mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
Improved Acrolinx scores
This commit is contained in:
parent
546e6d8267
commit
5ae5d6bb09
@ -20,7 +20,7 @@ ms.collection:
|
||||
> [!IMPORTANT]
|
||||
> Windows Autopatch groups is in **public preview**. This feature is being actively developed and might not be complete. You can test and use these features in production environments and provide feedback.<p>The Windows Autopatch group experience only applies if you’ve opted-in to use Windows Autopatch groups.</p><br>**To opt-in to use Windows Autopatch groups:**<ol><li>Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Devices** from the left navigation menu.</li><li>Under **Windows Autopatch**, select **Release Management**, then select **Autopatch groups (preview)**.</li><li>Review the **[Microsoft Privacy Statement](../overview/windows-autopatch-privacy.md)** and the **[Autopatch groups Public Preview Addendum](../references/windows-autopatch-groups-public-preview-addendum.md)**. If you agree, select the **I have reviewed and agree to the Autopatch groups Public Preview Addendum** checkbox. Then, select **Use preview** to test out Windows Autopatch groups and its bundled feature set. If the **Use preview** option is greyed out, ensure you meet all the [Autopatch group prerequisites](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#autopatch-groups-prerequisites).</li></ol>
|
||||
|
||||
As organizations move to a managed-service model where Microsoft manages update processes on their behalf, they’re challenged with having the right representation of their organizational structures followed by their own deployment cadence. Windows Autopatch groups helps organizations manage updates in a way that makes sense for their businesses with no extra cost or unplanned disruptions.
|
||||
As organizations move to a managed-service model where Microsoft manages update processes on their behalf, they’re challenged with having the right representation of their organizational structures followed by their own deployment cadence. Windows Autopatch groups help organizations manage updates in a way that makes sense for their businesses with no extra cost or unplanned disruptions.
|
||||
|
||||
## What are Windows Autopatch groups?
|
||||
|
||||
@ -67,7 +67,7 @@ The Default Autopatch group uses Windows Autopatch’s default update management
|
||||
The Default Autopatch group is intended to serve organizations that are looking to:
|
||||
|
||||
- Enroll into the service
|
||||
- Align to Windows Autopatch’s default update management process without requiring additional customizations.
|
||||
- Align to Windows Autopatch’s default update management process without requiring more customizations.
|
||||
|
||||
The Default Autopatch group **can’t** be deleted or renamed. However, you can customize its deployment ring composition to add and/or remove deployment rings, and you can also customize the update deployment cadences for each deployment ring within it.
|
||||
|
||||
@ -163,7 +163,7 @@ Autopatch groups creates two different layers. Each layer contains its own deplo
|
||||
|
||||
The service-based deployment ring set is exclusively used to keep Windows Autopatch updated with both service and device-level configuration policies, apps and APIs needed for core functions of the service.
|
||||
|
||||
The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups cannot be deleted or renamed:
|
||||
The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups can't be deleted or renamed:
|
||||
|
||||
- Modern Workplace Devices-Windows Autopatch-Test
|
||||
- Modern Workplace Devices-Windows Autopatch-First
|
||||
@ -177,7 +177,7 @@ The following are the Azure AD assigned groups that represent the service-based
|
||||
|
||||
The software-based deployment ring set is exclusively used with software update management policies, such as the Windows update ring and feature update policies, in the Default Windows Autopatch group.
|
||||
|
||||
The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups cannot be deleted or renamed:
|
||||
The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups can't be deleted or renamed:
|
||||
|
||||
- Windows Autopatch - Test
|
||||
- Windows Autopatch – Ring1
|
||||
@ -206,7 +206,7 @@ The following are three common uses for using Autopatch groups.
|
||||
|
||||
| Scenario | Solution |
|
||||
| ----- | ----- |
|
||||
| You’re working as the IT admin at Contoso Ltd. And manage several Microsoft and non-Microsoft cloud services. You don’t have extra time to spend setting up and managing several Autopatch groups.<p>Your organization currently operates its update management by using five deployment rings, but there’s an opportunity to have flexible deployment cadences if it’s pre-communicated to your end-users.</p> | If you don’t have thousands of devices to manage, use the Default Autopatch group for your organization. You can edit the Default Autopatch group to include additional deployment rings and/or slightly modify some of its default deployment cadences.<p>The Default Autopatch group is pre-configured and doesn’t require extra configurations when registering devices with the Windows Autopatch service.</p><p>The following is a visual representation of a gradual rollout for the Default Autopatch group pre-configured and fully managed by the Windows Autopatch service.</p> |
|
||||
| You’re working as the IT admin at Contoso Ltd. And manage several Microsoft and non-Microsoft cloud services. You don’t have extra time to spend setting up and managing several Autopatch groups.<p>Your organization currently operates its update management by using five deployment rings, but there’s an opportunity to have flexible deployment cadences if it’s precommunicated to your end-users.</p> | If you don’t have thousands of devices to manage, use the Default Autopatch group for your organization. You can edit the Default Autopatch group to include additional deployment rings and/or slightly modify some of its default deployment cadences.<p>The Default Autopatch group is preconfigured and doesn’t require extra configurations when registering devices with the Windows Autopatch service.</p><p>The following is a visual representation of a gradual rollout for the Default Autopatch group preconfigured and fully managed by the Windows Autopatch service.</p> |
|
||||
|
||||
:::image type="content" source="../media/autopatch-groups-default-autopatch-group.png" alt-text="Default Autopatch group" lightbox="../media/autopatch-groups-default-autopatch-group.png":::
|
||||
|
||||
@ -214,7 +214,7 @@ The following are three common uses for using Autopatch groups.
|
||||
|
||||
| Scenario | Solution |
|
||||
| ----- | ----- |
|
||||
| You’re working as the IT admin at Contoso Ltd. Your organization needs to plan a gradual rollout of software updates within specific critical business units or departments to help mitigate the risk of end-user disruption. | You can create a Custom Autopatch group for each of your business units, for example, the finance department and breakdown the deployment ring composition per the different user personas or based on how critical certain user groups can be for the department and subsequently for the business.<p>The following is a visual representation of a gradual rollout for Contoso’s Finance department.</p> |
|
||||
| You’re working as the IT admin at Contoso Ltd. Your organization needs to plan a gradual rollout of software updates within specific critical business units or departments to help mitigate the risk of end-user disruption. | You can create a Custom Autopatch group for each of your business units. For example, you can create a Custom Autopatch group for the finance department and breakdown the deployment ring composition per the different user personas or based on how critical certain user groups can be for the department and then for the business.<p>The following is a visual representation of a gradual rollout for Contoso’s Finance department.</p> |
|
||||
|
||||
:::image type="content" source="../media/autopatch-groups-finance-department-example.png" alt-text="Finance department example" lightbox="../media/autopatch-groups-finance-department-example.png":::
|
||||
|
||||
@ -248,7 +248,7 @@ Autopatch groups works with the following software update workloads:
|
||||
|
||||
### Maximum number of Autopatch groups
|
||||
|
||||
Windows Autopatch will support up to 50 Autopatch groups in your tenant. You can create up to 49 [Custom Autopatch groups](#about-custom-autopatch-groups) in addition to the [Default Autopatch group](#about-the-default-autopatch-group). Each Autopatch group supports up to 15 deployment rings.
|
||||
Windows Autopatch supports up to 50 Autopatch groups in your tenant. You can create up to 49 [Custom Autopatch groups](#about-custom-autopatch-groups) in addition to the [Default Autopatch group](#about-the-default-autopatch-group). Each Autopatch group supports up to 15 deployment rings.
|
||||
|
||||
> [!TIP]
|
||||
> If you reach the maximum number of Autopatch groups supported (50), and try to create more Custom Autopatch groups, the "**Create**" option in the Autopatch groups blade will be greyed out.
|
||||
|
@ -33,7 +33,7 @@ To start using the Windows Autopatch service, ensure you meet the [Windows Autop
|
||||
> [!IMPORTANT]
|
||||
> The online Readiness assessment tool helps you check your readiness to enroll in Windows Autopatch for the first time. Once you enroll, you'll no longer be able to access the tool again.
|
||||
|
||||
The Readiness assessment tool checks the settings in [Microsoft Intune](#microsoft-intune-settings) and [Azure Active Directory](#azure-active-directory-settings) (Azure AD) to ensure they'll work with Windows Autopatch. We aren't, however, checking the workloads in Configuration Manager necessary for Windows Autopatch. For more information about workload prerequisites, see [Configuration Manager co-management requirements](../prepare/windows-autopatch-prerequisites.md#configuration-manager-co-management-requirements).
|
||||
The Readiness assessment tool checks the settings in [Microsoft Intune](#microsoft-intune-settings) and [Azure Active Directory](#azure-active-directory-settings) (Azure AD) to ensure the settings work with Windows Autopatch. We aren't, however, checking the workloads in Configuration Manager necessary for Windows Autopatch. For more information about workload prerequisites, see [Configuration Manager co-management requirements](../prepare/windows-autopatch-prerequisites.md#configuration-manager-co-management-requirements).
