From f64a1bdafb9366d8405ceacd0cab93c09fc873b7 Mon Sep 17 00:00:00 2001 From: Gerardo Camacho <53233367+gerardoc-ms@users.noreply.github.com> Date: Wed, 8 Mar 2023 11:16:25 -0800 Subject: [PATCH 01/22] Add documentation for ScanBeforeInitialLogon Adding documentation for a registry value introduced being introduced in Win11 22H2 to support scanning for and installing updates before a first user logon. This is meant to be used only for devices (such as CloudPCs based on Azure VM) where there is a significant delay between the completion of the first user experience and the initial logon. Included a warning that using this value may have a negative effect when used in retail devices. --- windows/deployment/update/waas-wu-settings.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index af807a712a..af78a7ba37 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -283,3 +283,17 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` + +## Allow Windows Updates to install before initial user logon + +This value is supported on devices running Windows 11, version 22H2 or newer. + +On new devices Windows Update does not begin to install background updates until a user has completed the Out of Box Experience and logs on for the first time. The initial logon typically happens immediately after completing that first user experience. Some VM-based solutions provision a device and automate the first user experience but are not immediately assigned to a user and don't see an initial logon until several days later. + +In those scenarios, setting the following registry value allows those devices to begin background update work before a first user logon: + +- **Registry key**: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator +- **DWORD value name**: ScanBeforeInitialLogonAllowed +- **Value data**: 1 + +> [!NOTE] This value is designed to be used only for scenarios with a deferred initial user logon. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. From 8011fb6e7e92138d1d70e8672647c61523ebdb08 Mon Sep 17 00:00:00 2001 From: Gerardo Camacho <53233367+gerardoc-ms@users.noreply.github.com> Date: Wed, 8 Mar 2023 15:19:30 -0800 Subject: [PATCH 02/22] Update ScanBeforeInitialLogonAllowed section Added entry into the summary section, and changed "note" tag to "caution" --- windows/deployment/update/waas-wu-settings.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index af78a7ba37..ae53a53365 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -38,6 +38,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | +| | [Allow Windows Updates to install before initial user logon](#allow-windows-update-before-initial-logon) | Windows 11 22H2 devices | >[!IMPORTANT] >Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. @@ -284,7 +285,7 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` -## Allow Windows Updates to install before initial user logon +## Allow Windows Updates to install before initial user logon This value is supported on devices running Windows 11, version 22H2 or newer. @@ -296,4 +297,5 @@ In those scenarios, setting the following registry value allows those devices to - **DWORD value name**: ScanBeforeInitialLogonAllowed - **Value data**: 1 -> [!NOTE] This value is designed to be used only for scenarios with a deferred initial user logon. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. +> [!CAUTION] +> This value is designed to be used only for scenarios with a deferred initial user logon. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. From e9047ec25fd2823845599b3e4f516ef67e2972e4 Mon Sep 17 00:00:00 2001 From: Gerardo Camacho <53233367+gerardoc-ms@users.noreply.github.com> Date: Thu, 9 Mar 2023 10:36:55 -0800 Subject: [PATCH 03/22] Apply suggestions from code review Change wording as suggested Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/waas-wu-settings.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index ae53a53365..f109996699 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -287,15 +287,15 @@ New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWO ## Allow Windows Updates to install before initial user logon -This value is supported on devices running Windows 11, version 22H2 or newer. +This value is supported on devices running Windows 11, version 22H2, or later. -On new devices Windows Update does not begin to install background updates until a user has completed the Out of Box Experience and logs on for the first time. The initial logon typically happens immediately after completing that first user experience. Some VM-based solutions provision a device and automate the first user experience but are not immediately assigned to a user and don't see an initial logon until several days later. +On new devices, Windows Update does not begin to install background updates until a user has completed the Out of Box Experience and signs in for the first time. The user typically signs in initially immediately after completing that first user experience. Some VM-based solutions provision a device and automate the first user experience but are not immediately assigned to a user and don't see a user initially signing in until several days later. -In those scenarios, setting the following registry value allows those devices to begin background update work before a first user logon: +In those scenarios, setting the following registry values allows those devices to begin background update work before a user first signs in: - **Registry key**: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator - **DWORD value name**: ScanBeforeInitialLogonAllowed - **Value data**: 1 > [!CAUTION] -> This value is designed to be used only for scenarios with a deferred initial user logon. