mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 04:13:41 +00:00
update manager alias
This commit is contained in:
Aaron Czechowski
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
@ -14,8 +14,8 @@ A deployment audience is a collection of devices that you want to deploy updates
|
||||
1. To create a new audience, **POST** to the [deployment audience](/graph/api/resources/windowsupdates-deploymentaudience) resource with a request body of `{}`.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences
|
||||
content-type: application/json
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences
|
||||
content-type: application/json
|
||||
|
||||
{}
|
||||
```
|
||||
@ -35,8 +35,8 @@ A deployment audience is a collection of devices that you want to deploy updates
|
||||
1. Add devices, using their **Microsoft Entra ID**, to the deployment audience so they become audience members. Specify the deployment **Audience ID** in the URL field and the devices to add in the request body. The `id` property specifies the **Microsoft Entra ID** of the device.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
@ -10,7 +10,7 @@ ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by windows-autopatch-driver-and-firmware-programmatic-controls.md, windows-autopatch-troubleshoot-programmatic-controls.md, and the deployment-service-prerequisites.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
It's possible for the service to receive content approval but the content doesn't get installed on the device because of a Group Policy, CSP, or registry setting on the device. In some cases, organizations specifically configure these policies to fit their current or future needs. For instance, organizations may want to review applicable driver content, but not allow installation. Configuring this sort of behavior can be useful, especially when transitioning management of driver updates due to changing organizational needs. The following list describes driver related update policies that can affect deployments:
|
||||
It's possible for the service to receive content approval but the content doesn't get installed on the device because of a Group Policy, CSP, or registry setting on the device. In some cases, organizations specifically configure these policies to fit their current or future needs. For instance, organizations may want to review applicable driver content, but not allow installation. Configuring this sort of behavior can be useful, especially when transitioning management of driver updates due to changing organizational needs. The following list describes driver related update policies that can affect deployments:
|
||||
|
||||
### Policies that exclude drivers from Windows Update for a device
|
||||
|
||||
@ -20,7 +20,7 @@ The following policies exclude drivers from Windows Update for a device:
|
||||
- **Group Policy**: `\Windows Components\Windows Update\Do not include drivers with Windows Updates` set to `enabled`
|
||||
- **CSP**: [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#excludewudriversinqualityupdate) set to `1`
|
||||
- **Registry**: `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversFromQualityUpdates` set to `1`
|
||||
- **Intune**: [**Windows Drivers** update setting](/mem/intune/protect/windows-update-settings#update-settings) for the update ring set to `Block`
|
||||
- **Intune**: [**Windows Drivers** update setting](/mem/intune/protect/windows-update-settings#update-settings) for the update ring set to `Block`
|
||||
|
||||
**Behavior**: Devices with driver exclusion polices that are enrolled for **drivers** and added to an audience:
|
||||
- Will display the applicable driver content
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
@ -28,6 +28,6 @@ For this article, you'll use Graph Explorer to make requests to the [Microsoft G
|
||||
1. Enter the request into the URL field. The version will populate automatically based on the URL.
|
||||
1. If you need to modify the request body, edit the **Request body** tab.
|
||||
1. Select the **Run query** button. The results will appear in the **Response** window.
|
||||
|
||||
|
||||
> [!TIP]
|
||||
> When reviewing [Microsoft Graph documentation](/graph/), you may notice example requests usually list `content-type: application/json`. Specifying `content-type` typically isn't required for Graph Explorer, but you can add it to the request by selecting the **Headers** tab and adding the `content-type` to the **Request headers** field as the **Key** and `application/json` as the **Value**.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: include
|
||||
@ -15,7 +15,7 @@ The Update Health Tools are used when you deploy expedited updates. In some case
|
||||
|
||||
**Log location**: `%ProgramFiles%\Microsoft Update Health Tools\Logs`
|
||||
|
||||
- The logs are in `.etl` format.
|
||||
- The logs are in `.etl` format.
|
||||
- Microsoft offers [PerfView as a download on GitHub](https://github.com/Microsoft/perfview/blob/main/documentation/Downloading.md), which displays `.etl` files.
|
||||
|
||||
For more information, see [Troubleshooting expedited updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-the-most-out-of-expedited-windows-quality-updates/ba-p/3659741).
|
||||
|
||||
@ -10,7 +10,7 @@ metadata:
|
||||
ms.topic: landing-page # Required
|
||||
author: tiaraquan #Required; your GitHub user alias, with correct capitalization.
|
||||
ms.author: tiaraquan #Required; microsoft alias of author; optional team alias.
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.date: 08/27/2024 #Required; mm/dd/yyyy format.
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
---
|
||||
title: Programmatic controls for drivers and firmware
|
||||
titleSuffix: Windows Autopatch
|
||||
titleSuffix: Windows Autopatch
|
||||
description: Use programmatic controls to deploy driver and firmware updates to devices.
