/up-3.PNG b/windows/deployment/windows-autopilot/images/up-3.PNG
deleted file mode 100644
index 8b1e356f92..0000000000
Binary files a/windows/deployment/windows-autopilot/images/up-3.PNG and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/update-flow.png b/windows/deployment/windows-autopilot/images/update-flow.png
deleted file mode 100644
index c90f54e96c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/update-flow.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/update1.png b/windows/deployment/windows-autopilot/images/update1.png
deleted file mode 100644
index 83d98a29b5..0000000000
Binary files a/windows/deployment/windows-autopilot/images/update1.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/update2.png b/windows/deployment/windows-autopilot/images/update2.png
deleted file mode 100644
index 04dbcaddc1..0000000000
Binary files a/windows/deployment/windows-autopilot/images/update2.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/update3.png b/windows/deployment/windows-autopilot/images/update3.png
deleted file mode 100644
index 851adb58ec..0000000000
Binary files a/windows/deployment/windows-autopilot/images/update3.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg01.png b/windows/deployment/windows-autopilot/images/wg01.png
deleted file mode 100644
index fa08be3f48..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg01.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg02.png b/windows/deployment/windows-autopilot/images/wg02.png
deleted file mode 100644
index 5de01d6803..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg02.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg03.png b/windows/deployment/windows-autopilot/images/wg03.png
deleted file mode 100644
index 89ac12747c..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg03.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg04.png b/windows/deployment/windows-autopilot/images/wg04.png
deleted file mode 100644
index a59ea766b7..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg04.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg05.png b/windows/deployment/windows-autopilot/images/wg05.png
deleted file mode 100644
index cea36fb6bd..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg05.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg06.png b/windows/deployment/windows-autopilot/images/wg06.png
deleted file mode 100644
index 68cd29c24d..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg06.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/wg07.png b/windows/deployment/windows-autopilot/images/wg07.png
deleted file mode 100644
index bc5a81bb3f..0000000000
Binary files a/windows/deployment/windows-autopilot/images/wg07.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/white-glove-result.png b/windows/deployment/windows-autopilot/images/white-glove-result.png
deleted file mode 100644
index de3701e76d..0000000000
Binary files a/windows/deployment/windows-autopilot/images/white-glove-result.png and /dev/null differ
diff --git a/windows/deployment/windows-autopilot/images/windows_glyph.png b/windows/deployment/windows-autopilot/images/windows_glyph.png
deleted file mode 100644
index 3a41d4dfb1..0000000000
Binary files a/windows/deployment/windows-autopilot/images/windows_glyph.png and /dev/null differ
diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml
index 4984e4e28e..63adeb04ea 100644
--- a/windows/security/TOC.yml
+++ b/windows/security/TOC.yml
@@ -23,6 +23,12 @@
href: information-protection/tpm/tpm-fundamentals.md
- name: How Windows uses the TPM
href: information-protection/tpm/how-windows-uses-the-tpm.md
+ - name: Manage TPM commands
+ href: information-protection/tpm/manage-tpm-commands.md
+ - name: Manager TPM Lockout
+ href: information-protection/tpm/manage-tpm-lockout.md
+ - name: Change the TPM password
+ href: information-protection/tpm/change-the-tpm-owner-password.md
- name: TPM Group Policy settings
href: information-protection/tpm/trusted-platform-module-services-group-policy-settings.md
- name: Back up the TPM recovery information to AD DS
@@ -33,6 +39,7 @@
href: information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
- name: TPM recommendations
href: information-protection/tpm/tpm-recommendations.md
+
- name: Hardware-based root of trust
href: threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
- name: System Guard Secure Launch and SMM protection
diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md
new file mode 100644
index 0000000000..facc36e2eb
--- /dev/null
+++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md
@@ -0,0 +1,66 @@
+---
+title: Change the TPM owner password (Windows)
+description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.topic: conceptual
+ms.date: 04/26/2023
+ms.technology: itpro-security
+appliesto:
+ - ✅ Windows 11
+ - ✅ Windows 10
+ - ✅ Windows Server 2022
+ - ✅ Windows Server 2019
+ - ✅ Windows Server 2016
+---
+
+# Change the TPM owner password
+
+This article for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system.
+
+## About the TPM owner password
+
+Starting with Windows 10, version 1607, Windows doesn't retain the TPM owner password when provisioning the TPM. The password is set to a random high entropy value and then discarded.
+
+> [!IMPORTANT]
+>
+> Although the TPM owner password isn't retained starting with Windows 10, version 1607, you can change a default registry key to retain it. However, we strongly recommend that you don't make this change. To retain the TPM owner password, under the registry key of
+>
+> `HKLM\Software\Policies\Microsoft\TPM`
+>
+> create a `REG_DWORD` value of `OSManagedAuthLevel` and set it to `4`.
+>
+> For Windows versions newer than Windows 10 1703, the default value for this key is 5. A value of 5 means:
+>
+> - **TPM 2.0**: Keep the lockout authorization.
+> - **TPM 1.2**: Discard the Full TPM owner authorization and retain only the Delegated authorization.
+>
+> Unless the registry key value is changed from 5 to 4 before the TPM is provisioned, the owner password isn't saved.
+
+Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic. Windows takes ownership of the TPM as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it.
+
+Without the owner password, you can still perform all the preceding actions with a physical presence confirmation from UEFI.
+
+### Other TPM management options
+
+Instead of changing your owner password, you can also use the following options to manage your TPM:
+
+- **Clear the TPM** - If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For important precautions for this process, and instructions for completing it, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm).
+
+- **Turn off the TPM** - With TPM 1.2 and Windows 10, versions 1507 and 1511, you can turn off the TPM. Turn off the TPM if you want to keep all existing keys and data intact and disable the services that are provided by the TPM. For more info, see [Turn off the TPM](initialize-and-configure-ownership-of-the-tpm.md#turn-off-the-tpm).
+
+## Changing the TPM owner password
+
+With Windows 10, version 1507 or 1511, if you have opted specifically to preserve the TPM owner password, you can use the saved password to change to a new password.
+
+To change to a new TPM owner password, in `TPM.msc`, select **Change Owner Password**, and follow the instructions. It prompts to provide the owner password file or to type the password. Then you can create a new password, either automatically or manually, and save the password in a file or as a printout.
+
+## Use the TPM cmdlets
+
+You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule).
+
+## Related articles
+
+- [Trusted Platform Module](trusted-platform-module-top-node.md)
diff --git a/windows/security/information-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md
new file mode 100644
index 0000000000..24f72081df
--- /dev/null
+++ b/windows/security/information-protection/tpm/manage-tpm-commands.md
@@ -0,0 +1,83 @@
+---
+title: Manage TPM commands (Windows)
+description: This article for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.topic: conceptual
+ms.date: 04/26/2023
+ms.technology: itpro-security
+appliesto:
+ - ✅ Windows 11
+ - ✅ Windows 10
+ - ✅ Windows Server 2022
+ - ✅ Windows Server 2019
+ - ✅ Windows Server 2016
+---
+
+# Manage TPM commands
+
+This article for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users.
+
+After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands.
+
+The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group.
+
+## Block TPM commands by using the Local Group Policy Editor
+
+1. Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**.
+
+ > [!NOTE]
+ >
+ > Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS).
+
+1. In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**.
+
+1. Under **System**, select **Trusted Platform Module Services**.
+
+1. In the details pane, double-click **Configure the list of blocked TPM commands**.
+
+1. Select **Enabled**, and then select **Show**.
+
+1. For each command that you want to block, select **Add**, enter the command number, and then select **OK**.
+
+ > [!NOTE]
+ >
+ > For a list of commands, see links in the [TPM Specification](https://www.trustedcomputinggroup.org/tpm-main-specification/).
+
+1. After you have added numbers for each command that you want to block, select **OK** twice.
