Device registration overview
Important
The information in this article or section only applies if you have Windows Enterprise E3+ or F3 licenses (included in Microsoft 365 F3, E3, or E5) licenses and have activated Windows Autopatch features.
Feature activation is optional and at no additional cost to you if you have Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5) licenses.
For more information, see Licenses and entitlements. If you choose not to go through feature activation, you can still use the Windows Autopatch service for the features included in Business premium and A3+ licenses.
Windows Autopatch must register your existing devices into its service to manage update deployments on your behalf.
Prerequisites for device registration
Built-in roles required for device registration
A role defines the set of permissions granted to users assigned to that role. You can use the Intune Service Administrator role to register devices. For more information, see Required Intune permissions.
Software prerequisites
To be eligible for Windows Autopatch management, devices must meet a minimum set of required software-based prerequisites. For more information, see Windows Autopatch prerequisites.
Important
Windows Autopatch supports registering Windows 10 Long-Term Servicing Channel (LTSC) devices that are being currently serviced by the Windows LTSC. The service only supports managing the Windows quality updates workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use LTSC media or the Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade for Windows devices that are part of the LTSC.
The Windows Autopatch device registration process is transparent for end-users because it doesn't require devices to be reset.
The overall device registration process is as follows:
- IT admin reviews Windows Autopatch device registration prerequisites before registering devices with Windows Autopatch.
- IT admin identifies and adds devices or nests other Microsoft Entra device groups into any Microsoft Entra group used with an Autopatch group, imported (WUfB) policies, or direct membership to the Modern Workplace Devices-Windows-Autopatch-X-groups.
- Windows Autopatch then:
- Performs device readiness prior registration (prerequisite checks).
- Calculates the deployment ring distribution.
- Assigns devices to one of the deployment rings based on the previous calculation.
- Assigns devices to other Microsoft Entra groups required for management.
- Marks devices as active for management so it can apply its update deployment policies.
- IT admin then monitors the device registration trends and the update deployment reports.
For more information about the device registration workflow, see the Detailed device registration workflow diagram section for more technical details behind the Windows Autopatch device registration process.
Windows Autopatch deployment rings
Caution
Don't modify the Microsoft Entra group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly.
Additionally, it's not supported to have Configuration Manager collections directly synced to any Microsoft Entra group created by Autopatch groups.
When you start using Autopatch, Windows Autopatch creates the following deployment ring set to organize devices.
| Deployment ring | Description |
|---|---|
| Modern Workplace Devices-Windows Autopatch-Test | Deployment ring for testing service-based configuration, app deployments prior production rollout |
| Modern Workplace Devices-Windows Autopatch-First | First production deployment ring for early adopters. |
| Modern Workplace Devices-Windows Autopatch-Fast | Fast deployment ring for quick rollout and adoption |
| Modern Workplace Devices-Windows Autopatch-Broad | Final deployment ring for broad rollout into the organization |
Caution
Adding or importing devices directly into any of these groups isn't supported. Doing so might affect the Windows Autopatch service. To move devices between these groups, see Move devices in between deployment rings.
Important
Windows Autopatch device registration doesn't assign devices to the Test deployment rings of either the service-based (Modern Workplace Devices-Windows Autopatch-Test), or your Autopatch groups. This is intended to prevent devices that are essential to a business from being affected or devices that are used by executives from receiving early software update deployments.
During the device registration process, Windows Autopatch assigns each device to a deployment ring so that the service has the proper representation of device diversity across your organization. The deployment ring distribution is designed to release software update deployments to as few devices as possible to get the signals needed to make a quality evaluation of a given update deployment.
Device record and deployment ring assignment
Registering your devices with Windows Autopatch does the following:
- Makes a record of devices in the service.
- Assign devices to the deployment ring set and other groups required for software update management.
Default deployment ring calculation logic
The Windows Autopatch deployment ring calculation occurs during the device registration process:
- If the Windows Autopatch tenant's existing managed device size is ≤ 200, the deployment ring assignment is First (5%), Fast (15%), remaining devices go to the Broad ring (80%).
- If the Windows Autopatch tenant's existing managed device size is >200, the deployment ring assignment is First (1%), Fast (9%), remaining devices go to the Broad ring (90%).
Note
You can customize the deployment ring calculation logic by editing an Autopatch group.
| Deployment ring | Default device balancing percentage | Description |
|---|---|---|
| Test | zero | Windows Autopatch doesn't automatically add devices to this deployment ring. You must manually add devices to the Test ring following the required procedure. For more information on these procedures, see Moving devices in between deployment rings. The recommended number of devices in this ring, based upon your environment size, is as follows:
|
| First | 1% | The First ring is the first group of production users to receive a change. This group is the first set of devices to send data to Windows Autopatch and are used to generate a health signal across all end-users. For example, Windows Autopatch can generate a statistically significant signal saying that critical errors are trending up in a specific release for all end-users, but can't be confident that it's doing so in your organization. Since Windows Autopatch doesn't yet have sufficient data to inform a release decision, devices in this deployment ring might experience outages if there are scenarios that weren't covered during early testing in the Test ring. |
| Fast | 9% | The Fast ring is the second group of production users to receive changes. The signals from the First ring are considered as a part of the release process to the Broad ring. The goal with this deployment ring is to cross the 500-device threshold needed to generate statistically significant analysis at the tenant level. These extra devices allow Windows Autopatch to consider the effect of a release on the rest of your devices and evaluate if a targeted action for your tenant is needed. |
| Broad | Either 80% or 90% | The Broad ring is the last group of users to receive software update deployments. Since it contains most of the devices registered with Windows Autopatch, it favors stability over speed in a software update deployment. |
| N/A | zero | The Last ring is intended to be used for either specialized devices or devices that belong to VIP/executives in an organization. Windows Autopatch doesn't automatically add devices to this deployment ring. |
Automated deployment ring remediation functions
Windows Autopatch monitors device membership in its deployment rings, except for the Modern Workplace Devices-Windows Autopatch-Test, Windows Autopatch - Test and Windows Autopatch - Last rings, to provide automated deployment ring remediation functions to mitigate the risk of not having its managed devices being part of one of its deployment rings. These automated functions help mitigate risk of potentially having devices in a vulnerable state, and exposed to security threats in case they're not receiving update deployments due to either:
- Changes performed by the IT admin on objects created by the Windows Autopatch tenant enrollment process, or
- An issue occurred which prevented devices from getting a deployment ring assigned during the device registration process.
There are two automated deployment ring remediation functions:
| Function | Description |
|---|---|
| Check device deployment ring membership | Every hour, Windows Autopatch checks to see if any of its managed devices aren't part of one of the deployment rings. If a device isn't part of a deployment ring, Windows Autopatch randomly assigns the device to one of its deployment rings (except for the Modern Workplace Devices-Windows Autopatch-Test, Windows Autopatch - Test and Windows Autopatch - Last rings). |
| Multi-deployment ring device remediator | Every hour, Windows Autopatch checks to see if any of its managed devices are part of multiple deployment rings (except for the Modern Workplace Devices-Windows Autopatch-Test, Windows Autopatch - Test and Windows Autopatch - Last rings). If a device is part of multiple deployment rings, Windows Autopatch randomly removes the device until the device is only part of one deployment ring. |
Important
Windows Autopatch automated deployment ring functions don't assign or remove devices to or from the following deployment rings: