diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md deleted file mode 100644 index e22102c89e..0000000000 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Add and verify admin contacts -description: This article explains how to add and verify admin contacts -ms.date: 09/16/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: concept-article -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - highpri - - tier1 ---- - -# Add and verify admin contacts - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -There are several ways that Windows Autopatch service communicates with customers. To streamline communication and ensure we're checking with the right people when you [submit a support request](../manage/windows-autopatch-support-request.md), you must provide a set of admin contacts when you onboard with Windows Autopatch. - -You must have an admin contact for each specified area of focus. The Windows Autopatch Service Engineering Team contacts these individuals for assistance with your support request. Admin contacts should be the best person or group that can answer questions and make decisions for different [areas of focus](#area-of-focus). - -> [!IMPORTANT] -> Whoever you choose as admin contacts, they must have the knowledge and authority to make decisions for your Windows Autopatch environment. The Windows Autopatch Service Engineering Team will contact these admin contacts for questions involving support requests. - -## Area of focus - -Our admin contacts receive notifications about support request updates and new messages. These areas include the following areas of focus: - -| Area of focus | Description | -| ----- | ----- | -| Devices | | -| Updates | | - -**To add admin contacts:** - -1. Sign into the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Under **Tenant administration** in the **Windows Autopatch** section, select **Admin contacts**. -3. Select **+Add**. -4. Enter the contact details including name, email, phone number, and preferred language. For a support ticket, the ticket's primary contact's preferred language determines the language used for email communications. -5. Select an [Area of focus](#area-of-focus) and enter details of the contact's knowledge and authority in the specified area of focus. -6. Select **Save** to add the contact. -7. Repeat for each area of focus. diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md index da54b8ef15..6040e0d206 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md @@ -51,7 +51,7 @@ Before you start managing Autopatch groups, ensure you meet the following prereq ## Register devices into Autopatch groups -Autopatch groups register devices with the Windows Autopatch service when you either [create](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group) or [edit an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-an-autopatch-group). For more information, see [Register devices into Autopatch groups](../deploy/windows-autopatch-register-devices.md#register-devices-into-autopatch-groups). +Autopatch groups register devices with the Windows Autopatch service when you either [create](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group) or [edit an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-an-autopatch-group). For more information, see [Register devices into Autopatch groups](../deploy/windows-autopatch-register-devices.md#register-devices-with-autopatch-groups). ## High-level architecture diagram overview diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index 5a810e4f10..4bab65f8f1 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -49,7 +49,7 @@ Figuring out device health can be challenging and disruptive to the end user whe - Obtain proactive data sent by the device to the service, or - Proactively detect and remediate issues -Windows Autopatch has devices readiness states within its [**Autopatch group membership report**](../deploy/windows-autopatch-register-devices.md#autopatch-group-membership-report). Each state provides IT admins monitoring information on which devices might have potential device health issues. +Windows Autopatch has devices readiness states within its [**Autopatch group membership report**](../deploy/windows-autopatch-register-devices.md#autopatch-groups-membership-report). Each state provides IT admins monitoring information on which devices might have potential device health issues. | Tab | Description | | ----- | ----- | diff --git a/windows/deployment/windows-autopatch/includes/windows-autopatch-enterprise-e3-f3-licenses.md b/windows/deployment/windows-autopatch/includes/windows-autopatch-enterprise-e3-f3-licenses.md index 37b872ad2a..ec09838176 100644 --- a/windows/deployment/windows-autopatch/includes/windows-autopatch-enterprise-e3-f3-licenses.md +++ b/windows/deployment/windows-autopatch/includes/windows-autopatch-enterprise-e3-f3-licenses.md @@ -11,4 +11,4 @@ ms.localizationpriority: medium > [!IMPORTANT] -> **The information in this article or section only applies if you have Windows Enterprise E3+ or F3 licenses (included in Microsoft 365 F3, E3, or E5) licenses and have [activated Windows Autopatch features](../overview/windows-autopatch-overview.md#windows-enterprise-e3-and-f3-licenses).**

[Feature activation](../prepare/windows-autopatch-feature-activation.md) is optional and at no additional cost to you if you have Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5) licenses.

For more information, see [Licenses and entitlements](../prepare/windows-autopatch-prerequisites.md#licenses-and-entitlements). If you choose not to go through feature activation, you can still use the Windows Autopatch service for the features included in [Business premium and A3+ licenses](../overview/windows-autopatch-overview.md#business-premium-and-a3-licenses).

+> **The information in this article or section only applies if you have Windows Enterprise E3+ or F3 licenses (included in Microsoft 365 F3, E3, or E5) licenses and have activated Windows Autopatch features.**

Feature activation is optional and at no additional cost to you if you have Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5) licenses.

For more information, see Licenses and entitlements. If you choose not to go through feature activation, you can still use the Windows Autopatch service for the features included in Business premium and A3+ licenses.

diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-customize-windows-update-settings.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-customize-windows-update-settings.md deleted file mode 100644 index 5cf7948782..0000000000 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-customize-windows-update-settings.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Customize Windows Update settings Autopatch groups experience -description: How to customize Windows Updates with Autopatch groups -ms.date: 09/16/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: how-to -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: rekhanr -ms.collection: - - highpri - - tier1 ---- - -# Customize Windows Update settings - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -You can customize the Windows Update deployment schedule for each deployment ring in Windows Autopatch groups per your business and organizational needs. However, we recommend that you remain within service defined boundaries to maintain compliance. - -When the deployment cadence is customized, Windows Autopatch overrides our service defaults with your preferred deployment cadence. Depending on the selected options, devices with [customized schedules](#scheduled-install) might not count towards the Windows Autopatch [Windows quality update service level objective](../manage/windows-autopatch-windows-quality-update-overview.md#service-level-objective). - -## Deployment cadence - -### Cadence types - -For each tenant, at the deployment ring level, there are two cadence types to configure and manage your Windows Update deployments for all the devices in those deployment rings: - -- [Deadline-driven](#deadline-driven) -- [Scheduled install](#scheduled-install) - -> [!NOTE] -> Windows Autopatch uses the [Update rings policy for Windows 10 and later in Microsoft Intune](/mem/intune/protect/windows-10-update-rings) to apply either **Deadline-driven** or **Scheduled install** cadence types. Microsoft Intune implements [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) using the settings available in the [Update policy CSP](/windows/client-management/mdm/policy-csp-update). - -#### Deadline-driven - -With the deadline-drive cadence type, you can control and customize the deferral, deadline, and grace period to meet your specific business needs and organizational requirements. - -> [!NOTE] -> The configured grace period will apply to both Windows quality updates and Windows feature updates. - -Each deployment ring can be scheduled independent of the others, and there are no dependencies that the previous deployment ring must be scheduled before the next ring. Further, if the cadence type is set as **Deadline-driven**, the automatic update behavior setting, **Reset to default** in the Windows Update for Business policy, are applied. - -It's possible for you to change the cadence from the Windows Autopatch groups blade while update deployments are in progress. Windows Autopatch abides by the principle to always respect your preferences over service-defined values. - -However, if an update already started for a particular deployment ring, Windows Autopatch isn't able to change the cadence for that ring during that ongoing update cycle. The changes will only be effective in the next update cycle. - -#### Scheduled install - -> [!NOTE] ->If you select the Schedule install cadence type, the devices in that ring won't be counted towards the [Windows quality update service level objective](../manage/windows-autopatch-windows-quality-update-overview.md#service-level-objective). - -While the Windows Autopatch default options meet most the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. - -The **Scheduled install** cadence type minimizes disruptions by preventing forced restarts and interruptions to critical business activities for end users. When you select the **Scheduled install** cadence type, any previously set deadlines and grace periods are removed. Devices will only update and restart according to the time specified. - -If other applications force a device to restart outside of the specified time and a Windows Update is pending a restart, the Windows Update completes its installation at this time. For this reason, ensure that you consider your update and restart scenarios for devices running business critical activities, or restart sensitive workloads before using the Scheduled Install option. - -> [!NOTE] -> The compliance deadline and grace period for Windows quality updates won't be configured for the Scheduled Install cadence type. - -Devices **must** be active and available at the time when the device is scheduled for installation to ensure the optimal experience. If the device is consistently unavailable during the scheduled install time, the device can remain unprotected and unsecured, or the device might have the Windows Update scan and install during active hours. - -##### Scheduled install types - -> [!NOTE] -> For devices with **Active hours** configured, if the device is consistently unavailable, Windows will attempt to keep the devices up to date, including installation of updates during Active hours.

For Windows 10 devices, Windows Update can start 30 minutes prior to the specified install time. If the installation start time is specified at 2:00 AM, some of the devices may start the installation 30 mins prior.

- -The Scheduled install cadence has two options: - -| Option | Description | -| ----- | ----- | -| Active hours | The period (daily) that the user normally does their work, or the device is busy performing business critical actions.

The time outside of active hours is when the device is available for Windows to perform an update and restart the device (daily). The max range for Active hours is 18 hours. The six-hour period outside of the active hours is the deployment period, when Windows Update for Business scans, install and restart the device.

-| Schedule install and restart | Use this option to prevent the service from installing Windows Updates except during the specified start time. You can specify the following occurrence options:

Select a time when the device has low activity for the updates to complete. Ensure that the Windows Update has three to four hours to complete the installation and restart the device.

| - -> [!NOTE] -> Changes made in one deployment ring won't impact other rings in your tenant.

Configured **Active hours** and **Scheduled install and restart** options will apply to both Windows quality updates and Windows feature updates.

- -### User notifications - -In addition to the cadence type, you can also manage the end user notification settings. End users receive all update notifications by default. For critical devices or devices where notifications need to be hidden, use the **Manage notifications** option to configure notifications. For each tenant, at the deployment ring level, there are four options for you to configure end user update notification settings: - -- Not configured -- Use the default Windows Update notifications -- Turn off all notifications excluding restart warnings -- Turn off all notifications including restart warnings - -For more information, see [Windows Update settings you can manage with Intune update ring policies for Windows 10/11 devices](/mem/intune/protect/windows-update-settings). - -## Customize the Windows Update deployment cadence - -> [!IMPORTANT] -> The Windows update setting customizations can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its device management solution and that's the average frequency Windows devices take to communicate back to Microsoft Intune with new instructions to apply new software update settings.

For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

- -**To customize the Windows Update deployment cadence:** - -1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Navigate to **Tenant administration** > **Windows Autopatch** > **Autopatch groups**. Select the **horizontal ellipses (…)** > **Edit** for the Autopatch group you want to edit. -3. Select the **horizontal ellipses (…)** across each ring to manage the deployment cadence or notification settings. -4. Select **Next** to navigate to the Windows update settings page. The page lists the existing settings for each of the deployment rings in the Autopatch group. -5. Select [**Manage deployment cadence**](#cadence-types) to customize Windows Update settings. - 1. Select one of the cadence types for the ring: - 1. Select **Deadline-driven** to configure the deferral, deadline, and grace periods. This option enforces forced restarts based on the selected deadline and grace period. In the event you want to switch back to the service recommended defaults, for each of the settings, select the option tagged as "default". - 1. Select **Scheduled install** to opt-out of deadline-based forced restart. - 1. Select either **Active hours** or **Schedule install and restart time**. - 2. Select **Save**. -6. Select **Manage notifications**. A fly-in pane opens. - 1. Select one of following [Windows Update restart notifications](#user-notifications) for your devices that are part of the selected deployment ring. By default, Windows Autopatch recommends that you enable all notifications. - 1. Not configured - 1. Use the default Windows Update notifications - 1. Turn off all notifications excluding restart warnings - 1. Turn off all notifications included restart warnings - 1. Select **Save** once you select the preferred setting. -7. Repeat the same process to customize each of the rings. Once done, select **Next**. -8. In **Review + apply**, you're able to review the selected settings for each of the rings. -9. Select **Apply** to apply the changes to the ring policy. diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-feature-deactivation.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-feature-deactivation.md deleted file mode 100644 index 2fae25dbc4..0000000000 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-feature-deactivation.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deactivate Windows Autopatch -description: This article explains what deactivation means for your organization and what actions you must take. -ms.date: 09/16/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: how-to -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - highpri - - tier1 ---- - -# Deactivate Windows Autopatch - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -If you're looking to deactivate Windows Autopatch features, this article details what deactivation means for your organization and what actions you must take. - -> [!IMPORTANT] -> You must be a Global Administrator to deactivate Windows Autopatch features. - -Deactivating from Windows Autopatch requires manual actions from both you and from the Windows Autopatch Service Engineering Team. The Windows Autopatch Service Engineering Team: - -- Removes Windows Autopatch access to your tenant. - - We remove the [Modern Workplace Management application](../references/windows-autopatch-changes-made-at-feature-activation.md#windows-autopatch-enterprise-applications) from your tenant that is used to run the Windows Autopatch service on your tenant -- Excludes your devices from the Windows Autopatch service. Excluding your devices from Windows Autopatch doesn't remove your devices from Intune, Microsoft Entra ID or Configuration Manager. The Windows Autopatch Service Engineering Team follows the same process and principles as laid out in [Exclude a device](../manage/windows-autopatch-exclude-device.md). -- Deletes all data that we stored in the Windows Autopatch data storage. - -> [!NOTE] -> We will **not** delete any of your customer or Intune data. - -## Microsoft's responsibilities during deactivation - -| Responsibility | Description | -| ----- | ----- | -| Windows Autopatch data | Windows Autopatch deletes user data that is within the Windows Autopatch service. We don't make changes to any other data. For more information about how data is used in Windows Autopatch, see [Privacy](../overview/windows-autopatch-privacy.md). | -| Excluding devices | Windows Autopatch excludes all devices previously registered with the service. Only the Windows Autopatch device record is deleted. We don't delete Microsoft Intune and/or Microsoft Entra device records. For more information, see [Exclude a device](../manage/windows-autopatch-exclude-device.md). | - -## Your responsibilities after deactivating Windows Autopatch features - -| Responsibility | Description | -| ----- | ----- | -| Updates | After the Windows Autopatch service is deactivated, we'll no longer provide updates to your devices. You must ensure that your devices continue to receive updates through your own policies to ensure they're secure and up to date. | -| Optional Windows Autopatch configuration | Windows Autopatch doesn't remove the configuration policies or groups used to enable updates on your devices. You're responsible for these policies following tenant deactivation. If you don't wish to use these policies for your devices after deactivation, you can safely delete them. For more information, see [Changes made at feature activation](../references/windows-autopatch-changes-made-at-feature-activation.md). | -| Microsoft Intune roles | After deactivation, you can safely remove the Modern Workplace Intune Admin role. | - -## To Deactivate Windows Autopatch features - -**To deactivate Windows Autopatch features:** - -1. [Submit a support request](../manage/windows-autopatch-support-request.md) and request to deactivate Windows Autopatch features. -1. The Windows Autopatch Service Engineering Team communicates with your IT Administrator to confirm your intent to deactivate Windows Autopatch features. - 1. You have 14 days to review and confirm the communication sent by the Windows Autopatch Service Engineering Team. - 2. The Windows Autopatch Service Engineering Team can proceed sooner than 14 days if your confirmation arrives sooner. -1. The Windows Autopatch Service Engineering Team proceeds with the removal of all items listed under [Microsoft's responsibilities during deactivation](#microsofts-responsibilities-during-deactivation). -1. The Windows Autopatch Service Engineering Team informs you when deactivation is complete. -1. You're responsible for the items listed under [Your responsibilities after deactivating Windows Autopatch features](#your-responsibilities-after-deactivating-windows-autopatch-features). diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-microsoft-365-apps-enterprise.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-microsoft-365-apps-enterprise.md index f7dad834ee..854013fc48 100644 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-microsoft-365-apps-enterprise.md +++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-microsoft-365-apps-enterprise.md @@ -19,9 +19,6 @@ ms.collection: ## Service level objective -> [!IMPORTANT] -> To update Microsoft 365 Apps for enterprise, you must [create at least one Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group) first and **Microsoft 365 app update setting** must be set to [**Allow**](#allow-or-block-microsoft-365-app-updates). For more information on workloads supported by Windows Autopatch groups, see [Software update workloads](../deploy/windows-autopatch-groups-overview.md#software-update-workloads). - Windows Autopatch aims to keep at least 90% of eligible devices on a [supported version](/deployoffice/overview-update-channels#support-duration-for-monthly-enterprise-channel) of the Monthly Enterprise Channel (MEC) for the: - [Enterprise Standard Suite](/deployoffice/about-microsoft-365-apps). The Enterprise Standard Suite includes Access, Excel, OneNote, Outlook, PowerPoint, and Word. diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-feature-update-policies.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-feature-update-policies.md deleted file mode 100644 index 47810fe194..0000000000 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-feature-update-policies.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Windows feature updates policies -description: This article describes Windows feature update policies used in Windows Autopatch -ms.date: 09/16/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: how-to -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: andredm7 -ms.collection: - - highpri - - tier1 ---- - -# Windows feature update policies - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -## Windows feature updates for Windows 10 and later - -These policies control the minimum target version of Windows that a device is meant to accept. Throughout the rest of the article, these policies are referred to as DSS policies. There are four of these policies in your tenant with the following naming convention: - -**`Modern Workplace DSS Policy [ring name]`** - -### Windows feature update deployment settings - -| Setting name | Test | First | Fast | Broad | -| ----- | ----- | ----- | ----- | ----- | -| Name | Current targeted version of Windows | Current targeted version of Windows | Current targeted version of Windows | Current targeted version of Windows | -| Rollout options | Immediate start | Immediate start | Immediate start | Immediate start | - -### Windows feature update policy assignments - -| Setting name | Test | First | Fast | Broad | -| ----- | ----- | ----- | ----- | ----- | -| Included groups | Modern Workplace Devices-Windows Autopatch-Test | Modern Workplace Devices-Windows Autopatch-First | Modern Workplace Devices-Windows Autopatch-Fast | Modern Workplace Devices-Windows Autopatch-Broad | - -## Default release policy configuration - -You can see the following default policies created by the service in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431): - -| Policy name | Phase mapping | Feature update version | Rollout options | Support end date | -| ----- | ----- | ----- | ----- | ----- | -| Windows Autopatch - DSS Policy [Test] | Phase 1 | Windows 10 22H2 | Make update available as soon as possible | October 14, 2025 | -| Windows Autopatch - DSS Policy [First] | Phase 2 | Windows 10 22H2 | Make update available as soon as possible | October 14, 2025 | -| Windows Autopatch - DSS Policy [Fast] | Phase 3 | Windows 10 22H2 | Make update available as soon as possible | October 14, 2025 | -| Windows Autopatch - DSS Policy [Broad] | Phase 4 | Windows 10 22H2 | Make update available as soon as possible | October 14, 2025 | - -> [!NOTE] -> Gradual rollout settings aren't configured in the default Windows Update feature policy. If the date of the final group availability is changed to a past date, all remaining devices are offered the update as soon as possible. For more information, see [rollout options for Windows Updates in Microsoft Intune](/mem/intune/protect/windows-update-rollout-options#make-updates-available-gradually). - -## Global release policy configuration - -Windows Autopatch configures the values for its global Windows feature update policy. See the following default policies created by the service in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431): - -| Policy name | Feature update version | Rollout options | Support end date | -| ----- | ----- | ----- | ----- | -| Windows Autopatch - Global DSS Policy [Test] | Windows 10 22H2 | Make update available as soon as possible | October 14, 2025 | - -> [!NOTE] -> Gradual rollout settings aren't configured in the default Windows Update feature policy. If the date of the final group availability is changed to be a past date, all remaining devices are offered the update as soon as possible. For more information, see [rollout options for Windows Updates in Microsoft Intune](/mem/intune/protect/windows-update-rollout-options#make-updates-available-gradually). - -### Difference between the default and global update policies - -> [!IMPORTANT] -> Once you create a custom Windows feature update release, both the global and the default Windows feature update policies are unassigned from Autopatch group's deployment rings behind the scenes. - -The differences in between the global and the default Windows feature update policy values are: - -| Default Windows feature update policy | Global Windows feature update policy | -| ----- | ----- | -| | | - -## Windows Update ring policies - -Feature update policies work with Windows Update rings policies. Windows Update rings policies are created for each deployment ring for the [Autopatch group](../deploy/windows-autopatch-groups-overview.md#key-benefits) based on the deployment settings you define. The policy name convention is **`Windows Autopatch Update Policy - - `**. - -The following table details the default Windows Update rings policy values that affect either the default or custom Windows feature updates releases: - -| Policy name | Microsoft Entra group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline | -| ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | -| Windows Autopatch Update Policy - Default - Test | Windows Autopatch - Test | 0 | 0 | 30 | 0 | 5 | 0 | Yes | -| Windows Autopatch Update Policy - Default - Ring1 | Windows Autopatch - Ring1 | 1 | 0 | 30 | 2 | 5 |2 | Yes | -| Windows Autopatch Update Policy - Default - Ring2 | Windows Autopatch - Ring2 | 6 | 0 | 30 | 2 | 5 | 2 | Yes | -| Windows Autopatch Update Policy - Default - Ring3 | Windows Autopatch - Ring3 | 9 | 0 | 30 | 5 | 5 | 2 | Yes | -| Windows Autopatch Update Policy - Default - Last | Windows Autopatch - Last | 11 | 0 | 30 | 3 | 5 | 2 | Yes | - -> [!IMPORTANT] -> When you create a custom Windows feature update release, new Windows feature update policies are: - -## Phase policy configuration - -Windows Autopatch creates one Windows feature update policy per phase using the following naming convention: - -**`Windows Autopatch - DSS policy - - Phase `** - -These policies can be viewed in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -The following table is an example of the Windows feature update policies that were created for phases within a release: - -| Policy name | Feature update version | Rollout options| Day between groups | Support end date | -| ----- | ----- | ----- | ----- | ----- | -| Windows Autopatch - DSS Policy - My feature update release - Phase 1 | Windows 10 22H2 | Make update available as soon as possible| N/A | October 14, 2025 | -| Windows Autopatch - DSS Policy - My feature update release - Phase 2 | Windows 10 22H2 | Make update available as soon as possible | 7 | October 14, 2025 | -| Windows Autopatch - DSS Policy - My feature update release - Phase 3 | Windows 10 22H2 | Make update available as soon as possible | 7 | October 14, 2025 | -| Windows Autopatch - DSS Policy - My feature update release - Phase 4 | Windows 10 22H2 | Make update available as soon as possible | 7 | October 14, 2025 | -| Windows Autopatch - DSS Policy - My feature update release - Phase 5 | Windows 10 22H2 | Make update available as soon as possible | 7 | October 14, 2025 | - diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-communications.md deleted file mode 100644 index 02ddb0ce1e..0000000000 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-communications.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Windows quality update communications -description: This article explains Windows quality update communications -ms.date: 09/16/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: concept-article -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - highpri - - tier1 ---- - -# Windows quality update communications - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -There are three categories of communication that are sent out during a Windows quality and feature update: - -- [Standard communications](#standard-communications) -- [Communications during release](#communications-during-release) -- [Incident communications](#incident-communications) - -Communications are posted to, as appropriate for the type of communication, to the: - -- Message center -- Service health dashboard -- Windows Autopatch messages section of the Microsoft Intune admin center - -:::image type="content" source="../media/update-communications.png" alt-text="Update communications timeline" lightbox="../media/update-communications.png"::: - -## Standard communications - -| Communication | Location | Timing | Description | -| ----- | ----- | ----- | ----- | -| Release schedule |
  • Messages blade
  • Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • | At least seven days before the second Tuesday of the month| Notification of the planned release window for each ring. | -| Release start | Same as release schedule | The second Tuesday of every month. | Notification that the update is now being released into your environment. | -| Release summary | Same as release schedule | The fourth Tuesday of every month. | Informs you of the percentage of eligible devices that were patched during the release. | - -### Opt out of receiving emails for standard communications - -If you don't want to receive standard communications for Windows Updates releases via email, you can choose to opt out. - -**To opt out of receiving emails for standard communications:** - -1. Go to the **[Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)**. -2. Go to **Windows Autopatch** > **Tenant administration** > select **Admin contacts**. -3. Select the admin contact you want to opt out for. -4. Select **Edit Contact**. -5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane. -6. Select **Save** to apply the changes. - -## Communications during release - -The most common type of communication during a release is a customer advisory. Customer advisories are posted to both Message center and the Messages blade of the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) shortly after Autopatch becomes aware of the new information. - -There are some circumstances where Autopatch needs to change the release schedule based on new information. - -For example, new threat intelligence might require us to expedite a release, or we might pause due to user experience concerns. If the schedule of a quality update is changed, paused, resumed, or expedited, we inform you as quickly as possible so that you can adapt to the new information. - -## Incident communications - -Despite the best intentions, every service should plan for failure and success. When there's an incident, timely and transparent communication is key to building and maintaining your trust. If insufficient numbers of devices are updated to meet the service level objective, devices experience an interruption to productivity, and an incident are raised. Microsoft updates the status of the incident at least once every 24 hours. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md deleted file mode 100644 index 9d2fd72bf2..0000000000 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide.md +++ /dev/null @@ -1,331 +0,0 @@ ---- -title: Windows Autopatch deployment guide -description: This guide explains how to successfully deploy Windows Autopatch in your environment -ms.date: 07/08/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: how-to -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - tier2 ---- - -# Windows Autopatch deployment guide - -As organizations move to support hybrid and remote workforces, and continue to adopt cloud-based endpoint management with services such as Intune, managing updates is critical. - -Windows Autopatch is a cloud service that automates Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams updates to improve security and productivity across your organization. - -A successful Windows Autopatch deployment starts with planning and determining your objectives. Use this deployment guide to plan your move or migration to Windows Autopatch. - -This guide: - -- Helps you plan your deployment and adopt Windows Autopatch -- Lists and describes some common objectives -- Provides a recommended deployment plan -- Provides migration considerations for Windows Update for Business (WUfB) and Microsoft Configuration Manager -- Lists some common general considerations when deploying Windows Autopatch -- Provides suggested business case benefits and communication guidance -- Gives additional guidance and how to join the Autopatch community - -## Determine your objectives - -This section details some common objectives when using Windows Autopatch. - -Once an organization is onboarded, Windows Autopatch automatically creates multiple progressive deployment rings and applies the latest updates according to Windows Autopatch recommended practices and your organization's custom configuration. While there are options to adjust configurations such as quality update cadence, the service provides you with a baseline to begin establishing your update objectives. - -Use Windows Autopatch to solve the following challenges: - -- Difficulty developing and defending update cadence and general best practices -- Increase visibility and improve issue reporting -- Achieving a consistent update success rate -- Standardize and optimize the configuration for devices, policies, tools and versions across their environment -- Transition to modern update management by configuring Intune and Windows Update for Business -- Make update processes more efficient and less reliant on IT admin resources -- Address vulnerabilities and Windows quality updates as soon as possible to improve security -- Assist with compliance to align with industry standards -- Invest more time on value-add IT projects rather than monthly updates -- Planning and managing Windows feature updates -- Transition to Windows 11 - -## Recommended deployment steps - -The following deployment steps can be used as a guide to help you to create your organization's specific deployment plan to adopt and deploy Windows Autopatch. - -:::image type="content" source="../media/windows-autopatch-deployment-journey.png" alt-text="Windows Autopatch deployment journey" lightbox="../media/windows-autopatch-deployment-journey.png"::: - -### Step one: Prepare - -[Review the prerequisites](../prepare/windows-autopatch-prerequisites.md) and [enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md) into the Windows Autopatch service. At this stage, your devices aren't affected. You can enroll your tenant and review the service options before registering your devices. - -| Step | Description | -| ----- | ----- | -| **1A: Set up the service** |
      • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
      • Review and understand [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
      • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
      • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) completed successfully
      | -| **1B: Confirm update service needs and configure your workloads** |
      • [Windows quality updates](../manage/windows-autopatch-windows-quality-update-overview.md): Expedite preferences and cadence customizations
      • [Windows feature updates](../manage/windows-autopatch-windows-feature-update-overview.md): Servicing version preferences
      • [Driver and firmware updates](../manage/windows-autopatch-manage-driver-and-firmware-updates.md): Set to either Manual or Automatic
      • [Microsoft 365 Apps for enterprise](../manage/windows-autopatch-microsoft-365-apps-enterprise.md): Set to either Monthly Enterprise Channel or opt-out
      • [Microsoft Edge](../manage/windows-autopatch-edge.md): Required. Beta and Stable Channel
      • [Microsoft Teams](../manage/windows-autopatch-teams.md): Required. Automatic
      | -| **1C: Consider your Autopatch groups distribution** | Organizations have a range of Windows devices including desktop computers, laptops and tablets that might be grouped across multiple logical or physical locations. When planning your Autopatch groups strategy, consider the Autopatch group structure that best fits your organizational needs. It's recommended to utilize the service defaults as much as possible. However, if necessary, you can customize the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md) with additional deployment rings and/or [create your own Custom Autopatch group(s)](../deploy/windows-autopatch-groups-overview.md).

      • Review your device inventory and consider a representative mix of devices across your distribution
      • Review your Microsoft Entra groups that you wish to use to register devices into the service
      • Review [device registration options](../deploy/windows-autopatch-device-registration-overview.md) and [register your first devices](../deploy/windows-autopatch-register-devices.md)
      | -| **1D: Review network optimization** | It's important to [prepare your network](../prepare/windows-autopatch-configure-network.md) to ensure that your devices have access to updates in the most efficient way, without impacting your infrastructure.

      A recommended approach to manage bandwidth consumption is to utilize [Delivery Optimization](../prepare/windows-autopatch-configure-network.md#delivery-optimization). You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages amongst multiple devices in your deployment. | - -### Step two: Evaluate - -Evaluate Windows Autopatch with around 50 devices to ensure the service meets your needs. You can adjust this number based on your organizational make-up. It's recommended to monitor one update cycle during this evaluation step. - -| Step | Description | -| ----- | ----- | -| **2A: Review reporting capabilities** |
      • [Windows quality update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
      • [Windows feature update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
      • [Windows Update for Business (WUfB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report)
      Windows Autopatch quality and feature update reports provide a progress view on the latest update cycle for your devices. These reports should be reviewed often to ensure you understand the update state of your Windows Autopatch devices.

      There might be times when using Windows Autopatch for update deployment that it's beneficial to review Windows Update for Business (WUfB) reports.

      For example, when preparing to deploy Windows 11, you might find it useful to evaluate your devices using the [Windows feature update device readiness](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report) and [Windows feature update compatibility risks reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-compatibility-risks-report) in Intune.| -| **2B: Review operational changes** | As part of the introduction of Windows Autopatch, you should consider how the service integrates with your existing operational processes.
      • Identify service desk and end user computing process changes
      • Identify any alignment with third party support agreements
      • Review the default Windows Autopatch support process and alignment with your existing Premier and Unified support options
      • Identify IT admin process change & service interaction points
      | -| **2C: Educate end users and key stakeholders**| Educate your end users by creating guides for the Windows Autopatch end user experience.
      • [Windows quality updates](../manage/windows-autopatch-windows-quality-update-end-user-exp.md)
      • [Windows feature updates](../manage/windows-autopatch-windows-feature-update-overview.md)
        • [Microsoft 365 Apps for enterprise updates](../manage/windows-autopatch-microsoft-365-apps-enterprise.md)
      • [Microsoft Edge](../manage/windows-autopatch-edge.md)
      • [Microsoft Teams](../manage/windows-autopatch-teams.md)

      Include your IT support and help desk in the early stages of the Windows Autopatch deployment and planning process. Early involvement allows your support staff to:
      • Gain knowledge and experience in identifying and resolving update issues more effectively
      • Prepare them to support production rollouts. Knowledgeable help desk and support teams also help end users adopt to changes

      Your support staff can experience a walkthrough of the Windows Autopatch admin experience through the [Windows Autopatch demo site](https://aka.ms/autopatchdemo). | -| **2D: Pilot planning** | Identify target pilot group(s) of up to 500 devices. It's recommended to include a cross-section of your organizational make-up to ensure your pilot results are representative of your organizational environment. | - -### Step three: Pilot - -Plan to pilot the service with around 500 devices to provide sufficient pilot coverage to be ready for deployment. You can adjust this number based on your organizational make-up. It's recommended to monitor one to two update cycles during the pilot step. - -| Step | Description | -| ----- | ----- | -| **3A: Register devices** | Register pilot device group(s) | -| **3B: Monitor update process success** |
      • Quality update: One to two update cycles
      • Feature update: Set of pilot devices scheduled across several weeks
      • Drivers and firmware: One to two update cycles
      • Microsoft 365 Apps for enterprise (if not opted-out): One to two update cycles
      • Microsoft Edge: One to two update cycles
      • Microsoft Teams: One to two update cycles
        • | -| **3C: Review reports** |
        • [Quality update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports): Monitor data in the reports across one to two update cycles
        • [Feature update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports): Monitor data in the reports across the update schedule
        • [Windows Update for Business (WUfB) reports](/mem/intune/protect/windows-update-compatibility-reports#use-the-windows-feature-update-device-readiness-report): Monitor data in the report across one to two update cycles
        | -| **3D: Implement operational changes** |
        • Pilot Service Desk, end user computing and third party (if applicable) process changes with pilot representatives
        • IT admins must:
          • Review deployment progress using Windows Autopatch reports
          • Respond to identified actions to help improve success rates
        | -| **3E: Communicate with stakeholders** | Review and action your stakeholder communication plan. | -| **3F: Deployment planning** | Prepare target deployment groups for phased deployment of Windows Autopatch. | - -### Step four: Deploy - -Following a successful pilot, you can commence deployment to your broader organization. The pace at which you deploy is dependent on your own requirements; for example, deploying in groups of 500 to 5000 per week are commonly used approaches to complete the deployment of Windows Autopatch. - -| Step | Description | -| ----- | ----- | -| **4A: Review reports** |
        • Review deployment progress using Windows Autopatch reports
        • Respond to identified actions to help improve success rates
        | -| **4B: Communicate with stakeholders** | Review and action your stakeholder communication plan | -| **4C: Complete operational changes** |
        • Service Desk readiness is complete and in place
        • IT admins take the required action(s) based on the Autopatch reports
        | - -## Migration considerations - -If you're an existing Windows Update for Business (WUfB) or Configuration Manager customer, there are several considerations that could accelerate your deployment along a shorter path. - -### Why migrate from Windows Update for Business or Configuration Manager to Windows Autopatch? - -Customers who are using Windows Update for Business (WUfB) or Configuration Manager can quickly adopt Windows Autopatch and take advantage of the key benefits that Windows Autopatch provides. - -When moving from Windows Update for Business (WUfB) or Configuration Manager to Windows Autopatch, you can enhance and optimize the update experience that you're already familiar with. - -Once migrated, there are several configuration tasks that you no longer need to carry out: - -| Autopatch benefit | Configuration Manager | Windows Update for Business (WUfB) | -| ----- | ----- | ----- | -| Automated setup and ongoing configuration of Windows Update policies | Manage and perform recurring tasks such as:
        • Download updates
        • Distribute to distribution points
        • Target update collections
        | Manage "static" deployment ring policies | -| Automated management of deployment ring membership | Manually check collection membership and targets | Manage "static" deployment ring membership | -| Maintain minimum Windows feature version and progressively move between servicing versions | Spend time developing, testing and rolling-out task sequence | Set up and deploy Windows feature update policies | -| Service provides release management, signal monitoring, testing, and Windows Update deployment | Setup, target and monitor update test collections | Manage Test deployment rings and manually monitor update signals | -| Simple, integrated process to turn on the service as part of the Windows 365 provisioning policy | Manually target Cloud PCs in device collections | Manually target Cloud PCs in Microsoft Entra groups | - -In addition to the reports, other benefits include: - -| Autopatch benefit | Configuration Manager and Windows Update for Business (WUfB) | -| ----- | ----- | -| Windows quality and feature update reports with integrated alerts, deep filtering, and status-at-a-glance | Requires you to manually navigate and hunt for status and alerts | -| Filter by action needed with integrated resolution documentation | Requires you to research and discover possible actions relating to update issues | -| Better visibility for IT admins, Security compliance and proof for regulator | Requires you to pull together different reports and views across multiple admin portals | - -Service management benefits include: - -| Autopatch benefit | Configuration Manager and Windows Update for Business (WUfB) | -| ----- | ----- | -| Windows automation and Microsoft Insights | First or third-party resources required to support and manage updates internally | -| Microsoft research and insights determine the 'go/no-go' for your update deployment | Limited signals and insights from your organization to determine the 'go/no-go' for your update deployment | -| Windows Autopatch might pause or roll back an update. The pause or rollback is dependent on the scope of impact and to prevent end user disruption | Manual intervention required, widening the potential impact of any update issues | - -### Migrating from Windows Update for Business (WUfB) to Windows Autopatch - -#### Assessing your readiness to migrate from Windows Update for Business (WUfB) to Windows Autopatch - -When moving from Windows Update for Business (WUfB) to Windows Autopatch, you can accelerate and simplify your adoption by assessing your readiness to quickly migrate to the Windows Autopatch service by considering key differences that might impact your deployment: - -| Step | Assessment step | Recommendation | -| ----- | ----- | ----- | -| **1** | "User based" vs. "device based" targeting | Windows Autopatch doesn't support "user based" targeting. If your Windows Update deployment is "user based", you must plan to move to a device-based targeting model by adding and registering devices into Windows Autopatch. Use the [Consider your Autopatch groups guidance](#step-one-prepare) | -| **2** | Microsoft Edge channels | Windows Autopatch deploys Microsoft Edge Stable channel to devices in all deployment rings except for the Test deployment ring. The Test deployment ring is configured for the Microsoft Edge Beta channel. If you're currently using different channels, your teams should understand that your Windows Autopatch devices use these channels. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare). | -| **3** | Microsoft 365 Apps for enterprise | Windows Autopatch deploys the Monthly Enterprise Channel to all Microsoft 365 Apps for enterprise clients. If your organization is using a different channel and you don't wish to adopt the Monthly Enterprise Channel, you can opt out Microsoft 365 Apps for enterprise updates. For more information, see [Confirm update service needs and configure your workloads](#step-one-prepare) | -| **4** | Prepare your policies | You should consider any existing policy configurations in your Windows Update for Business (WUfB), Intune or on-premises environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | -| **5** | Network optimization technologies | We recommend you consider your network optimization technologies as part of your Windows Autopatch deployment. However, if you're already using Windows Update for Business (WUfB) it's likely you already have your network optimization solution in place. For more information, see [Review network optimization](#step-one-prepare) | - -### Optimized deployment path: Windows Update for Business (WUfB) to Windows Autopatch - -Once you have assessed your readiness state to ensure you're aligned to Windows Autopatch readiness, you can optimize your deployment of Windows Autopatch to quickly migrate to the service. The following steps illustrate a recommended optimized deployment path: - -| Step | Example timeline | Task | -| ----- | ----- | ----- | -| **[Step one: Prepare > Set up the service](#step-one-prepare)** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
        • Prepare your environment, review existing update policies and [General Considerations](#general-considerations)
        • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
        • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
        • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
        • Verify the [changes made at feature activation](../references/windows-autopatch-changes-made-at-feature-activation.md) have completed successfully
        | -| **[Step one: Prepare > Adjust the service configuration based on your migration readiness](#step-one-prepare)** | Week one |
        • [Windows quality updates](../manage/windows-autopatch-windows-quality-update-overview.md)
        • [Windows feature updates](../manage/windows-autopatch-windows-feature-update-overview.md)
        • [Driver and firmware updates](../manage/windows-autopatch-manage-driver-and-firmware-updates.md)
        • [Microsoft 365 Apps for enterprise](../manage/windows-autopatch-microsoft-365-apps-enterprise.md)
        • [Microsoft Edge](../manage/windows-autopatch-edge.md)
        • [Microsoft Teams](../manage/windows-autopatch-teams.md)
        • [Create an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group)
        | -| **[Step two: Evaluate](#step-two-evaluate)** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | -| **[Step three: Pilot](#step-three-pilot)** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | -| **[Step four: Deploy](#step-four-deploy)** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | - -### Migrating from Configuration Manager to Windows Autopatch - -Regardless of if you're migrating from Configuration Manager to Microsoft Intune or if you're remaining with Configuration Manager, if you're currently using Configuration Manager to manage updates, you can migrate the update workloads to Windows Autopatch and take advantage of the key benefits for your Configuration Manager environment. - -#### Assessing your readiness to migrate from Configuration Manager to Windows Autopatch - -When you migrate from Configuration Manager to Windows Autopatch, the fastest path to quickly gain value from Windows Autopatch is to already have co-management and the requisite workloads moved to Intune. - -| Step | Assessment step | Recommendation | -| ----- | ----- | ----- | -| **1** | Turn on co-management | If you're using co-management across Configuration Manager and your managed devices, you meet the key requirements to use Windows Autopatch.