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. +> This value is designed to be used only for scenarios where the initial signing-in of a user is deferred. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user signs in for the first time. From ba0b767ffe9eabaa782da5de333f7851fc04ab14 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Mar 2023 11:00:27 -0800 Subject: [PATCH 04/22] add a few edits, see suggestions committed, so pulling in to go ahead and deal with the merge conflicts that will arise --- windows/deployment/update/waas-wu-settings.md | 21 +++++++------------ 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index ae53a53365..bc6bd7c4ba 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -9,17 +9,12 @@ manager: aaroncz ms.topic: article ms.collection: highpri, tier2 ms.technology: itpro-updates -ms.date: 01/06/2023 +ms.date: 03/09/2023 --- # Manage additional Windows Update settings - -**Applies to** - -- Windows 10 -- Windows 11 - +***(Applies to: Windows 11 & Windows 10)*** > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -38,7 +33,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| | [Allow Windows Updates to install before initial user logon](#allow-windows-update-before-initial-logon) | Windows 11 22H2 devices | +| | [Allow Windows updates to install before initial user logon](#allow-windows-update-before-initial-logon) | Windows 11 version 22H2 | >[!IMPORTANT] >Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. @@ -285,11 +280,11 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` -## Allow Windows Updates to install before initial user logon +## Allow Windows updates to install before initial user logon -This value is supported on devices running Windows 11, version 22H2 or newer. +*(Starting in Windows 11, version 22H2)* -On new devices Windows Update does not begin to install background updates until a user has completed the Out of Box Experience and logs on for the first time. The initial logon typically happens immediately after completing that first user experience. Some VM-based solutions provision a device and automate the first user experience but are not immediately assigned to a user and don't see an initial logon until several days later. +On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience but aren't immediately assigned to a user and don't see an initial logon until several days later. In those scenarios, setting the following registry value allows those devices to begin background update work before a first user logon: @@ -297,5 +292,5 @@ In those scenarios, setting the following registry value allows those devices to - **DWORD value name**: ScanBeforeInitialLogonAllowed - **Value data**: 1 -> [!CAUTION] -> This value is designed to be used only for scenarios with a deferred initial user logon. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. +> [!Warning] +> This value is designed to be used only for scenarios with a deferred initial user sign in. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. From dc4b9d3e4214da1a85bfc3a268c9a1a803bfeba0 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Mar 2023 11:32:20 -0800 Subject: [PATCH 05/22] edits --- windows/deployment/update/waas-wu-settings.md | 20 ++++--------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index e45e6657f5..6cc5224463 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -32,7 +32,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | -| | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | +| | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | | | [Allow Windows updates to install before initial user logon](#allow-windows-update-before-initial-logon) | Windows 11 version 22H2 | >[!IMPORTANT] @@ -281,27 +281,15 @@ New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWO ``` ## Allow Windows updates to install before initial user logon - -<<<<<<< HEAD *(Starting in Windows 11, version 22H2)* -On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience but aren't immediately assigned to a user and don't see an initial logon until several days later. -======= -This value is supported on devices running Windows 11, version 22H2, or later. +On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience. These VMs may not be immediately assigned to a user so they won't see an initial sign-in until several days later. -On new devices, Windows Update does not begin to install background updates until a user has completed the Out of Box Experience and signs in for the first time. The user typically signs in initially immediately after completing that first user experience. Some VM-based solutions provision a device and automate the first user experience but are not immediately assigned to a user and don't see a user initially signing in until several days later. ->>>>>>> e9047ec25fd2823845599b3e4f516ef67e2972e4 - -In those scenarios, setting the following registry values allows those devices to begin background update work before a user first signs in: +In scenarios where initial sign-in is delayed, setting the following registry values allow devices to begin background update work before a user first signs in: - **Registry key**: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator - **DWORD value name**: ScanBeforeInitialLogonAllowed - **Value data**: 1 -<<<<<<< HEAD > [!Warning] -> This value is designed to be used only for scenarios with a deferred initial user sign in. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user is logging in for the first time. -======= -> [!CAUTION] -> This value is designed to be used only for scenarios where the initial signing-in of a user is deferred. Setting this value on normal consumer retail devices could have a detrimental effect on performance as it may allow update work to occur as the user signs in for the first time. ->>>>>>> e9047ec25fd2823845599b3e4f516ef67e2972e4 +> This value is designed to be used only for scenarios with a deferred initial user sign in. Setting this value on devices where initial user sign in isn't delayed could have a detrimental effect on performance since it may allow update work to occur as the user is signing in for the first time. From d3e14ebae00d5cff5e1b37305ff00bc615f48e2d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Mar 2023 12:04:13 -0800 Subject: [PATCH 06/22] tweak h2 --- windows/deployment/update/waas-wu-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 6cc5224463..63f165899e 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -33,7 +33,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| | [Allow Windows updates to install before initial user logon](#allow-windows-update-before-initial-logon) | Windows 11 version 22H2 | +| | [Allow Windows updates to install before initial user sign-in](#allow-windows-update-before-initial-sign-in) | Windows 11 version 22H2 | >[!IMPORTANT] >Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. @@ -280,7 +280,7 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` -## Allow Windows updates to install before initial user logon +## Allow Windows updates to install before initial user sign-in *(Starting in Windows 11, version 22H2)* On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience. These VMs may not be immediately assigned to a user so they won't see an initial sign-in until several days later. From 2f03d61118ea563ab2ef7f6cd63b984ff3cc2596 Mon Sep 17 00:00:00 2001 From: scottmca <89857809+scottmca@users.noreply.github.com> Date: Thu, 9 Mar 2023 15:14:52 -0500 Subject: [PATCH 07/22] Update provisioning-install-icd.md Customer could not find this issue because of the lack of good description. Added some additional keyboards/description to help customers find this issue better --- .../provisioning-packages/provisioning-install-icd.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 8796ceac18..9e11f2f5e5 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -57,7 +57,7 @@ On devices running Windows client, you can install [the Windows Configuration De - When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). -- Windows Configuration Designer doesn't work properly if the **Policies > Administrative Templates > Windows Components > Internet Explorer > Security Zones: Use only machine settings** Group Policy setting is enabled. Instead of changing the security setting, we recommend you run Windows Configuration Designer on a different device. +- Windows Configuration Designer will not up to the standard size button with steps for the guided wizard. Each step will be oversized button with no description to the left if the **Policies > Administrative Templates > Windows Components > Internet Explorer > Security Zones: Use only machine settings** Group Policy setting is enabled. Instead of changing the security setting, we recommend you run Windows Configuration Designer on a different device. - You can only run one instance of Windows Configuration Designer on your computer at a time. From 1d3fed16a05067e7c84603175a1f341e33cc3f3f Mon Sep 17 00:00:00 2001 From: Tarun Maganur <104856032+Tarun-Edu@users.noreply.github.com> Date: Thu, 9 Mar 2023 13:03:34 -0800 Subject: [PATCH 08/22] Update windows-11-se-overview.md --- education/windows/windows-11-se-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index 47ef842ab2..1508376333 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -124,7 +124,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | | `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | | `Mozilla Firefox` | 105.0.0 | Win32 | `Mozilla` | -| `NAPLAN` | 5.2.2 | Win32 | `NAP` | +| `NAPLAN` | 2.5.0 | Win32 | `NAP` | | `Netref Student` | 22.2.0 | Win32 | `NetRef` | | `NetSupport Manager` | 12.01.0014 | Win32 | `NetSupport` | | `NetSupport Notify` | 5.10.1.215 | Win32 | `NetSupport` | From b186f0d7cd7366a2ff7f6efcd24cac754d5d8d2f Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 9 Mar 2023 14:14:48 -0800 Subject: [PATCH 09/22] M365 Updates. --- ...autopatch-microsoft-365-apps-enterprise.md | 41 ++++++++----------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md index