Autopatch group policies

The following Windows Autopatch group policies are only created when you create a Windows Autopatch group.

Update rings policy for Windows 10 and later

Windows Autopatch groups create one Windows Update Ring policy for each deployment ring you specify. These rings configure important update settings like automatic update behavior, deferrals, deadlines, and grace periods. See the following recommended policy values for an update rollout that limits device’s exposure to security vulnerabilities. This configuration balances a quick rollout speed, with the need to validate update success and manage user experience.

Policy name	Quality updates deferral in days	Feature updates deferral in days	Feature updates uninstall window in days	Deadline for quality updates in days	Deadline for feature updates in days	Grace period	Auto restart before deadline
Test	0	0	30	0	5	0	Yes
Ring 1	1	0	30	0	5	1	Yes
Last	2	0	30	1	5	2	Yes

Feature update policy for Windows 10 and later

If feature updates are selected as a content type for a Windows Autopatch group, a feature update policy is created with the Microsoft Entra groups for each update ring assigned to it. This policy does the following:

• Helps ensure that existing devices on the target version don’t update beyond that version.
• If you add new devices to the Windows Autopatch group, which are below your target version, the devices are updated to the target version.

To achieve this outcome, the feature update policy is configured for immediate start as required.

Important

To safely deploy a new feature update, Windows Autopatch recommends using a custom Windows feature update release. The custom release allows you to choose how and when different deployment rings receive the update. Windows Autopatch doesn't recommend updating the minimum version within a Windows Autopatch group until your rollout is complete. Doing so starts a rollout immediately for all members of that group.

Once you create a custom Windows feature update release, the Windows Autopatch group's deployment rings are unassigned from that group’s feature update policy.