        If you don't have co-management, see [How to use co-management in Configuration Manager](/mem/configmgr/comanage/how-to-enable) | -| **2** | Use required co-management workloads | Using Windows Autopatch requires that your managed devices use the following three co-management workloads:
        • Windows Update policies workload
        • Device configuration workload
        • Office Click-to-Run apps workload

        If you have these workloads configured, you meet the key requirements to use Windows Autopatch. If you don't have these workloads configured, review [How to switch Configuration Manager workloads to Intune](/mem/configmgr/comanage/how-to-switch-workloads) | -| **3** | Prepare your policies | You should consider any existing policy configurations in your Configuration Manager (or on-premises) environment that could impact your deployment of Windows Autopatch. For more information, review [General considerations](#general-considerations) | -| **4** | Ensure Configuration Manager collections or Microsoft Entra device groups readiness | To move devices to Windows Autopatch, you must register devices with the Windows Autopatch service. To do so, use either Microsoft Entra device groups, or Configuration Manager collections. Ensure you have either Microsoft Entra device groups or Configuration Manager collections that allow you to evaluate, pilot and then migrate to the Windows Autopatch service. For more information, see [Register your devices](../deploy/windows-autopatch-register-devices.md). | - -### Optimized deployment path: Configuration Manager to Windows Autopatch - -Once you have assessed your readiness state to ensure you're aligned to Windows Autopatch readiness, you can optimize your deployment of Windows Autopatch to quickly migrate to the service. The following steps illustrate a recommended optimized deployment path: - -| Step | Example timeline | Task | -| ----- | ----- | ----- | -| **[Step one: Prepare > Set up the service](#step-one-prepare)** | Week one | Follow our standard guidance to turn on the Windows Autopatch service
        • Prepare your environment, review existing update policies and [General Considerations](#general-considerations).
        • Review and understand the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) when enrolling into the service
        • Enroll into the service and [add your admin contacts](../deploy/windows-autopatch-admin-contacts.md)
        • Review [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)
        • Verify the [changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) have completed successfully.
        | -| **[Step one: Prepare > Adjust the service configuration based on your migration readiness](#step-one-prepare)** | Week one |
        • [Windows quality updates](../manage/windows-autopatch-windows-quality-update-overview.md)
        • [Windows feature updates](../manage/windows-autopatch-windows-feature-update-overview.md)
        • [Driver and firmware updates](../manage/windows-autopatch-manage-driver-and-firmware-updates.md)
        • [Microsoft 365 Apps for enterprise](../manage/windows-autopatch-microsoft-365-apps-enterprise.md)
        • [Microsoft Edge](../manage/windows-autopatch-edge.md)
        • [Microsoft Teams](../manage/windows-autopatch-teams.md)
        • [Create an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group)
        | -| **[Step two: Evaluate](#step-two-evaluate)** | Week one to month two | Evaluate with around 50 devices for one update cycle to confirm the correct service configurations are in place | -| **[Step three: Pilot](#step-three-pilot)** | Month two to three | Pilot with around 500 - 5000 devices for one update cycle to ensure you can further validate with your key stakeholders and Service Desk teams | -| **[Step four: Deploy](#step-four-deploy)** | Month three to six | Phase deployments as necessary to migrate your estate. You can move as quickly as you feel comfortable | - -## General considerations - -As part of your planning process, you should consider any existing enterprise configurations in your environment that could affect your deployment of Windows Autopatch. - -Many organizations have existing policies and device management infrastructure, for example: - -- Group Policy Objects (GPO) -- Registry settings -- Configuration Manager -- Existing Mobile Device Management (MDM) policies -- Servicing profiles for Microsoft 365 Apps - -It's a useful exercise to create a baseline of your policies and existing settings to map out the configuration that could impact your move to Windows Autopatch. - -### Group policy - -Review existing policies and their structure. Some policies might apply globally, some apply at the site level, and some are specific to a device. The goal is to know and understand the intent of global policies, the intent of local policies, and so on. - -On-premises AD group policies are applied in the LSDOU order (Local, Site, Domain, and Organizational Unit (OU)). In this hierarchy, OU policies overwrite domain policies, domain policies overwrite site policies, and so on. - -| Area | Path | Recommendation | -| ----- | ----- | ----- | -| Windows Update Group Policy settings | `Computer Configuration\Administrative Templates\Windows Components\Windows Updates` | The most common Windows Update settings delivered through Group Policy can be found under this path. This is a good place for you to start your review. | -| Don't connect to any Windows Update Internet locations | `Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations` | This is a common setting for organizations that rely solely on intranet update locations such as Windows Server Update Services (WSUS) servers and can often be overlooked when moving to cloud update services such as Windows Update for Business (WUfB)

        When turned on, this policy prevents contact with the public Windows Update service and won't establish connections to Windows Update, and might cause the connection to Windows Update for Business (WUfB), and Delivery Optimization to stop working. | -| Scan Source policy | `Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service` | You can choose what types of updates to get from either Windows Server Update Services (WSUS) or Windows Update for Business (WUfB) service with the Windows Update Scan Source policy.

        You should review any scan source policy settings targeting devices to ensure:
        • That no conflicts exist that could affect update deployment through Windows Autopatch
        • Such policies aren't targeting devices enrolled into Windows Autopatch
        | - -### Registry settings - -Any policies, scripts or settings that create or edit values in the following registry keys might interfere with Windows and Office Update settings delivered through Autopatch. It's important to understand how these settings interact with each other and with the Windows and Office Update service as part of your Autopatch planning. - -| Key | Description | -| ----- | ----- | -| `HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState`
        (Intune MDM only cloud managed)

        `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`
        (If GPO/WSUS/Configuration Manager is deployed) | This key contains general settings for Windows Update, such as the update source, the service branch, and the deferral periods for feature and quality updates. | -| `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU`
        (If GPO/WSUS/Configuration Manager is deployed) | This key contains settings for Automatic Updates, such as the schedule, the user interface, and the detection frequency. | -| `HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update`
        (GPO/WSUS/Configuration Manager/Intune MDM Managed) | This key contains settings for update policies that are managed by Mobile Device Management (MDM) or Group Policy, such as pausing updates, excluding drivers, or configuring delivery optimization. | -| `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration`
        (GPO/Configuration Manager/Intune MDM Managed) | This key contains the registry keys for the Update Channel. This is a dynamic key that changes (depending on the configured settings) and the CDNBaseUrl (set when Microsoft 365 installs on the device).

        Look at the `UpdateChannel` value. The value tells you how frequently Office is updated.

        For more information, see [Manage Microsoft 365 Apps with Configuration Manager](/mem/configmgr/sum/deploy-use/manage-office-365-proplus-updates#bkmk_channel) to review the values, and what they're set to. Windows Autopatch currently supports the Monthly Enterprise Channel. If you opt into Office updates, it should be set to the Monthly Enterprise channel. | - -> [!NOTE] -> For more information about Windows Update Settings for Group Policy and Mobile Device Management (MDM), see [Manage additional Windows Update settings](/windows/deployment/update/waas-wu-settings). - -### Configuration Manager - -#### Windows and Microsoft 365 Apps for enterprise updates - -When Configuration Manager is deployed, and if Software Update policies are configured, the Software Update policies could conflict with Windows Update for Business and Office Update policies. - -Configuration Manager could require custom settings to disable software updates and assist with troubleshooting conflicting legacy, on-premises configurations to ensure that Autopatch deliver Windows and Office updates. It's safe to implement this change if you aren't managing third party updates from Configuration Manager. - -To ensure that Software Update Policies don't conflict with Windows Update for Business (WUfB) and Office Update policies, create a Software Update Policy in Configuration Manager that has: - -- Windows and Office Update configuration disabled -- Includes devices enrolled into Autopatch to remove any existing configuration(s). - -If this policy remains live, confirm that Autopatch devices aren't included in the live Software Update Policy in Configuration Manager. - -All devices that are enrolled in Autopatch use Windows and Office Update policies from the service, and any configurations that are applied through Configuration Manager Software Update Policies can be removed. - -For example, Configuration Manager Software Update Policy settings exclude Autopatch enrolled devices from receiving conflicting configuration for Windows and Office Updates: - -| Device setting | Recommended configuration | -| ----- | ----- | -| Enable software updates | No | -| Enable management of the Office 365 Client Agent | No | - -> [!NOTE] -> There is no requirement to create a Configuration Manager Software Update Policy if the policies aren't in use. - -#### Existing Mobile Device Management (MDM) policies - -| Policy | Description | -| ----- | ----- | -| **MDM to win over GP** | As part of the tenant enrollment process, Autopatch deploys a Device configuration profile, which applies to all registered devices to set Mobile Device Management (MDM) to win over Group Policy (GP) with the "MDMWinsOverGP" CSP.