+
+1. Close the Local Group Policy Editor.
+
+## Block or allow TPM commands by using the TPM MMC
+
+1. Open the TPM MMC (tpm.msc)
+
+1. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**.
+
+1. In the console tree, select **Command Management**. A list of TPM commands is displayed.
+
+1. In the list, select a command that you want to block or allow.
+
+1. Under **Actions**, select **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy.
+
+## Block new commands
+
+1. Open the TPM MMC (tpm.msc).
+
+ If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**.
+
+1. In the console tree, select **Command Management**. A list of TPM commands is displayed.
+
+1. In the **Action** pane, select **Block New Command**. The **Block New Command** dialog box is displayed.
+
+1. In the **Command Number** text box, type the number of the new command that you want to block, and then select **OK**. The command number you entered is added to the blocked list.
+
+## Use the TPM cmdlets
+
+You can manage the TPM using Windows PowerShell. For details, see [TrustedPlatformModule PowerShell cmdlets](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true).
+
+## Related articles
+
+- [Trusted Platform Module](trusted-platform-module-top-node.md)
diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md
new file mode 100644
index 0000000000..d89f660756
--- /dev/null
+++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md
@@ -0,0 +1,90 @@
+---
+title: Manage TPM lockout (Windows)
+description: This article for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.topic: conceptual
+ms.date: 04/26/2023
+ms.technology: itpro-security
+appliesto:
+ - ✅ Windows 11
+ - ✅ Windows 10
+ - ✅ Windows Server 2022
+ - ✅ Windows Server 2019
+ - ✅ Windows Server 2016
+---
+# Manage TPM lockout
+
+This article for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows.
+
+## About TPM lockout
+
+The TPM locks itself to prevent tampering or malicious attacks. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error message when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode.
+
+Windows takes ownership of the TPM ownership upon first boot. By default, Windows doesn't retain the TPM owner password.
+
+In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values.
+
+### TPM 1.2
+
+The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. These delays can prevent them from using the TPM for a period of time.
+
+### TPM 2.0
+
+TPM 2.0 devices have standardized lockout behavior which Windows configures. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 10 minutes. This configuration means that every continuous 10 minutes of powered on operation without an event causes the counter to decrease by 1.
+
+If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner's authorization. This value is no longer retained by default starting with Windows 10 version 1607 and higher.
+
+## Reset the TPM lockout by using the TPM MMC
+
+> [!NOTE]
+>
+> This procedure is only available if you have configured Windows to retain the TPM Owner Password. By default, this password isn't available in Windows 10 starting with version 1607 and higher.
+
+The following procedure explains the steps to reset the TPM lockout by using the TPM MMC.
+
+### Reset the TPM lockout
+
+1. Open the TPM MMC (tpm.msc).
+
+1 In the **Action** pane, select **Reset TPM Lockout** to start the Reset TPM Lockout Wizard.
+
+1. Choose one of the following methods to enter the TPM owner password:
+
+ - If you saved your TPM owner password to a `.tpm` file, select **I have the owner password file**, and then type the path to the file, or select **Browse** to navigate to the file location.
+
+ - If you want to manually enter your TPM owner password, select **I want to enter the owner password**, and then type the password in the text box provided.
+
+ > [!NOTE]
+ >
+ > If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it.
+
+## Use Group Policy to manage TPM lockout settings
+
+The TPM Group Policy settings in the following list are located at:
+
+**Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**
+
+- [Standard User Lockout Duration](trusted-platform-module-services-group-policy-settings.md#standard-user-lockout-duration)
+
+ This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for TPM commands that require authorization. An authorization failure occurs each time a user sends a command to the TPM and receives an error message that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, the user is prevented from sending commands to the TPM that require authorization.
+
+- [Standard User Individual Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#standard-user-individual-lockout-threshold)
+
+ This policy setting allows you to manage the maximum number of authorization failures for the TPM for each user. This value is the maximum number of authorization failures that each user can have before the user isn't allowed to send commands to the TPM that require authorization. If the number of authorization failures equals the duration that is set for the policy setting, the user is prevented from sending commands to the TPM that require authorization.