a196916be3..4ab698b3e2 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md @@ -1,7 +1,7 @@ --- title: Microsoft 365 Apps for enterprise description: This article explains how Windows Autopatch manages Microsoft 365 Apps for enterprise updates -ms.date: 02/28/2023 +ms.date: 03/09/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to @@ -16,7 +16,12 @@ ms.reviewer: hathind ## Service level objective -Windows Autopatch aims to keep at least 90% of eligible devices on a [supported version](/deployoffice/overview-update-channels#support-duration-for-monthly-enterprise-channel) of the Monthly Enterprise Channel (MEC) for [Enterprise Standard Suite](/deployoffice/about-microsoft-365-apps) (Access, Excel, OneNote, Outlook, PowerPoint, and Word). Microsoft 365 Apps deployed on the [Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview) are supported for two months. +Windows Autopatch aims to keep at least 90% of eligible devices on a [supported version](/deployoffice/overview-update-channels#support-duration-for-monthly-enterprise-channel) of the Monthly Enterprise Channel (MEC) for the: + +- [Enterprise Standard Suite](/deployoffice/about-microsoft-365-apps). The Enterprise Standard Suite includes Access, Excel, OneNote, Outlook, PowerPoint, and Word. +- Subscription versions of Microsoft Project and Visio desktop apps, for example, Project Plan 3 or Visio Plan 2. + +Microsoft 365 Apps deployed on the [Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview) are supported for two months. > [!NOTE] > [Microsoft Teams](../operate/windows-autopatch-teams.md) uses a different update channel from the rest of Microsoft 365 Apps. @@ -25,8 +30,11 @@ Windows Autopatch aims to keep at least 90% of eligible devices on a [supported For a device to be eligible for Microsoft 365 Apps for enterprise updates (both 32-bit and 64-bit versions), as a part of Windows Autopatch, they must meet the following criteria: +- The device must be turned on and have an internet connection. +- The device must be able to access the [required network endpoints](../prepare/windows-autopatch-configure-network#required-microsoft-product-endpoints) to reach the Office Content Delivery Network (CDN). - There are no policy conflicts between Microsoft Autopatch policies and customer policies. - The device must have checked into the Intune service in the last five days. +- If Microsoft 365 Apps are running, the apps must close for the update process to complete. ## Update release schedule @@ -47,21 +55,13 @@ Windows Autopatch configures the following end user experiences: ### Behavior during updates -Updates are only applied when Microsoft 365 Apps aren't running. Therefore, notifications usually appear because the user is working in a Microsoft 365 App, such as Microsoft Outlook, and hasn't closed it in several days. +> [!NOTE] +> If Microsoft 365 Apps are running, the apps must close for the update process to complete. -Once the device downloads the update, users are given notifications leading up to the deadline. They'll receive the following message in the notification area in Windows, reminding them to apply the updates. +Updates are only applied when Microsoft 365 Apps aren't running. Therefore, [end user notifications for Microsoft 365 Apps](/deployoffice/updates/end-user-update-notifications-microsoft-365-apps) usually appear when: -*Updates ready to be applied -Updates are required by your system admin are blocked by one or more apps. Office will restart at mm/dd/yyyy h:mm AM/PM to apply updates.* - -Alternatively, users can select **Update now** to apply the updates. Users are prompted to close all open Office programs. After the updates are applied, the message disappears. - -When the deadline arrives and the updates still aren't applied, users will: - -1. See a dialog box that warns them that they have 15 minutes before the updates are applied. -1. Have 15 minutes to save and close any work. - -When the countdown reaches 00∶00, any open Office programs are closed, and the updates are applied. +- The user is working in a Microsoft 365 App, such as Microsoft Outlook, and hasn't closed it in several days. +- The update [deadline arrives](/deployoffice/updates/end-user-update-notifications-microsoft-365-apps#notifications-your-users-see-when-you-set-an-update-deadline-for-microsoft-365-apps) and the updates still aren't applied. ### Office client app configuration @@ -69,17 +69,12 @@ To ensure that users are receiving automatic updates, Windows Autopatch prevents ## Microsoft 365 Apps for enterprise update controls -If Windows Autopatch detects issues between versions of Microsoft 365 Apps for enterprise, we might pause the update by forcing Microsoft 365 Apps to stay on a specific version. +Windows Autopatch doesn't allow you to pause or rollback an update in the Microsoft Intune admin center. -Windows Autopatch will either: - -- Choose to stay on the previous version for devices that haven't received the update yet. -- Force all devices to roll back to the previous version. +Please [submit a support request](../operate/windows-autopatch-support-request.md) to the Windows Autopatch Service Engineering Team to pause or rollback an update when needed. > [!NOTE] -> Windows Autopatch doesn't allow you to: