Frequently Asked Questions about Windows Autopatch

Windows Autopatch works with all supported versions of Windows 10 and Windows 11 Enterprise and Professional editions.

Windows Autopatch is a service that removes the need for organizations to plan and operate the update process. Windows Autopatch moves the burden from your IT to Microsoft. Windows Autopatch uses Windows Update for Business and other service components to update devices. Both are part of Windows Enterprise E3.

Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported.

Autopatch isn't available for 'A'. Windows Autopatch supports some 'F' series licensing. For more information, see More about licenses.

Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports Hybrid AD join or pure Microsoft Entra join.

Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not supported.

Yes. For those who used the promo code to access Windows Autopatch during public preview, you'll continue to have access to Windows Autopatch even when the promo code expires. There's no additional action you have to take to continue using Windows Autopatch.

• Supported Windows 10/11 Enterprise and Professional edition versions
• Azure Active Directory (Azure AD) Premium
• Hybrid Azure AD-Joined or Azure AD-joined only
• Microsoft Intune

Additional prerequisites for devices managed by Configuration Manager:

• Configuration Manager Co-management requirements
• A supported version of Configuration Manager
• Switch workloads for device configuration, Windows Update and Microsoft 365 Apps from Configuration Manager to Intune (minimum Pilot Intune. Pilot collection must contain the devices you want to register into Autopatch.)

• Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-based only) or F3. For more information, see More about licenses.
• Azure AD Premium (for co-management)
• Microsoft Intune (includes Configuration Manager 2010 or greater via co-management)

No, Windows Autopatch doesn't require any specific hardware. However, general hardware requirements for updates are still applicable. For example, to deliver Windows 11 to your Autopatch devices they must meet specific hardware requirements. Windows devices must be supported by your hardware OEM.

No you can't individually approve or deny devices. Once a device is registered with Windows Autopatch, updates are rolled out to the devices according to its ring assignment. Individual device level control isn't supported.

No, Windows 365 Enterprise Cloud PC's support all features of Windows Autopatch. For more information, see Virtual devices.

Cloud PC displays the model as the license type you've provisioned. For more information, see Windows Autopatch on Windows 365 Enterprise Workloads.

No. Autopatch is only available on enterprise workloads. For more information, see Windows Autopatch on Windows 365 Enterprise Workloads.

No. Don't change, edit, add to, or remove any of the configurations. Doing so might cause unintended configuration conflicts and impact the Windows Autopatch service. For more information about policies and configurations, see Changes made at tenant enrollment.

Windows Autopatch groups helps you manage updates in a way that makes sense for your businesses. For more information, see Windows Autopatch groups overview and Manage Windows Autopatch groups.

• Windows 10/11 quality updates: Windows Autopatch manages all aspects of deployment rings.
• Windows 10/11 feature updates: Windows Autopatch manages all aspects of deployment rings.
• Microsoft 365 Apps for enterprise updates: All devices registered for Windows Autopatch will receive updates from the Monthly Enterprise Channel.
• Microsoft Edge: Windows Autopatch configures eligible devices to benefit from Microsoft Edge's progressive rollouts on the Stable channel and will provide support for issues with Microsoft Edge updates.
• Microsoft Teams: Windows Autopatch allows eligible devices to benefit from the standard automatic update channels and will provide support for issues with Teams updates.

For Windows quality and feature updates, updates are applied to devices in the Test ring first. The devices are evaluated, and then rolled out to the First, Fast then Broad rings. There's an evaluation period at each progression. This process is dependent on customer testing and verification of all updates during these rollout stages. The outcome is to ensure that registered devices are always up to date and disruption to business operations is minimized to free up your IT department from that ongoing task.

Autopatch relies on the following capabilities to help resolve update issues:

• Pausing and resuming: For more information about pausing and resuming updates, see pausing and resuming Windows quality updates.
• Rollback: For more information about Microsoft 365 Apps for enterprise, see Update controls for Microsoft 365 Apps for enterprise.

Yes. Windows Autopatch provides a permanent pause of a feature update deployment.

For zero-day threats, Autopatch will have an expedited release cadence. For normal updates Autopatch, uses a regular release cadence starting with devices in the Test ring and completing with general rollout to the Broad ring.

The decision of when to move to the next ring is handled by Windows Autopatch; it isn't customer configurable.

No, you can't customize update scheduling. However, you can specify active hours to prevent users from updating during business hours.

Windows Autopatch doesn't support managing update deployment ring membership using your Microsoft Entra groups. For more information, see Moving devices in between deployment rings.

The release cadences are defined based on the update type. For example, a regular cadence (for a Windows quality update would be a gradual rollout from the Test ring to the Broad ring over 14 days whereas an expedited release would roll out more rapidly.

The FastTrack Center is the primary mode of support for customers who need assistance from Microsoft to meet the pre-requisites (such as Intune and Azure or Hybrid AD) for onboarding to Windows Autopatch. For more information, see Microsoft FastTrack for Windows Autopatch. When you've onboarded with Windows Autopatch, you can submit a support request with the Windows Autopatch Service Engineering Team.

Dual Scan for Windows has been deprecated and replaced with the scan source policy. Windows Autopatch supports the scan source policy if the Feature updates, and Windows quality updates workloads are configured for Windows update. If Feature and Windows updates are configured for WSUS, it could cause disruptions to the service and your release schedules.

Programmatic access to Autopatch isn't currently available.

Additional Content

Provide feedback or start a discussion in our Windows Autopatch Tech Community