+
+- [Standard User Total Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#standard-user-total-lockout-threshold)
+
+ This policy setting allows you to manage the maximum number of authorization failures for the TPM for all standard users. If the total number of authorization failures for all users equals the duration that is set for the policy, all users are prevented from sending commands to the TPM that require authorization.
+
+For information about mitigating dictionary attacks that use the lockout settings, see [TPM fundamentals](tpm-fundamentals.md#anti-hammering).
+
+## Use the TPM cmdlets
+
+You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/).
+
+## Related articles
+
+- [Trusted Platform Module](trusted-platform-module-top-node.md)
diff --git a/windows/security/threat-protection/security-policy-settings/TOC.yml b/windows/security/threat-protection/security-policy-settings/TOC.yml
index 1e4b1fa586..df9030461f 100644
--- a/windows/security/threat-protection/security-policy-settings/TOC.yml
+++ b/windows/security/threat-protection/security-policy-settings/TOC.yml
@@ -1,22 +1,22 @@
- name: Security policy settings
href: security-policy-settings.md
- items:
+ items:
- name: Administer security policy settings
href: administer-security-policy-settings.md
- items:
+ items:
- name: Network List Manager policies
href: network-list-manager-policies.md
- name: Configure security policy settings
href: how-to-configure-security-policy-settings.md
- name: Security policy settings reference
href: security-policy-settings-reference.md
- items:
+ items:
- name: Account Policies
href: account-policies.md
- items:
+ items:
- name: Password Policy
href: password-policy.md
- items:
+ items:
- name: Enforce password history
href: enforce-password-history.md
- name: Maximum password age
@@ -31,7 +31,7 @@
href: store-passwords-using-reversible-encryption.md
- name: Account Lockout Policy
href: account-lockout-policy.md
- items:
+ items:
- name: Account lockout duration
href: account-lockout-duration.md
- name: Account lockout threshold
@@ -40,7 +40,7 @@
href: reset-account-lockout-counter-after.md
- name: Kerberos Policy
href: kerberos-policy.md
- items:
+ items:
- name: Enforce user logon restrictions
href: enforce-user-logon-restrictions.md
- name: Maximum lifetime for service ticket
@@ -55,7 +55,7 @@
href: audit-policy.md
- name: Security Options
href: security-options.md
- items:
+ items:
- name: "Accounts: Administrator account status"
href: accounts-administrator-account-status.md
- name: "Accounts: Block Microsoft accounts"
@@ -92,6 +92,8 @@
href: devices-restrict-floppy-access-to-locally-logged-on-user-only.md
- name: "Domain controller: Allow server operators to schedule tasks"
href: domain-controller-allow-server-operators-to-schedule-tasks.md
+ - name: "Domain controller: LDAP server channel binding token requirements"
+ href: domain-controller-ldap-server-channel-binding-token-requirements.md
- name: "Domain controller: LDAP server signing requirements"
href: domain-controller-ldap-server-signing-requirements.md
- name: "Domain controller: Refuse machine account password changes"
@@ -250,7 +252,7 @@
href: secpol-advanced-security-audit-policy-settings.md
- name: User Rights Assignment
href: user-rights-assignment.md
- items:
+ items:
- name: Access Credential Manager as a trusted caller
href: access-credential-manager-as-a-trusted-caller.md
- name: Access this computer from the network
diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md
new file mode 100644
index 0000000000..24614ad5c4
--- /dev/null
+++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md
@@ -0,0 +1,90 @@
+---
+title: Domain controller LDAP server channel binding token requirements
+description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server channel binding token requirements security policy setting.
+ms.reviewer: waynmc
+ms.author: waynmc
+ms.prod: windows-client
+ms.localizationpriority: medium
+author: vinaypamnani-msft
+manager: aaroncz
+ms.topic: conceptual
+ms.date: 04/26/2023
+ms.technology: itpro-security
+---
+
+# Domain controller: LDAP server channel binding token requirements
+
+**Applies to**:
+
+- Windows Server
+
+This article describes the best practices, location, values, and security considerations for the **Domain controller: LDAP server channel binding token requirements** security policy setting.
+
+## Reference
+
+This policy setting determines whether the Lightweight Directory Access Protocol (LDAP) server requires LDAP clients to negotiate channel bindings (EPA).
+
+Unsigned/Unprotected network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client device and modifies them before forwarding them to the client device. In the example of an LDAP server, a malicious user can cause a client device to make decisions based on false records from the LDAP directory. You can lower this risk in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) Authentication Header mode, which provides mutual authentication and packet integrity for IP traffic, can make all types of man-in-the-middle attacks difficult.
+
+- If channel binding is set to Always, LDAP clients who don't support channel bindings will be rejected.
+- If channel binding is set to when supported, only incorrect channel bindings will be blocked, and clients who don't support channel binding can continue to connect via LDAP over TLS.
+
+CBT or EPA is used with TLS sessions when a SASL authentication method is used to authenticate the user. SASL means you use NTLM or Kerberos for user authentication. LDAP Simple Bind over TLS doesn't offer channel binding token protection and is therefore not recommended.
+
+### Possible values
+
+- **Never**: No channel binding validation is performed. This is the behavior of all servers that haven't been updated.
+- **When Supported**: Clients that advertise support for Channel Binding Tokens must provide the correct token when authenticating over TLS/SSL connections; clients that don't advertise such support and/or don't use TLS/SSL connections aren't impacted. This is an intermediate option that allows for application compatibility.
+- **Always**: All clients must provide channel binding information over LDAPS. The server rejects LDAPS authentication requests from clients that don't do so.
+
+### Best practices
+
+We recommend that you set **Domain controller: LDAP server channel binding token requirements** to **Always**. Clients that don't support LDAP channel binding will be unable to execute LDAP queries against the domain controllers.
+
+### Location
+
+Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+
+### Default values
+
+The following table lists the actual and effective default values for this policy. Default values are also listed on the policy's property page.
+
+| Server type or GPO | Default value |
+|--------------------------------------------|---------------|
+| Default Domain Policy | Not defined |
+| Default Domain Controller Policy | Not defined |
+| Stand-Alone Server Default Settings | Not defined |
+| DC Effective Default Settings | None |
+| Member Server Effective Default Settings | None |
+| Client Computer Effective Default Settings | None |
+
+## Policy management
+
+This section describes features and tools that are available to help you manage this policy.
+
+### Restart requirement
+
+None. Changes to this policy become effective without a device restart when they're saved locally or distributed through Group Policy.
+
+## Security considerations
+
+This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
+
+### Vulnerability
+
+Unsigned/Unprotected network traffic is susceptible to man-in-the-middle attacks. In such attacks, an intruder captures packets between the server and the client device, modifies them, and then forwards them to the client device. Regarding LDAP servers, an attacker could cause a client device to make decisions that are based on false records from the LDAP directory. To lower the risk of such an intrusion in an organization's network, you can implement strong physical security measures to protect the network infrastructure. You could also implement Internet Protocol security (IPsec) Authentication Header mode, which performs mutual authentication and packet integrity for IP traffic to make all types of man-in-the-middle attacks difficult.
+
+### Countermeasure
+
+Configure the **Domain controller: LDAP server channel binding token requirements** setting to **Always**.
+
+### Potential impact
+
+Client devices that don't support LDAP channel binding can't run LDAP queries against the domain controllers.
