Windows Autopatch document hard to understand and use.

Question

I've read the autopatch document. Microsoft seems to make things more confusing and provides less explanation with every iteration of a product.

I can not for the life of me understand what microsoft wants to set this up.
https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview#prerequisites-for-device-registration

I'm trying to setup a policy and I don't know if I should or shouldn't be making an azure group. I don't know if it should or shouldn't be dynamic. I don't know what automatic part the policy is going to do.

The wizard lacks explanation and doesn't explain jack.....

What happens if I put a group here... or there... or am I supposed to...

If I add rings then it asks for more groups...

The document talks about other groups being made for me... or do I need to make those?

Hello MS... document some stuff

Answer 1

@ComputerHabit, Thanks for your reply. For your questions, here are my answers.

Q1: Can I use one group? The use of dynamic and assigned really messes up understanding what is wanted for setup.

A1: You can just use Assigned group in Autopatch group. And you can add your Microsoft Entra dynamic device group to this as well. For Microsoft Entra group, I suggest create at least two. One is with only some testing devices. And the other is with more or all. one adds into Test and the other add to LAST. The device in TEST will apply the update policy first. If we get any issue during this time, we can adjust the policy to avoid the issue occurs on the group we add in LAST.

Q2: In the "TEST" and "LAST" rings it says assigned. Does that mean I can't use a dynamic azure group? WHY?

A2: No, the assigned in Autopatch group means you can only add one Microsoft Entra device group, either dynamic or assigned Microsoft Entra group.

Q3. Does this mean I then have to have two separate groups? One is dynamic and a query and one is not and static?

A3. No, no need for this.

Q4. Also the talk of device registration is now missing... I've seen videos on the process and it's GONE from the site now. I don't know what is supposed to happen now.

A4. The device will automatically do device registration when it is added into Autopatch group. You can see it under here.

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@ComputerHabit, Thanks for posting in Q&A. To deploy Windows Autopatch, we can review the deployment guide in the following link:

https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/overview/windows-autopatch-deployment-guide

Autopatch groups register devices with the Windows Autopatch service when you either create or edit an Autopatch group. You can create an Autopatch group for each of your business units or for the branch location. The depends on your requirement. You can refer to the Use case as an example for your reference:

https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview

When create Autopatch group, both the Test and Last deployment rings are default deployment rings that are automatically present in an Autopatch group. They only support one single Microsoft Entra group assignment at a time. We can also add other deployment rings.

For the Deployment ring distribution, it has Dynamic and Assigned. For Dynamic, you can use one or more device-based Microsoft Entra groups, either dynamic query-based or assigned to use in your deployment ring composition. For Assigned, you can use one single device-based Microsoft Entra group, either dynamic query-based, or assigned to use in your deployment ring composition.

One more link to let you better understand it:

https://mobile-jon.com/2024/04/16/deep-dive-into-windows-patching-with-microsoft-intune/

Note: Non-Microsoft link, just for the reference.

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

I'm still confused by the setup.

Can I use one group? The use of dynamic and assigned really messes up understanding what is wanted for setup.

In the "TEST" and "LAST" rings it says assigned. Does that mean I can't use a dynamic azure group? WHY?

Does this mean I then have to have two separate groups? One is dynamic and a query and one is not and static?

The document lacks basic clarity.

Answer 4

Also the talk of device registration is now missing... I've seen videos on the process and it's GONE from the site now. I don't know what is supposed to happen now.