        When applied, any MDM policy that's set, and has an equivalent GP Policy, results in the GP service blocking the policy setting. Setting the value to 0 (zero) or deleting the policy removes the GP policy blocks and restore the saved GP policies.

        This setting doesn't apply to all scenarios. This setting doesn't work for:
        • User scoped settings. This setting applies to device scoped settings only
        • Any custom Group Policy Object (GPO) outside of ADMX. For example, Microsoft Edge or Chrome settings
        • Any Windows Update for Business policies (WUfB). When you use Windows Update for Business (WUfB), ensure all previous Group Policies (GP) are removed that relate to Windows Update to ensure that Autopatch policies can take effect


        For more information and guidance on the expected behavior applied through this policy, see [ControlPolicyConflict Policy CSP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) | -| **Windows Update for Business (WUfB) policies** | If you have any existing *Deployment rings for Windows 10 and later or Windows feature update DSS policies* in place, ensure that the assignments don't target Windows Autopatch devices. This is to avoid creating policy conflicts and unexpected update behavior, which could impact update compliance and end user experience. | -| **Update Policy CSP** | If any policies from the [Update Policy CSP](/windows/client-management/mdm/policy-csp-update) that aren't deployed and managed by Windows Autopatch are deployed to devices, policy conflicts and unexpected update behavior could occur and could affect update compliance and the end user experience. | - -#### Servicing profiles for Microsoft 365 Apps for enterprise - -You can use automation to deliver monthly updates to Microsoft 365 Apps for enterprise directly from the Office Content Delivery Network (CDN) using [Servicing profiles](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#compatibility-with-servicing-profiles). A servicing profile takes precedence over other policies, such as a Microsoft Intune policy or the Office Deployment Tool. The servicing profile affects all devices that meet the [device eligibility requirements](../manage/windows-autopatch-microsoft-365-apps-enterprise.md) regardless of existing management tools in your environment. - -You can consider retargeting servicing profiles to non-Windows Autopatch devices or if you plan to continue using them, you can [block Windows Autopatch delivered Microsoft 365 App updates](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates) for Windows Autopatch-enrolled devices. - -## Business case - -Part of your planning might require articulating the business benefits of moving to Windows Autopatch from your existing update solution(s). Windows Autopatch provides several resources to help when building your business case. - -- [How Windows Autopatch works for you](https://www.microsoft.com/microsoft-365/windows/autopatch) -- [What is Windows Autopatch?](https://techcommunity.microsoft.com/t5/windows-autopatch/windows-autopatch-resource-guide/m-p/3502461#_note3) -- [Forrester - The Projected Total Economic Impact™ Of Windows Autopatch: Cost Savings And Business Benefits Enabled By Windows Autopatch](https://techcommunity.microsoft.com/t5/windows-autopatch/windows-autopatch-resource-guide/m-p/3502461#_note6) -- [Windows Autopatch Skilling snack](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/skilling-snack-windows-autopatch/ba-p/3787448) - -## Stakeholder communications - -Change management relies on clear and helpful communication about upcoming changes. The best way to have a smooth deployment is to make sure end users and stakeholders are aware of all changes and disruptions. Your rollout communication plan should include all pertinent information, how to notify users, and when to communicate. - -- Identify groups impacted by the Autopatch deployment -- Identify key stakeholders in the impacted groups -- Determine the types of communications needed -- Develop your messaging based on the [Recommended deployment steps](#recommended-deployment-steps) -- Create your stakeholder and communication plan schedule based on the [Recommended deployment steps](#recommended-deployment-steps) -- Have communications drafted and reviewed, and consider your delivery channels such as: - - Social media posts - - Internal messaging app (for example, Microsoft Teams) - - Internal team site - - Email - - Company blog - - Prerecorded on-demand videos - - Virtual meeting(s) - - In-person meetings - - Team workshops -- Deploy your stakeholder communication plan - -## Review your objectives and business case with stakeholders - -Review your original objectives and business case with your key stakeholders to ensure your outcomes have been met and to ensure your expected value has been achieved. - -## Need additional guidance? - -If you need assistance with your Windows Autopatch deployment journey, you have the following support options: - -- Microsoft Account Team -- [Microsoft FastTrack](../manage/windows-autopatch-support-request.md#microsoft-fasttrack) -- Windows Autopatch Service Engineering Team - - [General support request](../manage/windows-autopatch-support-request.md) - -First contact your Microsoft Account team who can work with you to establish any guidance or support you might need. If you don't have a Microsoft Account Team contact or wish to explore other routes, Microsoft FastTrack offers Microsoft 365 deployment guidance for customers with 150 or more licenses of an eligible subscription at no additional cost. Finally, you can also log a support request with the Windows Autopatch Service Engineering Team. - -### Windows Commercial Advisors (WCA) - -Once you're underway with your deployment, consider joining the [Windows Commercial Advisors (WCA)](https://aka.ms/joinccp) community within the [Microsoft Management Customer Connection Program (MM CCP)](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/announcing-the-microsoft-management-customer-connection-program/ba-p/3725035), where you can: - -- Engage directly with the Windows Commercial Engineering Teams and other Windows Commercial Customers -- Gain access to: - - Exclusive virtual meetings - - Focus groups - - Surveys - - Teams discussions - - Previews diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index c368cbf204..40e8e3904b 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -28,7 +28,7 @@ sections: Windows Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not supported. - question: How do I access Windows Autopatch? answer: | - You can access Windows Autopatch through Intune. For more information, see [Start using Windows Autopatch](../prepare/windows-autopatch-feature-activation.md#use-microsoft-intune-for-windows-autopatch) and [Prerequisites](../prepare/windows-autopatch-prerequisites.md) to ensure you meet the licensing requirements to activate all [Windows Autopatch features](../overview/windows-autopatch-overview.md#windows-enterprise-e3-and-f3-licenses). + You can access Windows Autopatch through Intune. For more information, see [Start using Windows Autopatch](../prepare/windows-autopatch-feature-activation.md#use-microsoft-intune-for-windows-autopatch) and [Prerequisites](../prepare/windows-autopatch-prerequisites.md) to ensure you meet the licensing requirements. - name: Requirements questions: - question: What are the licensing requirements for Windows Autopatch? diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md deleted file mode 100644 index 47ec915cf2..0000000000 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Roles and responsibilities -description: This article describes the roles and responsibilities provided by Windows Autopatch and what the customer must do -ms.date: 07/08/2024 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: concept-article -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - highpri - - tier1 ---- - -# Roles and responsibilities - -This article outlines your responsibilities and Windows Autopatch's responsibilities when: - -- [Preparing to activate Windows Autopatch features](#prepare) -- [Deploying the service](#deploy) -- [Operating with the service](#manage) - -## Prepare - -| Task | Your responsibility | Windows Autopatch | -| ----- | :-----: | :-----: | -| Review the [prerequisites](../prepare/windows-autopatch-prerequisites.md) | :heavy_check_mark: | :x: | -| Review the [FAQ](../overview/windows-autopatch-faq.yml) | :heavy_check_mark: | :x: | -| [Review the service data platform and privacy compliance details](../overview/windows-autopatch-privacy.md) | :heavy_check_mark: | :x: | -| Consult the [Deployment guide](../overview/windows-autopatch-deployment-guide.md) | :heavy_check_mark: | :x: | -| Ensure device [prerequisites](../prepare/windows-autopatch-prerequisites.md) are met and in place prior to feature activation | :heavy_check_mark: | :x: | -| Ensure [infrastructure and environment prerequisites](../prepare/windows-autopatch-configure-network.md) are met and in place before feature activation | :heavy_check_mark: | :x: | -| Prepare to remove your devices from existing unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies | :heavy_check_mark: | :x: | -| [Configure required network endpoints](../prepare/windows-autopatch-configure-network.md#required-microsoft-product-endpoints) | :heavy_check_mark: | :x: | -| [Activate Windows Autopatch features](../prepare/windows-autopatch-feature-activation.md) | :heavy_check_mark: | :x: | -| Identify stakeholders for deployment communications | :heavy_check_mark: | :x: | - -For more information and assistance with preparing for your Windows Autopatch deployment journey, see [Need additional guidance](../overview/windows-autopatch-deployment-guide.md#need-additional-guidance). - -## Deploy - -| Task | Your responsibility | Windows Autopatch | -| ----- | :-----: | :-----: | -| [Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md) in Microsoft Intune | :heavy_check_mark: | :x: | -| [Deploy and configure Windows Autopatch service configuration](../references/windows-autopatch-changes-made-at-feature-activation.md) | :x: | :heavy_check_mark: | -| Educate users on the Windows Autopatch end user update experience
        • [Windows quality update end user experience](../manage/windows-autopatch-windows-quality-update-end-user-exp.md)
        • [Windows feature update end user experience](../manage/windows-autopatch-manage-windows-feature-update-releases.md)
        • [Microsoft 365 Apps for enterprise end user experience](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#end-user-experience)
        • [Microsoft Edge end user experience](../manage/windows-autopatch-edge.md)
        • [Microsoft Teams end user experience](../manage/windows-autopatch-teams.md#end-user-experience)
        | :heavy_check_mark: | :x: | -| Review network optimization
        • [Prepare your network](../prepare/windows-autopatch-configure-network.md)
        • [Delivery Optimization](../prepare/windows-autopatch-configure-network.md#delivery-optimization) | :heavy_check_mark: | :x: | -| Review existing configurations
          • Remove your devices from existing unsupported [Windows Update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
          • Consult [General considerations](../overview/windows-autopatch-deployment-guide.md#general-considerations)
          | :heavy_check_mark: | :x: | -| Confirm your update service needs and configure your workloads
          • [Allow or block Microsoft 365 Apps for enterprise updates](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates)
          • [Manage driver and firmware updates](../manage/windows-autopatch-manage-driver-and-firmware-updates.md)
          • [Customize Windows Update settings](../manage/windows-autopatch-customize-windows-update-settings.md)
          • Decide your [Windows feature update versions(s)](../manage/windows-autopatch-windows-feature-update-overview.md)
          | :heavy_check_mark: | :x: | -| [Consider your Autopatch groups distribution](../deploy/windows-autopatch-groups-overview.md)
          • [Create an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group)
          | :heavy_check_mark: | :x: | -| [Register devices](../deploy/windows-autopatch-register-devices.md)
          • [Review your device registration options](../deploy/windows-autopatch-device-registration-overview.md)
          • [Register your first devices](../deploy/windows-autopatch-register-devices.md) | :heavy_check_mark: | :x: | -| [Review devices report](../deploy/windows-autopatch-register-devices.md#devices-report) | :x: | :heavy_check_mark: | -| Automatically assign devices to deployment rings at device registration