+
+## Related articles
+
+- [Security Options](security-options.md)
+- [LDAP session security settings and requirements after ADV190023 is installed](/troubleshoot/windows-server/identity/ldap-session-security-settings-requirements-adv190023)
+- [2020 LDAP channel binding and LDAP signing requirements for Windows (KB4520412)](https://support.microsoft.com/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a)
+- [KB4034879: Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure](https://support.microsoft.com/topic/kb4034879-use-the-ldapenforcechannelbinding-registry-entry-to-make-ldap-authentication-over-ssl-tls-more-secure-e9ecfa27-5e57-8519-6ba3-d2c06b21812e)
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
index e9790d83e9..e9dc1bb0cc 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
@@ -5,7 +5,7 @@ ms.prod: windows-client
author: vinaypamnani-msft
ms.author: vinpa
manager: aaroncz
-ms.collection:
+ms.collection:
- highpri
- tier2
ms.topic: article
@@ -53,7 +53,7 @@ To create a configuration file:
To use a configuration file, double-click it to start Windows Sandbox according to its settings. You can also invoke it via the command line as shown here:
```batch
-C:\Temp> MyConfigFile.wsb
+C:\Temp> MyConfigFile.wsb
```
## Keywords, values, and limits
@@ -80,6 +80,7 @@ Enables or disables networking in the sandbox. You can disable network access to
`value`
Supported values:
+
- *Enable*: Enables networking in the sandbox.
- *Disable*: Disables networking in the sandbox.
- *Default*: This value is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC.
@@ -93,12 +94,12 @@ An array of folders, each representing a location on the host machine that will
```xml
-
- absolute path to the host folder
- absolute path to the sandbox folder
- value
+
+ absolute path to the host folder
+ absolute path to the sandbox folder
+ value
-
+
...
@@ -110,8 +111,7 @@ An array of folders, each representing a location on the host machine that will
*ReadOnly*: If *true*, enforces read-only access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*.
-
-> [!NOTE]
+> [!NOTE]
> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host.
### Logon command
@@ -136,13 +136,14 @@ Enables or disables audio input to the sandbox.
`value`
Supported values:
+
- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may require this capability.
- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting.
- *Default*: This value is the default value for audio input support. Currently, this default value denotes that audio input is enabled.
> [!NOTE]
> There may be security implications of exposing host audio input to the container.
-
+
### Video input
Enables or disables video input to the sandbox.
@@ -150,7 +151,8 @@ Enables or disables video input to the sandbox.
`value`
Supported values:
-- *Enable*: Enables video input in the sandbox.
+
+- *Enable*: Enables video input in the sandbox.
- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox.
- *Default*: This value is the default value for video input support. Currently, this default value denotes that video input is disabled. Applications that use video input may not function properly in the sandbox.
@@ -164,6 +166,7 @@ Applies more security settings to the sandbox Remote Desktop client, decreasing
`value`
Supported values:
+
- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled.
- *Disable*: Runs the sandbox in standard mode without extra security mitigations.
- *Default*: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode.
@@ -178,6 +181,7 @@ Enables or disables printer sharing from the host into the sandbox.
`value`
Supported values:
+
- *Enable*: Enables sharing of host printers into the sandbox.
- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host.
- *Default*: This value is the default value for printer redirection support. Currently, this default value denotes that printer redirection is disabled.
@@ -189,8 +193,9 @@ Enables or disables sharing of the host clipboard with the sandbox.
`value`
Supported values:
+
- *Enable*: Enables sharing of the host clipboard with the sandbox.
-- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted.
+- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted.
- *Default*: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*.
### Memory in MB
@@ -202,6 +207,7 @@ Specifies the amount of memory that the sandbox can use in megabytes (MB).
If the memory value specified is insufficient to boot a sandbox, it will be automatically increased to the required minimum amount.
## Example 1
+
The following config file can be used to easily test the downloaded files inside the sandbox. To achieve this testing, networking and vGPU are disabled, and the sandbox is allowed read-only access to the shared downloads folder. For convenience, the logon command opens the downloads folder inside the sandbox when it's started.
### Downloads.wsb
@@ -233,7 +239,7 @@ With the Visual Studio Code installer script already mapped into the sandbox, th
### VSCodeInstall.cmd
-Download vscode to `downloads` folder and run from `downloads` folder
+Download vscode to `downloads` folder and run from `downloads` folder.