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: how-to
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/31/2025
|
||||
@ -87,7 +87,7 @@ To create a policy without any deployment settings, in the request body specify
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
|
||||
{
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567"
|
||||
@ -129,7 +129,7 @@ To create a policy with additional settings, in the request body:
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.updatePolicy",
|
||||
"audience": {
|
||||
@ -193,7 +193,7 @@ Once Windows Autopatch has scan results from devices, the applicability for driv
|
||||
- The **Microsoft Entra ID** of the devices it's applicable to
|
||||
- Information describing the update such as the name and version.
|
||||
|
||||
To display [applicable content](/graph/api/resources/windowsupdates-applicablecontent), run a query using the **Audience ID**, for example `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
To display [applicable content](/graph/api/resources/windowsupdates-applicablecontent), run a query using the **Audience ID**, for example `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/applicableContent
|
||||
@ -202,7 +202,7 @@ GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d
|
||||
The following truncated response displays:
|
||||
|
||||
- An **Microsoft Entra ID** of `01234567-89ab-cdef-0123-456789abcdef`
|
||||
- The **Catalog ID** of `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`
|
||||
- The **Catalog ID** of `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`
|
||||
|
||||
```json
|
||||
"matchedDevices": [
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -32,7 +32,7 @@ For a device to be eligible for Microsoft Edge updates as a part of Windows Auto
|
||||
|
||||
With the expanded Autopatch group capabilities, you can choose to enable Microsoft Edge updates on a per Autopatch group level. Depending on your tenant settings, one of the following scenarios occurs:
|
||||
|
||||
- Tenants that previously turned on Autopatch Microsoft Edge updates, has the Microsoft Edge updates Update Type checkbox selected, and the updated policies applied to each Autopatch group.
|
||||
- Tenants that previously turned on Autopatch Microsoft Edge updates, has the Microsoft Edge updates Update Type checkbox selected, and the updated policies applied to each Autopatch group.
|
||||
- Tenants that previously turned off Autopatch Microsoft Edge updates, or are new to Windows Autopatch, Autopatch Microsoft Edge updates remain turned off.
|
||||
|
||||
If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group) and selected Microsoft Edge updates as a content type, the **Update Type** checkbox is **selected**, with new policies created and any available old policies are removed. If you didn’t select Microsoft Edge updates as a content type upon creating an Autopatch group, the **Update Type** checkbox is **unselected**. Any available customized policies are retained and appear in the **Policies** tab.
|
||||
@ -43,11 +43,11 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Select **Microsoft Edge updates**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Select **Microsoft Edge updates**.
|
||||
1. Select **Next: Deployment settings** > **Next: Release schedules** > **Next: Review + save** > **Save** to save these changes.
|
||||
1. We recommend deleting old Autopatch default policies to avoid policy conflict. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. We recommend deleting old Autopatch default policies to avoid policy conflict. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. Manually remove the following profiles related to Microsoft Edge
|
||||
1. Windows Autopatch - Microsoft Edge Update Channel Beta
|
||||
1. Windows Autopatch - Microsoft Edge Update Channel Stable
|
||||
@ -61,9 +61,9 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Unselect **Microsoft Edge updates**.
|
||||
1. Unselect **Microsoft Edge updates**.
|
||||
1. Select **Next: Deployment settings** > **Next: Release schedules** > **Next: Review + save** > **Save** to save these changes.
|
||||
|
||||
### Verify Microsoft Edge updates policies
|
||||
@ -71,7 +71,7 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
**To verify Microsoft Edge updates policies:**
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Verify each Autopatch group has the **Microsoft Edge Update Type** checkbox **selected**.
|
||||
1. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. The following new policies should be discoverable from the list of profiles:
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- tier2
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -33,12 +33,12 @@ Autopatch groups create one Windows 10 Update Ring policy for each deployment ri
|
||||
|
||||
## Feature update policy for Windows 10 and later
|
||||
|
||||
If features updates are [selected as a content type for an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group), a feature update policy is created with the Microsoft Entra groups for each update ring assigned to it. This policy does the following:
|
||||
If features updates are [selected as a content type for an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group), a feature update policy is created with the Microsoft Entra groups for each update ring assigned to it. This policy does the following:
|
||||
|
||||
- Ensures existing devices on the target version don’t update beyond that version.
|
||||
- If new devices are added to the Autopatch group and are below your target version, the devices are updated to the target version.
|
||||
- If new devices are added to the Autopatch group and are below your target version, the devices are updated to the target version.
|
||||
|
||||
To achieve this outcome, the feature update policy is configured for immediate start as required.
|
||||
To achieve this outcome, the feature update policy is configured for immediate start as required.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To safely deploy a new feature update, Autopatch recommends using a custom Windows feature update release. The custom release allows you to choose how and when different deployment rings receive the update. Autopatch doesn't recommend updating the minimum version within an Autopatch group until your rollout is complete. Doing so initiates a rollout which starts immediately for all members of that group.<p>Once you create a custom Windows feature update release, the Autopatch group's deployment rings are unassigned from that group’s feature update policy.</p>
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -68,11 +68,11 @@ You can also use the CSP DisableCHPE (available on Windows Insider Preview). For
|
||||
> [!NOTE]
|
||||
> There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don’t have CHPE.
|
||||
|
||||
If you choose to no longer use Hotpatch updates, clear the CHPE disable flag (`HotPatchRestrictions=0`) then restart the device to turn on CHPE usage.
|
||||
If you choose to no longer use Hotpatch updates, clear the CHPE disable flag (`HotPatchRestrictions=0`) then restart the device to turn on CHPE usage.
|
||||
|
||||
## Ineligible devices
|
||||
|
||||
Devices that don't meet one or more prerequisites automatically receive the Latest Cumulative Update (LCU) instead. Latest Cumulative Update (LCU) contains monthly updates that supersede the previous month's updates containing both security and nonsecurity releases.
|
||||
Devices that don't meet one or more prerequisites automatically receive the Latest Cumulative Update (LCU) instead. Latest Cumulative Update (LCU) contains monthly updates that supersede the previous month's updates containing both security and nonsecurity releases.
|
||||
|
||||
LCUs requires you to restart the device, but the LCU ensures that the device remains fully secure and compliant.
|
||||
|
||||
@ -149,7 +149,7 @@ For the latest release schedule, see the [hotpatch release notes](https://suppor
|
||||
|
||||
### Step 3: Verify the device is properly configured to turn on hotpatch updates
|
||||
|
||||
1. In Intune, review your configured policies within Autopatch to see which groups of devices are targeted with a hotpatch policy by going to the **Windows Update** > **Quality Updates** page.
|
||||
1. In Intune, review your configured policies within Autopatch to see which groups of devices are targeted with a hotpatch policy by going to the **Windows Update** > **Quality Updates** page.
|
||||
1. Ensure the hotpatch update policy is set to **Allow**.
|
||||
1. On the device, select **Start** > **Settings** > **Windows Update** > **Advanced options** > **Configured update policies** > find **Enable hotpatching when available**. This setting indicates that the device is enrolled in hotpatch updates as configured by Autopatch.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -31,7 +31,7 @@ You can manage and control your driver and firmware updates by:
|
||||
|
||||
The Autopatch service creates additional driver profiles on a per-deployment ring and per group basis within your tenant.
|
||||
|
||||
Choosing between Automatic and Manual modes can be done per-deployment ring and/or per Autopatch group. For a single Autopatch group, a mix of both Automatic and Manual policies is allowed. If you were previously in Manual mode, we create Manual policies for all your group rings. If Automatic (the default) was previously used, we create Automatic policies instead.
|
||||
Choosing between Automatic and Manual modes can be done per-deployment ring and/or per Autopatch group. For a single Autopatch group, a mix of both Automatic and Manual policies is allowed. If you were previously in Manual mode, we create Manual policies for all your group rings. If Automatic (the default) was previously used, we create Automatic policies instead.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you switch between Automatic and Manual modes, new policies are generated to **replace old policies**. **You’ll lose any approvals, paused drivers, and declined drivers previously made for those groups and/or deployment rings**.
|
||||
@ -67,9 +67,9 @@ Choosing between Automatic and Manual modes can be done per-deployment ring and/
|
||||
|
||||
For deployment rings set to **Automatic**, you can choose the deferral period for driver and firmware updates. The deferral period is the number of days that you must wait to deploy after a driver becomes available. By default, these deferral values match the values you set for your Windows quality updates.
|
||||
|
||||
The deferral period allows you to delay the installation of driver and firmware updates on the devices in the specified deployment ring in case you want to test the update on a smaller group of devices first or avoid potential disruptions during a busy period.
|
||||
The deferral period allows you to delay the installation of driver and firmware updates on the devices in the specified deployment ring in case you want to test the update on a smaller group of devices first or avoid potential disruptions during a busy period.
|
||||
|
||||
The deferral period can be set from 0 to 30 days, and it can be different for each deployment ring.
|
||||
The deferral period can be set from 0 to 30 days, and it can be different for each deployment ring.
|
||||
|
||||
> [!NOTE]
|
||||
> The deferral period only applies to automatically approved driver and firmware updates. An admin must specify the date to start offering a driver with any manual approval.
|
||||
@ -88,7 +88,7 @@ When an OEM releases a newer update version that qualifies to be the new recomme
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), navigate to **Devices** > **Manage updates** > **Windows updates** > **Driver updates**.
|
||||
1. Select **Manage drivers for Autopatch groups** or select one of the **Drivers to review** links.
|
||||
1. Select the driver or drivers you’d like to manage.
|
||||
1. Select the driver or drivers you’d like to manage.
|
||||
1. Select **Manage**. You can either:
|
||||
1. Approve for all policies
|
||||
2. Decline for all unreviewed policies
|
||||
@ -128,6 +128,6 @@ These updates can include:
|
||||
1. Approve for all policies
|
||||
2. Decline for all unreviewed policies
|
||||
3. Manage for individual policies
|
||||
1. In the **Approve for all policies** dropdown, select the date to make the driver available through Windows Update.
|
||||
1. In the **Approve for all policies** dropdown, select the date to make the driver available through Windows Update.
|
||||
1. In the **Manage for individual policies** dropdown, select the policies to approve or decline the driver.
|
||||
1. Select **Save**.
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -74,7 +74,7 @@ To ensure that users are receiving automatic updates, Windows Autopatch prevents
|
||||
|
||||
With the expanded Autopatch group capabilities, you can choose to turn on Microsoft 365 Apps updates on a per Autopatch group level. Depending on your tenant settings, one of the following scenarios occurs:
|
||||
|
||||
- Tenants that previously turned on Autopatch Microsoft 365 Apps update, has the Microsoft 365 Apps updates Update Type checkbox selected and the updated policies applied to each Autopatch group.