|
||||
|
||||
**To access and run the Readiness assessment tool:**
|
||||
|
||||
@ -67,13 +67,13 @@ The following are the Azure Active Directory settings:
|
||||
|
||||
### Check results
|
||||
|
||||
For each check, the tool will report one of four possible results:
|
||||
For each check, the tool reports one of four possible results:
|
||||
|
||||
| Result | Meaning |
|
||||
| ----- | ----- |
|
||||
| Ready | No action is required before completing enrollment. |
|
||||
| Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users.<p><p>You can complete enrollment, but you must fix these issues before you deploy your first device. |
|
||||
| Not ready | You must fix these issues before enrollment. You won’t be able to enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. |
|
||||
| Not ready | You must fix these issues before enrollment. You can't enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. |
|
||||
| Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permissions to run this check. |
|
||||
|
||||
## Step 3: Fix issues with your tenant
|
||||
@ -89,11 +89,11 @@ Once the Readiness assessment tool provides you with a "Ready" result, you're re
|
||||
|
||||
**To enroll your tenant:**
|
||||
|
||||
Within the Readiness assessment tool, you'll now see the **Enroll** button. By selecting **Enroll**, you'll kick off the enrollment of your tenant to the Windows Autopatch service. During the enrollment workflow, you'll see the following:
|
||||
Within the Readiness assessment tool, you can see the **Enroll** button. By selecting **Enroll**, you start the enrollment process of your tenant into the Windows Autopatch service. During the enrollment workflow, you see the following:
|
||||
|
||||
- Consent workflow to manage your tenant.
|
||||
- Provide Windows Autopatch with IT admin contacts.
|
||||
- Setup of the Windows Autopatch service on your tenant. This step is where we'll create the policies, groups and accounts necessary to run the service.
|
||||
- Setup of the Windows Autopatch service on your tenant. This step is where we create the policies, groups and accounts necessary to run the service.
|
||||
|
||||
Once these actions are complete, you've now successfully enrolled your tenant.
|
||||
|
||||
@ -104,7 +104,7 @@ Once these actions are complete, you've now successfully enrolled your tenant.
|
||||
|
||||
You can choose to delete the data we collect directly within the Readiness assessment tool.
|
||||
|
||||
Windows Autopatch retains the data associated with these checks for 12 months after the last time you ran a check in your Azure Active Directory organization (tenant). After 12 months, we retain the data in a de-identified form.
|
||||
Windows Autopatch retains the data associated with these checks for 12 months after the last time you ran a check in your Azure Active Directory organization (tenant). After 12 months, we retain the data in a deidentified form.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Autopatch will only delete the results we collect within the Readiness assessment tool; Autopatch won't delete any other tenant-level data.
|
||||
|
@ -24,13 +24,13 @@ Seeing issues with your tenant? This article details how to remediate issues fou
|
||||
|
||||
## Check results
|
||||
|
||||
For each check, the tool will report one of four possible results:
|
||||
For each check, the tool reports one of four possible results:
|
||||
|
||||
| Result | Meaning |
|
||||
| ----- | ----- |
|
||||
| Ready | No action is required before completing enrollment. |
|
||||
| Advisory | Follow the steps in the tool or this article for the best experience with enrollment and for users.<p><p>You can complete enrollment, but you must fix these issues before you deploy your first device. |
|
||||
| Not ready | You must fix these issues before enrollment. You won’t be able to enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. |
|
||||
| Not ready | You must fix these issues before enrollment. You can't enroll into Windows Autopatch if you don't fix these issues. Follow the steps in the tool or this article to resolve them. |
|
||||
| Error | The Azure Active Directory (AD) role you're using doesn't have sufficient permission to run this check or your tenant isn't properly licensed for Microsoft Intune. |
|
||||
|
||||
> [!NOTE]
|
||||
@ -46,7 +46,7 @@ Your "Update rings for Windows 10 or later" policy in Intune must not target any
|
||||
|
||||
| Result | Meaning |
|
||||
| ----- | ----- |
|
||||
| Advisory | You have an "update ring" policy that targets all devices, all users, or both. Windows Autopatch will also create our own update ring policies during enrollment. To avoid conflicts with Windows Autopatch devices, we'll exclude our devices group from your existing update ring policies that target all devices, all users, or both. You must consent to this change when you go to enroll your tenant.</p>|
|
||||
| Advisory | You have an "update ring" policy that targets all devices, all users, or both. Windows Autopatch creates our own update ring policies during enrollment. To avoid conflicts with Windows Autopatch devices, we exclude our devices group from your existing update ring policies that target all devices, all users, or both. You must consent to this change when you go to enroll your tenant.</p>|
|
||||
|
||||
## Azure Active Directory settings
|
||||
|
||||
|
@ -18,7 +18,7 @@ ms.collection:
|
||||
|
||||
## Conflicting and unsupported policies
|
||||
|
||||
Deploying any of the following policies to a managed device will make that device ineligible for management since the device will prevent us from delivering the service as designed.