```batch
REM Download Visual Studio Code
@@ -264,3 +270,41 @@ C:\users\WDAGUtilityAccount\Downloads\vscode.exe /verysilent /suppressmsgboxes
```
+
+## Example 3
+
+The following config file runs a PowerShell script as a logon command to swap the primary mouse button for left-handed users.
+
+`C:\sandbox` folder on the host is mapped to the `C:\sandbox` folder in the sandbox, so the `SwapMouse.ps1` script can be referenced in the sandbox configuration file.
+
+### SwapMouse.ps1
+
+Create a powershell script using the following code, and save it in the `C:\sandbox` directory as `SwapMouse.ps1`.
+
+```powershell
+[Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null
+
+$SwapButtons = Add-Type -MemberDefinition @'
+[DllImport("user32.dll")]
+public static extern bool SwapMouseButton(bool swap);
+'@ -Name "NativeMethods" -Namespace "PInvoke" -PassThru
+
+$SwapButtons::SwapMouseButton(!([System.Windows.Forms.SystemInformation]::MouseButtonsSwapped))
+```
+
+### SwapMouse.wsb
+
+```xml
+
+
+
+ C:\sandbox
+ C:\sandbox
+ True
+
+
+
+ powershell.exe -ExecutionPolicy Bypass -File C:\sandbox\SwapMouse.ps1
+
+
+```
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
index 6e2f83d198..74e81b1a05 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
@@ -5,7 +5,7 @@ ms.prod: windows-client
author: vinaypamnani-msft
ms.author: vinpa
manager: aaroncz
-ms.collection:
+ms.collection:
- highpri
- tier2
ms.topic: article
@@ -22,6 +22,7 @@ A sandbox is temporary. When it's closed, all the software and files and the sta
Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment.
Windows Sandbox has the following properties:
+
- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD.
- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows.
- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application.
@@ -32,13 +33,17 @@ Windows Sandbox has the following properties:
> Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file#networking).
## Prerequisites
-
-- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Windows Home edition*)
-- AMD64 or (as of [Windows 11 Build 22483](https://blogs.windows.com/windows-insider/2021/10/20/announcing-windows-11-insider-preview-build-22483/)) ARM64 architecture
+
+- Windows 10, version 1903 and later, or Windows 11
+- Windows Pro, Enterprise or Education edition
+- ARM64 (for Windows 11, version 22H2 and later) or AMD64 architecture
- Virtualization capabilities enabled in BIOS
- At least 4 GB of RAM (8 GB recommended)
- At least 1 GB of free disk space (SSD recommended)
-- At least two CPU cores (four cores with hyperthreading recommended)
+- At least two CPU cores (four cores with hyper-threading recommended)
+
+> [!NOTE]
+> Windows Sandbox is currently not supported on Windows Home edition
## Installation
@@ -59,7 +64,7 @@ Windows Sandbox has the following properties:
> [!NOTE]
> To enable Sandbox using PowerShell, open PowerShell as Administrator and run the following command:
- >
+ >
> ```powershell
> Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online
> ```
@@ -67,9 +72,10 @@ Windows Sandbox has the following properties:
4. Locate and select **Windows Sandbox** on the Start menu to run it for the first time.
> [!NOTE]
- > Windows Sandbox does not adhere to the mouse settings of the host system, so if the host system is set to use a right-handed mouse, you should apply these settings in Windows Sandbox manually.
+ > Windows Sandbox does not adhere to the mouse settings of the host system, so if the host system is set to use a left-handed mouse, you must apply these settings in Windows Sandbox manually when Windows Sandbox starts. Alternatively, you can use a sandbox configuration file to run a logon command to swap the mouse setting. For an example, see [Example 3](windows-sandbox-configure-using-wsb-file.md#example-3).
+
+## Usage
-## Usage
1. Copy an executable file (and any other files needed to run the application) from the host and paste them into the **Windows Sandbox** window.
2. Run the executable file or installer inside the sandbox.