|
||||
- Tenants that previously turned on Autopatch Microsoft 365 Apps update, has the Microsoft 365 Apps updates Update Type checkbox selected and the updated policies applied to each Autopatch group.
|
||||
- Tenants that previously turned off Autopatch Microsoft 365 Apps updates, or are new to Windows Autopatch, Autopatch Microsoft 365 Apps updates remain turned off.
|
||||
|
||||
If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group) and selected Microsoft 365 apps updates as a content type, the **Update Type** checkbox is **selected**, with new policies created, and any available old policies are removed. If you didn’t select Microsoft 365 apps updates as a content type upon creating an Autopatch group, the **Update Type** checkbox is **unselected**. Any available customized policies are retained and appear in the **Policies** tab.
|
||||
@ -85,11 +85,11 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Select **Microsoft 365 Apps updates**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Select **Microsoft 365 Apps updates**.
|
||||
1. Select **Next: Deployment settings** > **Next: Release schedules** > **Next: Review + save** > **Save** to save these changes.
|
||||
1. We recommend deleting old Autopatch default policies to avoid policy conflict. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. We recommend deleting old Autopatch default policies to avoid policy conflict. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. Manually remove the following profiles related to Microsoft 365 Apps:
|
||||
1. Windows Autopatch - Office Configuration
|
||||
2. Windows Autopatch - Office Update Configuration [Test]
|
||||
@ -98,7 +98,7 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
5. Windows Autopatch - Office Update Configuration [Broad]
|
||||
|
||||
> [!NOTE]
|
||||
> If you previously selected **Microsoft 365 Apps updates** when [creating an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group), but your tenant isn't showing the new updates, there’s a possibility that you previously modified the policy. To ensure there are no disruptions, the Autopatch Service retains that policy.
|
||||
> If you previously selected **Microsoft 365 Apps updates** when [creating an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group), but your tenant isn't showing the new updates, there’s a possibility that you previously modified the policy. To ensure there are no disruptions, the Autopatch Service retains that policy.
|
||||
|
||||
### Turn off Microsoft 365 Apps updates
|
||||
|
||||
@ -106,9 +106,9 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Select an Autopatch group to modify (repeat these steps for each group).
|
||||
1. Next to **Update types**, select **Edit**.
|
||||
1. Unselect **Microsoft 365 Apps updates**.
|
||||
1. Unselect **Microsoft 365 Apps updates**.
|
||||
1. Select **Next: Deployment settings** > **Next: Release schedules** > **Next: Review + save** > **Save** to save these changes.
|
||||
|
||||
### Verify Microsoft 365 Apps updates policies
|
||||
@ -116,7 +116,7 @@ If you [created an Autopatch group](../manage/windows-autopatch-manage-autopatch
|
||||
**To verify Microsoft 365 Apps updates policies:**
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Navigate to **Tenant Administration** > **Windows Autopatch** > **Autopatch groups**.
|
||||
1. Verify each Autopatch group has the **Microsoft 365 Apps Update Type** checkbox **selected**.
|
||||
1. Navigate to **Devices** > **Manage devices** > **Configuration** > **Policies** tab.
|
||||
1. The following new policies should be discoverable from the list of profiles:
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- tier2
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -30,7 +30,7 @@ Support requests are triaged and responded to as they're received.
|
||||
1. In the **Help** section, enter your questions and/or a description of the issue.
|
||||
1. Review the links that are provided to try to help with the issue.
|
||||
1. If the answers that were given don't help you resolve the issue, select **Contact support** at the bottom of the page.
|
||||
1. Follow the instructions to file a support request with Windows Autopatch. Make sure you provide the correct primary contact information for this specific support ticket.
|
||||
1. Follow the instructions to file a support request with Windows Autopatch. Make sure you provide the correct primary contact information for this specific support ticket.
|
||||
1. When you're ready, select **Contact me**.
|
||||
|
||||
## Premier and Unified support options
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -7,11 +7,11 @@ ms.subservice: autopatch
|
||||
ms.topic: troubleshooting
|
||||
ms.author: tiaraquan
|
||||
author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/31/2025
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: overview
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
---
|
||||
title: Programmatic controls for feature updates
|
||||
title: Programmatic controls for feature updates
|
||||
titleSuffix: Windows Autopatch
|
||||
description: Use programmatic controls to deploy feature updates to devices in your organization.