            • [Windows Autopatch group deployment rings](../deploy/windows-autopatch-groups-overview.md#autopatch-group-deployment-rings)
            | :x: | :heavy_check_mark: | -| Remediate registration issues
            • [For devices displayed in the **Not ready** tab](../deploy/windows-autopatch-post-reg-readiness-checks.md#devices-blade-registered-and-not-registered-tabs)
            • [For devices displayed in the **Not registered** tab](../deploy/windows-autopatch-post-reg-readiness-checks.md#devices-blade-registered-and-not-registered-tabs)
            • [For devices with conflicting configurations](../references/windows-autopatch-conflicting-configurations.md)
            | :heavy_check_mark: | :x: | -| Populate the Test and Last deployment ring membership
            • [Windows Autopatch group deployment rings](../deploy/windows-autopatch-groups-overview.md#autopatch-group-deployment-rings)
            | :heavy_check_mark: | :x: | -| [Manually override device assignments to deployment rings](../deploy/windows-autopatch-register-devices.md#move-devices-in-between-deployment-rings) | :heavy_check_mark: | :x: | -| Review device conflict scenarios
            • [Device conflict in deployment rings within an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)
            • [Device conflict across different Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-across-different-autopatch-groups)
            | :heavy_check_mark: | :x: | -| Communicate to end-users, help desk and stakeholders | :heavy_check_mark: | :x: | - -## Manage - -| Task | Your responsibility | Windows Autopatch | -| ----- | :-----: | :-----: | -| [Maintain contacts in the Microsoft Intune admin center](../deploy/windows-autopatch-admin-contacts.md) | :heavy_check_mark: | :x: | -| [Maintain and manage the Windows Autopatch service configuration](../monitor/windows-autopatch-maintain-environment.md) | :x: | :heavy_check_mark: | -| [Maintain customer configuration to align with the Windows Autopatch service configuration](../monitor/windows-autopatch-maintain-environment.md) | :heavy_check_mark: | :x: | -| Resolve service remediated device conflict scenarios
            • [Device conflict in deployment rings within an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)
            | :x: | :heavy_check_mark: | -| Resolve remediated device conflict scenarios
            • [Device conflict across different Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-across-different-autopatch-groups)
            • [Device conflict prior to device registration](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-before-device-registration)
            | :heavy_check_mark: | :x: | -| Maintain the Test and Last deployment ring membership
            • [Windows Autopatch deployment rings](../deploy/windows-autopatch-groups-overview.md#autopatch-group-deployment-rings)
            | :heavy_check_mark: | :x: | -| [Define and implement service default release schedule](../manage/windows-autopatch-windows-quality-update-overview.md) | :x: | :heavy_check_mark: | -| Maintain your workload configuration and custom release schedule
            • [Manage driver and firmware updates](../manage/windows-autopatch-manage-driver-and-firmware-updates.md)
            • [Customize Windows Update settings](../manage/windows-autopatch-customize-windows-update-settings.md)
            • [Decide your Windows feature update version(s)](../manage/windows-autopatch-windows-feature-update-overview.md)
            | :heavy_check_mark: | :x: | -| Communicate the update [release schedule](../manage/windows-autopatch-windows-quality-update-communications.md) to IT admins | :x: | :heavy_check_mark: | -| Release updates (as scheduled)
            • [Windows quality updates](../manage/windows-autopatch-windows-quality-update-overview.md)
            • [Windows feature updates](../manage/windows-autopatch-windows-feature-update-overview.md)
            • [Microsoft 365 Apps for enterprise](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#update-release-schedule)
            • [Microsoft Edge](../manage/windows-autopatch-edge.md#update-release-schedule)
            • [Microsoft Teams](../manage/windows-autopatch-teams.md#update-release-schedule)
                • | :x: | :heavy_check_mark: | -| [Release updates](../manage/windows-autopatch-windows-quality-update-overview.md) | :x: | :heavy_check_mark: | -| [Release updates (OOB)](../manage/windows-autopatch-windows-quality-update-overview.md#out-of-band-releases) | :x: | :heavy_check_mark: | -| Deploy updates to devices | :x: | :heavy_check_mark: | -| Monitor [Windows quality](../manage/windows-autopatch-windows-quality-update-overview.md) or [feature updates](../manage/windows-autopatch-windows-feature-update-overview.md) through the release cycle | :x: | :heavy_check_mark: | -| Review [release announcements](../manage/windows-autopatch-windows-quality-update-overview.md#) | :heavy_check_mark: | :x: | -| Review deployment progress using Windows Autopatch reports
                • [Windows quality update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-quality-update-reports)
                • [Windows feature update reports](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#windows-feature-update-reports)
                | :heavy_check_mark: | :x: | -| [Pause updates (initiated by you)](../manage/windows-autopatch-windows-quality-update-overview.md#pause-and-resume-a-release) | :heavy_check_mark: | :x: | -| Run [ongoing post-registration device readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md) | :x: | :heavy_check_mark: | -| Maintain existing configurations
                • Remove your devices from existing and unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies
                • Consult [General considerations](../overview/windows-autopatch-deployment-guide.md#general-considerations)
                | :heavy_check_mark: | :x: | -| Understand the health of [Up to date](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#up-to-date-devices) devices and investigate devices that are
                • [Not up to date](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#not-up-to-date-devices)
                • [Not ready](../monitor/windows-autopatch-windows-quality-and-feature-update-reports-overview.md#not-ready-devices)
                • have [Device alerts](../monitor/windows-autopatch-device-alerts.md)
                • have [conflicting configurations](../references/windows-autopatch-conflicting-configurations.md)
                | | | -| [Raise, manage and resolve a service incident if an update management area isn't meeting the service level objective](../manage/windows-autopatch-support-request.md) | :x: | :heavy_check_mark: | -| [Exclude a device](../manage/windows-autopatch-exclude-device.md) | :heavy_check_mark: | :x: | -| [Register a device that was previously excluded](../manage/windows-autopatch-exclude-device.md#restore-a-device-or-multiple-devices-previously-excluded) | :heavy_check_mark: | :x: | -| [Request deactivation from Windows Autopatch](../manage/windows-autopatch-feature-deactivation.md) | :heavy_check_mark: | :x: | -| [Remove Windows Autopatch data from the service and exclude devices](../manage/windows-autopatch-feature-deactivation.md#microsofts-responsibilities-during-deactivation) | :x: | :heavy_check_mark: | -| [Maintain update configuration & update devices post deactivation from Windows Autopatch](../manage/windows-autopatch-feature-deactivation.md#your-responsibilities-after-deactivating-windows-autopatch-features) | :heavy_check_mark: | :x: | -| Review and respond to Message Center and Service Health Dashboard notifications
                • [Windows quality update communications](../manage/windows-autopatch-windows-quality-update-communications.md)
                • [Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md)
                | :heavy_check_mark: | :x: | -| Highlight Windows Autopatch management alerts that require customer action
                • [Tenant management alerts](../monitor/windows-autopatch-maintain-environment.md#windows-autopatch-tenant-actions)
                • [Policy health and remediation](../monitor/windows-autopatch-policy-health-and-remediation.md)
                | :x: | :heavy_check_mark: | -| Review and respond to Windows Autopatch management alerts
                • [Tenant management alerts](../monitor/windows-autopatch-maintain-environment.md#windows-autopatch-tenant-actions)
                • [Policy health and remediation](../monitor/windows-autopatch-policy-health-and-remediation.md)
                | :heavy_check_mark: | :x: | -| [Raise and respond to support requests](../manage/windows-autopatch-support-request.md) | :heavy_check_mark: | :x: | -| [Manage and respond to support requests](../manage/windows-autopatch-support-request.md#manage-an-active-support-request) | :x: | :heavy_check_mark: | -| Review the [What's new](../whats-new/windows-autopatch-whats-new-2024.md) section to stay up to date with updated feature and service releases | :heavy_check_mark: | :x: | diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-made-at-feature-activation.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-made-at-feature-activation.md deleted file mode 100644 index 432b2cc9ba..0000000000 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-made-at-feature-activation.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Changes made at feature activation -description: This reference article details the changes made to your tenant when you activate Windows Autopatch -ms.date: 03/03/2025 -ms.service: windows-client -ms.subservice: autopatch -ms.topic: concept-article -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: aaroncz -ms.reviewer: hathind -ms.collection: - - highpri - - tier1 ---- - -# Changes made at feature activation - -[!INCLUDE [windows-autopatch-enterprise-e3-f3-licenses](../includes/windows-autopatch-enterprise-e3-f3-licenses.md)] - -The following configuration details explain the changes made to your tenant when consenting to Windows Autopatch feature activation with the Windows Autopatch service. - -> [!IMPORTANT] -> The service manages and maintains the following configuration items. Don't change, edit, add to, or remove any of the configurations. Doing so might cause unintended configuration conflicts and impact the Windows Autopatch service. - -## Windows Autopatch enterprise applications - -Enterprise applications are applications (software) that a business uses to do its work. - -Windows Autopatch creates an enterprise application in your tenant. This enterprise application is used to run the Windows Autopatch service. - -| Enterprise application name | Usage | Permissions | -| ----- | ------ | ----- | -| Modern Workplace Management | The Modern Workplace Management application:
                • Manages the service
                • Publishes baseline configuration updates
                • Maintains overall service health
                |
                • DeviceManagementApps.ReadWrite.All
                • DeviceManagementConfiguration.ReadWrite.All
                • DeviceManagementManagedDevices.PriviligedOperation.All
                • DeviceManagementManagedDevices.ReadWrite.All
                • DeviceManagementRBAC.ReadWrite.All
                • DeviceManagementServiceConfig.ReadWrite.All
                • Directory.Read.All
                • Group.Create
                • Policy.Read.All
                • WindowsUpdates.ReadWrite.All
                | - -## Microsoft Entra groups - -Windows Autopatch creates the required Microsoft Entra groups to operate the service. - -The following groups target Windows Autopatch configurations to devices and management of the service by our [first party enterprise applications](#windows-autopatch-enterprise-applications). - -| Group name | Description | -| ----- | ----- | -| Modern Workplace Devices-Virtual Machine | All Autopatch virtual devices | -| Windows Autopatch-Devices all | All Autopatch devices | -| Modern Workplace Devices-Windows Autopatch-Test | Deployment ring for testing update deployments prior production rollout | -| Modern Workplace Devices-Windows Autopatch-First | First production deployment ring for early adopters | -| Modern Workplace Devices-Windows Autopatch-Fast | Fast deployment ring for quick rollout and adoption | -| Modern Workplace Devices-WindowsAutopatch-Broad | Final deployment ring for broad rollout into the organization | - -## Windows feature update policies - -- Windows Autopatch - Global DSS Policy - -| Policy name | Policy description | Value | -| ----- | ----- | ----- | -| Windows Autopatch - Global DSS Policy | Global DSS policy for Test device group with the required minimum OS version | Assigned to:
                • Modern Workplace Devices-Windows Autopatch-Test

