Over the past few months I've watched Windows Autopatch change the way a lot of organisations handle Windows updates. Some of these tenants used to patch inconsistently or relied on Intune update rings that nobody really looked after. Once Autopatch is in place, the attitude tends to change, because deployments become more predictable and need far less manual effort. Autopatch now sits entirely inside the Intune admin center (Tenant administration → Devices → Windows updates), and the old standalone Autopatch portal is gone. Having everything in one place makes things clearer. It also brings up some new questions, though. You need to decide how to keep Autopatch-managed devices apart from your own Intune update rings, and how to deal with group assignment and exceptions.
Autopatch groups split devices into four deployment rings
Everything in Windows Autopatch revolves around the Autopatch group. Each group is divided into four deployment rings: Test, First, Fast and Broad. People often mix these up with Intune update rings, but they are not the same thing. Autopatch rings are successive stages for pushing updates out within a defined set of devices, usually grouped by department or region. You now manage groups and exceptions entirely in the Intune admin center. Microsoft's documentation on Autopatch groups covers the details.
A typical quality update rollout with Autopatch runs in stages. A simple flowchart shows it best:
flowchart TD
Start["Autopatch Quality Update Release"] --> Test["Ring: Test (few devices)"]
Test --> First["Ring: First (pilot group)"]
First --> Fast["Ring: Fast (wider group)"]
Fast --> Broad["Ring: Broad (majority)"]
Broad --> Done["Update rollout completed"]
Figure: Staged rollout of a quality update using Autopatch groups and deployment rings.
Rolling out step by step means you see problems early and can pause or delay the update if something breaks. In quite a few projects, issues that showed up in the "Test" ring stopped a faulty update from reaching everyone. Without that stage, nobody would have noticed until it was too late.
Autopatch covers quality updates, expedited patches and feature releases
Quality updates are mostly automated with Autopatch. The Intune admin center gives you a clear status view, and if a critical vulnerability needs fast action you can push an urgent patch through with the "expedite" option under Windows updates → Expedite updates. Feature updates, such as the Windows 11 24H2 release, go through the same staged ring approach. If you have a big rollout ahead, my post on Windows 11 24H2: Controlled rollout with Intune and Autopatch covers the practical side and the pitfalls I ran into. Check application compatibility and hardware readiness before you go live.
Reporting is much better than it used to be. With the device and update reports in Intune, it's far easier to follow a deployment, find devices that are stuck and see which endpoints keep falling out of compliance. If you want more detail on quality update controls, read the official Microsoft overview.
Practical tip: Look at the update reports regularly and keep a close eye on group assignments, so you can react quickly when a ring runs into problems or delays. In larger environments especially, stray devices and special-purpose systems often end up in the wrong group.
Kiosks and specialist hardware need their own update handling
Anyone who has run Autopatch across a larger estate knows that some devices don't fit the standard lifecycle. Kiosks, specialist workstations and tightly controlled endpoints often need their own update cadence or manual patching. You can exclude these devices from Autopatch groups or put them into separate Intune update rings to control them individually. In several engagements I found it worked best to keep these machines out of Autopatch altogether and handle them with manual or group-based assignments. For Microsoft 365 Apps, you can run update channels alongside this. My post on choosing Microsoft 365 Apps update channels explains how.
Autopatch also manages drivers, firmware and Microsoft 365 Apps
One thing I really like about Windows Autopatch is that it also handles driver, firmware and Microsoft 365 Apps updates. For drivers and firmware, Autopatch relies on metadata from the OEMs and rolls out validated updates through the same rings as Windows updates. That saves manual work and makes things more consistent. If you run unusual hardware, though, keep a close watch on assignments and exceptions in the Intune admin center. Microsoft 365 Apps updates can be managed through Autopatch as well, including assigning a channel per group.
Licensing and prerequisites set the limits for Autopatch
Licensing for Windows Autopatch comes up for discussion a lot. Since 2024, the core features need Windows Enterprise E3 or E5, while Microsoft 365 Business Premium gives you some basic patching options. If your estate is mixed in particular, check the latest Microsoft Autopatch docs for the current details. For Autopatch to work, devices must be Azure AD-joined or Hybrid-joined and managed by Intune.
To get a quick view of which devices are eligible for Autopatch and which groups they belong to, go to the Intune admin center (Devices → Windows Autopatch). As of February 2025 there is no supported PowerShell automation for a full export. In my experience the export tools in the portal are usually enough.
Autopatch works well in practice if you manage it actively
Windows Autopatch can take a lot of work off IT teams, provided the basics are in place. Keep Autopatch and your own Intune update policies separate, and be careful with exceptions. The ring model won't solve everything, but it works surprisingly well when your groups are kept clean and you actually follow up on what the reports show. Autopatch is especially strong in environments with mixed hardware, specialised endpoints and different Microsoft 365 Apps requirements. Still, you can't just set it up and forget about it. If you plan properly and stay on top of it, updates will cost you much less worry. I'm looking forward to the next round of feature releases, this time without patching late into the night.