|
||||
description: Use programmatic controls to deploy feature updates to devices in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: how-to
|
||||
ms.author: tiaraquan
|
||||
author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/31/2025
|
||||
@ -101,7 +101,7 @@ The following truncated response displays a **Catalog ID** of `d9049ddb-0ca8-4b
|
||||
|
||||
## Create a deployment
|
||||
|
||||
When creating a deployment for a feature update, there are multiple options available to define how the deployment behaves. The deployment and monitoring settings are optional. The following [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) are defined in the example request body for deploying the Windows 11, version 22H2 feature update (**Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f`):
|
||||
When creating a deployment for a feature update, there are multiple options available to define how the deployment behaves. The deployment and monitoring settings are optional. The following [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) are defined in the example request body for deploying the Windows 11, version 22H2 feature update (**Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f`):
|
||||
|
||||
- Deployment [start date](/graph/api/resources/windowsupdates-schedulesettings) of February 14, 2023 at 5 AM UTC
|
||||
- [Gradual rollout](/graph/api/resources/windowsupdates-gradualrolloutsettings) at a rate of 100 devices every three days
|
||||
@ -207,7 +207,7 @@ The response body contains:
|
||||
|
||||
To [update deployment](/graph/api/windowsupdates-deployment-update), PATCH the deployment resource by its **Deployment ID** and supply the updated settings in the request body. The following example keeps the existing gradual rollout settings that were defined when creating the deployment but changes the deployment start date to February 28, 2023 at 5 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
content-type: application/json
|
||||
|
||||
@ -235,7 +235,7 @@ GET https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-
|
||||
|
||||
## Add members to the deployment audience
|
||||
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update is offered.
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update is offered.
|
||||
|
||||
The following example adds three devices to the deployment audience using the **Microsoft Entra ID** for each device:
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
---
|
||||
title: Programmatic controls for expedited Windows quality updates
|
||||
titleSuffix: Windows Autopatch
|
||||
description: Use programmatic controls to deploy expedited Windows quality updates to devices in your organization.
|
||||
description: Use programmatic controls to deploy expedited Windows quality updates to devices in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: autopatch
|
||||
ms.topic: how-to
|
||||
ms.author: tiaraquan
|
||||
author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/31/2025
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- tier2
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: smithcharles
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: rekhanr
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -37,20 +37,20 @@ With this feature, IT admins can view:
|
||||
|
||||
Alerts are raised when devices report policy conflicts. Autopatch policies are assigned to Autopatch groups. Devices that are members of Autopatch groups are expected to receive only Windows Autopatch policies.
|
||||
|
||||
Once you resolve the conflict, it can take effect on the device at the next Intune sync. This view is refreshed every 24 hours. It can take up to 72 hours after the conflict is resolved for the view to be updated.
|
||||
Once you resolve the conflict, it can take effect on the device at the next Intune sync. This view is refreshed every 24 hours. It can take up to 72 hours after the conflict is resolved for the view to be updated.
|
||||
|
||||
> [!NOTE]
|
||||
> This view only includes policy conflicts between Microsoft Intune policies. This view doesn't include policy issues caused by other configurations, for example, group policy settings, registry settings that are changed by scripts and prevent Windows Autopatch from deploying updates.<p>When Windows Autopatch detects Intune based policies are missing or modified, this information is displayed with detailed recommended actions, and described in [Policy health and remediation](../monitor/windows-autopatch-policy-health-and-remediation.md).</p><p>To ensure devices remain healthy and not affected by group policies, see [Post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md#details-about-the-post-device-registration-readiness-checks).</p>
|
||||
|
||||
## Policy conflict view
|
||||
|
||||
This view includes the list of Windows Autopatch policies ([Expected policies](#policy-conflict-view-alert-details)) that are assigned to various Windows Autopatch groups that include devices. When the Expected policy can't be successfully assigned to one or more devices, because of an equivalent setting in another Intune policy targeting the device, the conflict is detected, and reported as a [Conflicting policy](#policy-conflict-view-alert-details).
|
||||
This view includes the list of Windows Autopatch policies ([Expected policies](#policy-conflict-view-alert-details)) that are assigned to various Windows Autopatch groups that include devices. When the Expected policy can't be successfully assigned to one or more devices, because of an equivalent setting in another Intune policy targeting the device, the conflict is detected, and reported as a [Conflicting policy](#policy-conflict-view-alert-details).
|
||||
|
||||
If the Expected policy conflicts with multiple Intune policies, each conflict is displayed in different lines in the Policy conflict view.
|
||||
If the Expected policy conflicts with multiple Intune policies, each conflict is displayed in different lines in the Policy conflict view.
|
||||
|
||||
**To view all policies conflicting with the Expected policies:**
|
||||
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Navigate to **Devices** > **Managed updates** > **Windows Updates** > **Monitor** > **Policy health**.
|
||||
3. In the **Policy conflicts** tab, the list of expected policies and conflicting policies is displayed.
|
||||
4. Select **View alert** and review the details of the **Recommended action** and alert details.
|
||||
@ -70,7 +70,7 @@ All alerts displayed in this flyout include the following details. You must revi
|
||||
|
||||
## Affected devices view
|
||||
|
||||
This view includes the list of devices with policy conflicts with the [Expected policy](#policy-conflict-view-alert-details). It's possible for devices to have multiple conflicting policies, due to their membership in various groups.
|
||||
This view includes the list of devices with policy conflicts with the [Expected policy](#policy-conflict-view-alert-details). It's possible for devices to have multiple conflicting policies, due to their membership in various groups.
|
||||
|
||||
You can navigate to this view from the Affected devices column link in the [Policy conflicts view](#policy-conflict-view), or directly from Policy health blade. This page displays a filtered device list, when navigating from the Policy conflicts view. Affected devices only include devices that have a successful Intune sync status in the last 28 days.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: overview
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -26,7 +26,7 @@ Windows Autopatch requires, and uses Windows diagnostic data to display device u
|
||||
|
||||
This data collection configuration method using Windows diagnostic data in Intune is shared across Autopatch reports. To support Autopatch reporting, you must configure the [Enable Windows diagnostic data collection settings](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-settings) from devices at the **Required** or higher level.