|
||||
Deploying any of the following policies to a managed device makes that device ineligible for management since the device prevents us from delivering the service as designed.
|
||||
|
||||
### Update policies
|
||||
|
||||
|
@ -18,7 +18,7 @@ ms.collection:
|
||||
|
||||
## Deployment rings for Windows 10 and later
|
||||
|
||||
The following policies contain settings which apply to both Windows quality and feature updates. After onboarding there will be four of these policies in your tenant with the following naming convention:
|
||||
The following policies contain settings that apply to both Windows quality and feature updates. After onboarding there will be four of these policies in your tenant with the following naming convention:
|
||||
|
||||
**Modern Workplace Update Policy [ring name] – [Windows Autopatch]**
|
||||
|
||||
@ -46,7 +46,7 @@ The following policies contain settings which apply to both Windows quality and
|
||||
| Deadline for Windows feature updates | 5 | 5 | 5 | 5 |
|
||||
| Deadline for Windows quality updates | 0 | 2 | 2 | 5 |
|
||||
| Grace period | 0 | 2 | 2 | 2 |
|
||||
| Auto-restart before deadline | Yes | Yes | Yes | Yes |
|
||||
| Auto restart before deadline | Yes | Yes | Yes | Yes |
|
||||
|
||||
### Windows 10 and later assignments
|
||||
|
||||
@ -61,7 +61,7 @@ The service deploys policies using Microsoft Intune to control how Windows featu
|
||||
|
||||
### Windows feature updates for Windows 10 and later
|
||||
|
||||
These policies control the minimum target version of Windows which a device is meant to accept. Throughout the rest of the article, you will see these policies referred to as DSS policies. After onboarding there will be four of these policies in your tenant with the following naming convention:
|
||||
These policies control the minimum target version of Windows that a device is meant to accept. Throughout the rest of the article, these policies are referred to as DSS policies. After onboarding, there will be four of these policies in your tenant with the following naming convention:
|
||||
|
||||
**Modern Workplace DSS Policy [ring name]**
|
||||
|
||||
@ -81,7 +81,7 @@ These policies control the minimum target version of Windows which a device is m
|
||||
|
||||
#### Windows 11 testing
|
||||
|
||||
To allow customers to test Windows 11 in their environment, there's a separate DSS policy which enables you to test Windows 11 before broadly adopting within your environment.
|
||||
To allow customers to test Windows 11 in their environment, there's a separate DSS policy that enables you to test Windows 11 before broadly adopting within your environment.
|
||||
|
||||
##### Windows 11 deployment setting
|
||||
|
||||
@ -99,11 +99,11 @@ To allow customers to test Windows 11 in their environment, there's a separate D
|
||||
|
||||
## Conflicting and unsupported policies
|
||||
|
||||
Deploying any of the following policies to a Windows Autopatch device will make that device ineligible for management since the device will prevent us from delivering the service as designed.
|
||||
Deploying any of the following policies to a Windows Autopatch device makes that device ineligible for management since the device prevents us from delivering the service as designed.
|
||||
|
||||
### Update policies
|
||||
|
||||
Window Autopatch deploys mobile device management (MDM) policies to configure devices and requires a specific configuration. If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) are deployed to devices that aren't on the permitted list, those devices will be excluded from management.
|
||||
Window Autopatch deploys mobile device management (MDM) policies to configure devices and requires a specific configuration. If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) are deployed to devices that aren't on the permitted list, those devices are excluded from management.
|
||||
|
||||
| Allowed policy | Policy CSP | Description |
|
||||
| ----- | ----- | ----- |
|
||||
@ -113,7 +113,7 @@ Window Autopatch deploys mobile device management (MDM) policies to configure de
|
||||
|
||||
### Group policy and other policy managers
|
||||
|
||||
Group policy as well as other policy managers can take precedence over mobile device management (MDM) policies. For Windows quality updates, if any policies or configurations are detected which modify the following hives in the registry, the device could become ineligible for management:
|
||||
Group policy and other policy managers can take precedence over mobile device management (MDM) policies. For Windows quality updates, if any policies or configurations are detected which modify the following hives in the registry, the device could become ineligible for management:
|
||||
|
||||
- `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState`
|
||||
- `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`
|
||||
|
Loading…
x
Reference in New Issue
Block a user