                Exclude from:
                • Modern Workplace - Windows 11 Pre-Release Test Devices
                | - -## Microsoft Office update policies - -> [!IMPORTANT] -> By default, these policies aren't deployed. You can opt in to deploy these policies when you [activate Windows Autopatch features](../prepare/windows-autopatch-feature-activation.md).

                To update Microsoft Office, you must [create at least one Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md) and the toggle must be set to [**Allow**](../manage/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates).

                - -- Windows Autopatch - Office Configuration -- Windows Autopatch - Office Update Configuration [Test] -- Windows Autopatch - Office Update Configuration [First] -- Windows Autopatch - Office Update Configuration [Fast] -- Windows Autopatch - Office Update Configuration [Broad] - -| Policy name | Policy description | Properties | Value | -| ----- | ----- | ----- | ----- | -| Windows Autopatch - Office Configuration | Sets Office Update Channel to the Monthly Enterprise servicing branch.

                Assigned to:

                1. Modern Workplace Devices-Windows Autopatch-Test
                2. Modern Workplace Devices-Windows Autopatch-First
                3. Modern Workplace Devices-Windows Autopatch-Fast
                4. Modern Workplace Devices-Windows Autopatch-Broad
                |
                1. Enable Automatic Updates
                2. Hide option to enable or disable updates
                3. Update Channel
                4. Channel Name (Device)
                5. Hide Update Notifications
                6. Update Path
                7. Location for updates (Device)
                |
                1. Enabled
                2. Enabled
                3. Enabled
                4. Monthly Enterprise Channel
                5. Disabled
                6. Enabled
                7. `http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6`
                | -| Windows Autopatch - Office Update Configuration [Test] | Sets the Office update deadline

                Assigned to:

                1. Modern Workplace Devices-Windows Autopatch-Test
                |
                1. Delay downloading and installing updates for Office
                2. Update Deadline
                |
                1. Enabled; `Days(Device) == 0 days`
                2. Enabled; `Update Deadline(Device) == 7 days`
                | -| Windows Autopatch - Office Update Configuration [First] | Sets the Office update deadline

                Assigned to:

                1. Modern Workplace Devices-Windows Autopatch-First
                |
                1. Delay downloading and installing updates for Office
                2. Update Deadline
                |
                1. Enabled; `Days(Device) == 0 days`
                2. Enabled; `Update Deadline(Device) == 7 days`
                | -| Windows Autopatch - Office Update Configuration [Fast] | Sets the Office update deadline

                Assigned to:

                1. Modern Workplace Devices-Windows Autopatch-Fast
                |
                1. Delay downloading and installing updates for Office
                2. Update Deadline
                |
                1. Enabled; `Days(Device) == 3 days`
                2. Enabled; `Update Deadline(Device) == 7 days`
                | -| Windows Autopatch - Office Update Configuration [Broad] | Sets the Office update deadline
                Assigned to:
                1. Modern Workplace Devices-Windows Autopatch-Broad
                  2. |
                  1. Delay downloading and installing updates for Office
                  2. Update Deadline
                  |
                  1. Enabled; `Days(Device) == 7 days`
                  2. Enabled; `Update Deadline(Device) == 7 days`
                  | - -## Microsoft Edge update policies - -> [!IMPORTANT] -> By default, these policies aren't deployed. You can opt in to deploy these policies when you [activate Windows Autopatch features](../prepare/windows-autopatch-feature-activation.md).

                  To update Microsoft Edge, you must [create at least one Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md) and the toggle must be set to [**Allow**](../manage/windows-autopatch-edge.md#allow-or-block-microsoft-edge-updates).

                  - -- Windows Autopatch - Edge Update Channel Stable -- Windows Autopatch - Edge Update Channel Beta - -| Policy name | Policy description | Properties | Value | -| ----- | ----- | ----- | ----- | -| Windows Autopatch - Edge Update Channel Stable | Deploys updates via the Edge Stable Channel

                  Assigned to:

                  1. Modern Workplace Devices-Windows Autopatch-First
                  2. Modern Workplace Devices-Windows Autopatch-Fast
                    1. Modern Workplace Devices-Windows Autopatch-Broad
                    |
                    1. Target Channel Override
                    2. Target Channel (Device)
                    |
                    1. Enabled
                    2. Stable
                    | -| Windows Autopatch - Edge Update Channel Beta | Deploys updates via the Edge Beta Channel

                    Assigned to:

                    1. Modern Workplace Devices-Windows Autopatch-Test
                    |
                    1. Target Channel Override
                    2. Target Channel (Device)
                    |
                    1. Enabled
                    2. Beta
                    | - -## Driver updates for Windows 10 and later - -> [!IMPORTANT] -> By default, these policies aren't deployed. You can opt in to deploy these policies when you [activate Windows Autopatch features](../prepare/windows-autopatch-feature-activation.md).

                    To update drivers and firmware, you must [create at least one Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md) and the toggle must be set to [**Allow**](../manage/windows-autopatch-manage-autopatch-groups.md#create-an-autopatch-group).

                    - -- Windows Autopatch - Driver Update Policy [Test] -- Windows Autopatch - Driver Update Policy [First] -- Windows Autopatch - Driver Update Policy [Fast] -- Windows Autopatch - Driver Update Policy [Broad] - -## PowerShell scripts - -| Script | Description | -| ----- | ----- | -| Modern Workplace - Autopatch Client Setup v1.1 | Installs necessary client components for the Windows Autopatch service | diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 285c7754e4..8605d49f4d 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -27,7 +27,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | -| [Prerequisites](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | Added F SKU licenses to the [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) section. Also see [FAQ](../overview/windows-autopatch-faq.yml)
                    • [MC690609](https://admin.microsoft.com/adminportal/home#/MessageCenter)
                    | +| [Prerequisites](../prepare/windows-autopatch-prerequisites.md) | Added F SKU licenses to the [More about licenses](../prepare/windows-autopatch-prerequisites.md) section. Also see [FAQ](../overview/windows-autopatch-faq.yml)
                    • [MC690609](https://admin.microsoft.com/adminportal/home#/MessageCenter)
                    | ## December service release @@ -212,7 +212,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | [Windows feature updates](../operate/windows-autopatch-windows-feature-update-overview.md#) | Added note about [Windows 10 Long-Term Servicing Channel (LTSC) support](../operate/windows-autopatch-windows-feature-update-overview.md) | | [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) | Added note about [Windows 10 Long-Term Servicing Channel (LTSC) support](../operate/windows-autopatch-windows-quality-update-overview.md) | | [Register your devices](../deploy/windows-autopatch-register-devices.md) | Added note about [Windows 10 Long-Term Servicing Channel (LTSC) support](../deploy/windows-autopatch-device-registration-overview.md#prerequisites-for-device-registration) | -| [Prerequisites](../prepare/windows-autopatch-prerequisites.md) | Added note about [Windows 10 Long-Term Servicing Channel (LTSC) support](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | +| [Prerequisites](../prepare/windows-autopatch-prerequisites.md) | Added note about [Windows 10 Long-Term Servicing Channel (LTSC) support](../prepare/windows-autopatch-prerequisites.md) | | [Privacy](../overview/windows-autopatch-privacy.md) | Added additional resources to the [Microsoft Windows 10/11 diagnostic data](../overview/windows-autopatch-privacy.md#microsoft-windows-1011-diagnostic-data) section | | [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md) | Updated Feature update policies section with Windows Autopatch - DSS Policy [deployment ring] | | [Register your devices](../deploy/windows-autopatch-register-devices.md) |
                    • Updated the [Built-in roles required for registration](../deploy/windows-autopatch-device-registration-overview.md#built-in-roles-required-for-device-registration) section
                    • Added more information about assigning less-privileged user accounts
                    | diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md index f9d30352a5..0d3bd50696 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md @@ -53,7 +53,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | ----- | ----- | | [Windows quality updates overview](../operate/windows-autopatch-groups-windows-quality-update-overview.md) | Added [Import Update rings for Windows 10 and later](../operate/windows-autopatch-groups-windows-quality-update-overview.md#import-update-rings-for-windows-10-and-later) | | [Windows quality updates overview](../operate/windows-autopatch-groups-windows-quality-update-overview.md#service-level-objective) | Updated the Service level objective, added the Service level objective calculation. | -| [Prerequisites](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | Added more E3 and E5 licenses to the [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) section. | +| [Prerequisites](../prepare/windows-autopatch-prerequisites.md) | Added more E3 and E5 licenses to the [More about licenses](../prepare/windows-autopatch-prerequisites.md) section. | ## January service releases