|
||||
|
||||
### Permissions and scope to view reports
|
||||
### Permissions and scope to view reports
|
||||
|
||||
To view Windows Update reports, you must be assigned an Intune role with the **Device Configuration** > **View reports** permission. This permission is included in the following built-in roles:
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -7,7 +7,7 @@ metadata:
|
||||
ms.date: 04/21/2025
|
||||
audience: itpro
|
||||
ms.localizationpriority: medium
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
ms.reviwer: hathind
|
||||
@ -16,19 +16,19 @@ title: Frequently Asked Questions about Windows Autopatch
|
||||
summary: This article answers frequently asked questions about Windows Autopatch.
|
||||
sections:
|
||||
- name: General
|
||||
questions:
|
||||
questions:
|
||||
- question: Is Windows 365 for Enterprise supported with Windows Autopatch?
|
||||
answer: |
|
||||
Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported.
|
||||
- question: Will Windows Autopatch support local domain join Windows 10?
|
||||
answer: |
|
||||
Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Microsoft Hybrid Entra join](/entra/identity/devices/concept-hybrid-join) or [Microsoft Entra join](/entra/identity/devices/concept-directory-join).
|
||||
Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Microsoft Hybrid Entra join](/entra/identity/devices/concept-hybrid-join) or [Microsoft Entra join](/entra/identity/devices/concept-directory-join).
|
||||
- question: Will Windows Autopatch be available for state and local government customers?
|
||||
answer: |
|
||||
Windows Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not supported.
|
||||
- question: How do I access Windows Autopatch?
|
||||
answer: |
|
||||
You can access Windows Autopatch through Intune. For more information, see [Start using Windows Autopatch](../prepare/windows-autopatch-start-using-autopatch.md#use-microsoft-intune-for-windows-autopatch) and [Prerequisites](../prepare/windows-autopatch-prerequisites.md) to ensure you meet the licensing requirements.
|
||||
answer: |
|
||||
You can access Windows Autopatch through Intune. For more information, see [Start using Windows Autopatch](../prepare/windows-autopatch-start-using-autopatch.md#use-microsoft-intune-for-windows-autopatch) and [Prerequisites](../prepare/windows-autopatch-prerequisites.md) to ensure you meet the licensing requirements.
|
||||
- name: Requirements
|
||||
questions:
|
||||
- question: What are the licensing requirements for Windows Autopatch?
|
||||
@ -55,8 +55,8 @@ sections:
|
||||
answer: |
|
||||
No, Windows Autopatch doesn't require any specific hardware. However, general hardware requirements for updates are still applicable. For example, to deliver Windows 11 to your Autopatch devices they must meet [specific hardware requirements](/windows/whats-new/windows-11-requirements). Windows devices must be supported by your hardware OEM.
|
||||
- name: Device registration
|
||||
questions:
|
||||
- question: Who can register devices into Windows Autopatch?
|
||||
questions:
|
||||
- question: Who can register devices into Windows Autopatch?
|
||||
answer: |
|
||||
If you have Business Premium, A3+, E3+ and F3 licenses, you can register devices into Windows Autopatch. For more information, see [Features and capabilities](../overview/windows-autopatch-overview.md#features-and-capabilities).
|
||||
- question: Does Autopatch on Windows 365 Cloud PCs have any feature difference from a physical device?
|
||||
@ -77,7 +77,7 @@ sections:
|
||||
- name: Manage updates
|
||||
questions:
|
||||
- question: Who can manage updates with Windows Autopatch?
|
||||
answer: |
|
||||
answer: |
|
||||
Business Premium, A3+, E3+ and F3 licenses can manage updates with Windows Autopatch. For more information, see [Features and capabilities](../overview/windows-autopatch-overview.md#features-and-capabilities).
|
||||
- question: What systems does Windows Autopatch update?
|
||||
answer: |
|
||||
@ -100,12 +100,12 @@ sections:
|
||||
- question: What is the expected behavior for turning on the Feature Update option for Autopatch groups?
|
||||
answer: |
|
||||
Starting in April 2025, default policies aren't created for new Autopatch customers. Existing customers will continue to receive support until Windows 10 reaches its End-of-Service (EOS). However, these policies won't transition to Windows 11.
|
||||
|
||||
|
||||
If you created an Autopatch group before April 2025:
|
||||
- The Feature Update option is unselected by default.
|
||||
- Selecting the Feature Update option creates a feature update policy for the newly created Autopatch group. This doesn't affect the Global DSS policy.
|
||||
- The Feature Update option doesn't affect existing releases created before April 2025; these releases remain unchanged
|
||||
|
||||
|
||||
If you created an Autopatch group after April 2025:
|
||||
- Selecting the Feature Update option creates a feature update policy and assigns it to all its deployment rings.
|
||||
- Global DSS policy isn't affected.
|
||||
@ -122,7 +122,7 @@ sections:
|
||||
Yes, hotpatch updates are available for Arm64 devices. For more information, see [Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)](../manage/windows-autopatch-hotpatch-updates.md#arm-64-devices-must-disable-compiled-hybrid-pe-usage-chpe-arm-64-cpu-only)).
|
||||
- question: What is the default hotpatch behavior on Windows Home or Pro devices?
|
||||
answer: |
|
||||
Hotpatch updates aren't available to Home or Pro devices. Hotpatching requires domain admin or group policy. It's available only via Windows Autopatch update policy, which includes Windows 365 Enterprise, E3/E5, F3 and A3/A5 licenses.
|
||||
Hotpatch updates aren't available to Home or Pro devices. Hotpatching requires domain admin or group policy. It's available only via Windows Autopatch update policy, which includes Windows 365 Enterprise, E3/E5, F3 and A3/A5 licenses.
|
||||
- question: How do I enroll devices to receive hotpatch updates?
|
||||
answer: |
|
||||
For more information, see [Enroll devices to receive hotpatch updates](../manage/windows-autopatch-hotpatch-updates.md#enroll-devices-to-receive-hotpatch-updates).
|
||||
@ -137,13 +137,13 @@ sections:
|
||||
Devices receiving the hotpatch update have a different KB number tracking the release and a different OS version than devices receiving the standard update that requires a restart. The monthly KB release articles indicate if the KB installed is hotpatch capable and the corresponding OS version. The following Windows Update message appears “Great news! The latest security update was installed without a restart.”
|
||||
- question: What if I restart a device after receiving a hotpatch update?
|
||||
answer: |
|
||||
The device stays on the hotpatch update KB/OS version after a restart. It won't receive any new features as part of the regular servicing track until the next quarterly cumulative baseline update.
|
||||
The device stays on the hotpatch update KB/OS version after a restart. It won't receive any new features as part of the regular servicing track until the next quarterly cumulative baseline update.
|
||||
- question: Do hotpatch updates only update common system binaries loaded in third-party processes or only Microsoft processes?
|
||||
answer: |
|
||||
Hotpatch updates aren't limited to Microsoft processes. Hotpatch updates are only created for OS binaries. Any process loading OS binaries that have hotpatch updates installed are updated before the application or operating system uses the binaries. This includes common system dynamic link libraries (DLLs) like ntdll.dll.
|
||||
Hotpatch updates aren't limited to Microsoft processes. Hotpatch updates are only created for OS binaries. Any process loading OS binaries that have hotpatch updates installed are updated before the application or operating system uses the binaries. This includes common system dynamic link libraries (DLLs) like ntdll.dll.
|
||||
- question: How can I find out if a hotpatch update was applied to the specific DLL?
|
||||
answer: |
|
||||
You can see the hotpatch modules in the memory dump. Symbols for hotpatched DLLs depend on the function that receives the update. Some code that is hotpatch-updated could be public (symbols), while other functions could be private (no symbols).
|
||||
answer: |
|
||||
You can see the hotpatch modules in the memory dump. Symbols for hotpatched DLLs depend on the function that receives the update. Some code that is hotpatch-updated could be public (symbols), while other functions could be private (no symbols).
|
||||
- question: Are there kernel-mode hotpatch updates?
|
||||
answer: |
|
||||
Yes, there are kernel-mode hotpatch updates.
|
||||
@ -155,7 +155,7 @@ sections:
|
||||
Yes, you can. You can manually download the standard Windows monthly update from the Microsoft Update Catalog. In this case, the device stops receiving hotpatch updates and receives standard Windows updates until the month after the next baseline update. Since the device is still enrolled in hotpatching, the device automatically rejoins the hotpatch cadence of updates after the update is released on the baseline month.
|
||||
- question: How do hotpatch update events show up in audit logs?
|
||||
answer: |
|
||||
Process explorer shows it loaded in memory OS ``<binary name>_hotpatch`` loaded in memory. The hotpatch update KB includes a link to the CSV file listing the update payload.
|
||||
Process explorer shows it loaded in memory OS ``<binary name>_hotpatch`` loaded in memory. The hotpatch update KB includes a link to the CSV file listing the update payload.
|
||||
- question: Can I get security alerts through Event Tracing for Windows (ETW) about hotpatch updates?
|
||||
answer: |
|
||||
Hotpatch events are captured in the audit log. Search for “hotpatch” in the audit log to find related errors if any were captured.
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: overview
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- tier2
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: andredm7
|
||||
ms.collection:
|
||||
- highpri
|
||||
@ -26,13 +26,13 @@ Windows Autopatch enables role-based access control to use the least privileged
|
||||
> [!IMPORTANT]
|
||||
> To successfully manage Windows Autopatch as a lower privilege role, the user must have both Autopatch Admin permissions and Policy and Profile admin permissions.
|
||||
|
||||
The permissions defined in Windows Autopatch administrator or Windows Autopatch reader roles are used to manage Autopatch groups, support requests, Autopatch messages, and Autopatch reports.
|
||||
The permissions defined in Windows Autopatch administrator or Windows Autopatch reader roles are used to manage Autopatch groups, support requests, Autopatch messages, and Autopatch reports.
|
||||
|
||||
To manage update policies and Windows Update reports, Device Configuration permission is **required**. This permission is available in built-in roles such as the Policy and Profile Manager roles.
|
||||
|
||||
### Policy and Profile Manager roles
|
||||
|
||||
Policy and Profile Manager roles include device configuration permissions for managing Intune policies including the following Update policies:
|
||||
Policy and Profile Manager roles include device configuration permissions for managing Intune policies including the following Update policies:
|
||||
|
||||
- Update rings
|
||||
- Quality updates
|
||||
@ -85,7 +85,7 @@ The following Microsoft Entra roles can access Windows Autopatch features via th
|
||||
|
||||
You can create two custom roles that include permissions required for a specific job role.
|
||||
|
||||
To achieve all-up update management, make sure that the groups assigned to the Autopatch custom role are also a member of the [Policy & Profile Manager role](#policy-and-profile-manager-roles) or a custom role with equivalent permissions.
|
||||
To achieve all-up update management, make sure that the groups assigned to the Autopatch custom role are also a member of the [Policy & Profile Manager role](#policy-and-profile-manager-roles) or a custom role with equivalent permissions.
|
||||
|
||||
Navigate to **Tenant Administration** > **Roles** > **Create Custom role** > **Windows Autopatch** to create a custom role.
|
||||
|
||||
@ -109,18 +109,18 @@ Navigate to **Tenant Administration** > **Roles** > **Create Custom role** > **W
|
||||
|
||||
### Scopes
|
||||
|
||||
Windows Autopatch supports Intune scope tags and scoped groups to be used for distributed update management. Use Microsoft Intune to create and manage scope tags.
|
||||
Windows Autopatch supports Intune scope tags and scoped groups to be used for distributed update management. Use Microsoft Intune to create and manage scope tags.
|
||||
|
||||
- Windows Autopatch supports Intune scope for Autopatch groups, Autopatch role assignments, update policies, and reports.
|
||||
- Autopatch messages, support, and Admin contacts don't support scopes.
|
||||
- Autopatch groups created by scoped admins are assigned to the same scope tags as the user.
|
||||
- Autopatch messages, support, and Admin contacts don't support scopes.
|
||||
- Autopatch groups created by scoped admins are assigned to the same scope tags as the user.
|
||||
- Only scoped admins, with the same scope tags assigned to them, can edit and manage Autopatch groups.
|
||||
- When you create Autopatch groups and assign scope tags, the update policies created inherit the same scope tags.
|
||||
- When you create Autopatch groups and assign scope tags, the update policies created inherit the same scope tags.
|
||||
- The devices assigned to Autopatch groups don't inherit the Autopatch group scope tags. Use Intune to assign scope tag to devices.
|
||||
|
||||
## Permissions for Autopatch groups
|
||||
|
||||
Autopatch groups create Microsoft Entra groups and update policies and assign the policies to the group as part of its workflow. To successfully complete the workflow, both permissions are **required**. The option to create Autopatch groups is only available when the user has both the permissions enabled.
|
||||
Autopatch groups create Microsoft Entra groups and update policies and assign the policies to the group as part of its workflow. To successfully complete the workflow, both permissions are **required**. The option to create Autopatch groups is only available when the user has both the permissions enabled.
|
||||
|
||||
1. Device Configuration, **all** permissions
|
||||
2. Windows Autopatch group, **all** permissions
|
||||
@ -163,8 +163,8 @@ The following table explains the high-level workflow:
|
||||
1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), navigate to **Tenant Administration** > **Autopatch groups** > **select a group**. All rings and policies of the Autopatch group have the same scope.
|
||||
1. In the **Add group to ring** option, select the Microsoft Entra groups to be assigned to the Autopatch group. Only groups with scope objects are available for selection.
|
||||
1. Navigate to **Properties** > **Scope (Tags)** > **Edit** > **Select scope tags** > select the tags that you want to add to the profile. You can assign a **maximum of 100 scope tags** to an object.
|
||||
1. The **Scope Group** section is displayed when the service detects Autopatch groups that are created before role-based access controls. This indicates that a Microsoft Entra group is created, which can be added as a Scoped Group. A scoped admin can manage this Autopatch group if included in their scope.
|
||||
2. Follow the steps in the [Scoped admins and Autopatch group workflow](#scoped-admins-and-autopatch-group-workflow) section to assign scoped groups.
|
||||
1. The **Scope Group** section is displayed when the service detects Autopatch groups that are created before role-based access controls. This indicates that a Microsoft Entra group is created, which can be added as a Scoped Group. A scoped admin can manage this Autopatch group if included in their scope.
|
||||
2. Follow the steps in the [Scoped admins and Autopatch group workflow](#scoped-admins-and-autopatch-group-workflow) section to assign scoped groups.
|
||||
1. Select **Review + save**.
|
||||
|
||||
## Known issues
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: concept-article
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: adnich
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: legal
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
msreviewer: hathind
|
||||
---
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: whats-new
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
---
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: whats-new
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: whats-new
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: whats-new
|
||||
ms.localizationpriority: medium
|
||||
author: tiaraquan
|
||||
ms.author: tiaraquan
|
||||
manager: aaroncz
|
||||
manager: bpardi
|
||||
ms.reviewer: hathind
|
||||
ms.collection:
|
||||
- highpri
|
||||
|
||||
Reference in New Issue
Block a user