What Is Windows Autopatch?

Microsoft's Windows Autopatch is a managed patching service that automates Windows 10 and Windows 11 updates using ring deployment. The feature is available to customers with Windows Enterprise E3 and above licenses.

Quick answer: Windows Autopatch is a cloud-based, managed service from Microsoft that automates patch deployment for Windows 10 and 11 devices using deployment rings. It requires Microsoft Intune and Microsoft Entra ID (formerly Azure AD), and only manages Windows workstations. It does not support Windows Server, macOS, Linux, or third-party applications. For organizations with hybrid environments, additional patching tools are still required.

Many organizations regularly test patches in their environments to ensure updates are functional across their devices and installed software before implementation. Depending on exactly how those patches get tested, there can be a troubling lag time between when patch updates are released and when they are actually deployed across the organization. Windows Autopatch aims to eliminate the delay.

Windows Autopatch is a managed service included with Windows Enterprise E3 and above that automates ring deployment-style patch management for Windows 10 and 11. It also requires Microsoft Intune and Microsoft Entra ID Premium for co-management.

Since its launch in 2022, Autopatch has matured into a stable service that many enterprises use to reduce manual patching overhead. Microsoft continues to expand its capabilities while maintaining its core focus on Windows workstation management.

Intune only:

• Microsoft Entra ID (formerly Azure Active Directory)

• Microsoft Intune

• Windows 10/11 supported versions

Co-management:

• Hybrid Microsoft Entra ID-Joined or Microsoft Entra ID-joined only

• Microsoft Intune

• Configuration Manager, version 2010 or later

• Switch workloads for device configuration, Windows Update, and Microsoft 365 Apps from Configuration Manager to Intune (min Pilot Intune)

• Co-management workloads

• Windows 10/11 Enterprise E3 and up

• Microsoft Entra ID Premium (for co-management)

• Microsoft Intune (includes Configuration Manager, version 2010 or greater via co-management)

To learn more about Autopatch requirements, you can access Microsoft's Windows Autopatch FAQ.

What does Autopatch update?

Autopatch updates the following:

• Windows 10 and Windows 11 quality updates

• Windows 10 and 11 feature updates

• Windows 10 and 11 drivers

• Windows 10 and 11 firmware

• Microsoft 365 apps for enterprise updates

Windows Autopatch specifically patches drivers and firmware that are only published to Windows Update as automatic.

Autopatch utilizes four deployment rings to gradually roll out updates across your organization:

• Test ring - Contains a small number of your organization's devices for initial validation

• First ring - Contains 1% of all devices

• Fast ring - Contains 9% of devices

• Broad ring - Contains 90% of all your enterprise's devices

The listed ratios are managed automatically. Your devices can also be moved manually if you choose.

For a deeper comparison of these tools, see the guides on What is WSUS, What is Intune, and What is SCCM.

Windows Autopatch offers several benefits for organizations managing Windows workstations:

• Ring deployment manages your Windows environment with gradual rollouts

• As a managed service, Microsoft handles orchestration for patch deployment to devices

• Reduced administrative overhead compared to manual patching

• Built-in rollback capabilities if updates cause issues

• Integration with existing Microsoft 365 and Intune infrastructure

Autopatch has notable limitations that organizations should consider:

• The feature is only useful for Windows 10 and 11 device management

• Autopatch support for Windows Server is not on the roadmap

• You must use the feature in conjunction with Microsoft Entra ID and Intune

• Windows Autopatch is of no use to organizations with Mac or Linux endpoints

• Administrators cannot control patch deployment dates or times

• No third-party application support

If your organization requires third-party application support, Windows Server management, or other operating systems like macOS or Linux, you will not get it with Windows Autopatch.

Organizations using Autopatch still follow the same monthly update cycle. Many customers will still use tools like WSUS, Intune, or SCCM to control patching, and they can expect few deviations from the norms of Patch Tuesday.

For organizations that need more control over timing or want to automate Windows patching across mixed environments, third-party solutions provide greater flexibility.

Windows Update for Business (WUfB) is an existing cloud-based tool from Microsoft that enables control over the approval and scheduling of updates for Windows 10 and 11. Both Windows Autopatch and Intune use WUfB as the underlying mechanism to manage updates.

For a full breakdown of how Windows updates work, see OS Patching Essentials: Everything You Ever Wanted to Know About Microsoft Windows Updates.

Intune deployment rings use Windows Update for Business (WUfB) to allow administrators to control patch deployment, scheduling, and approval at a granular level from the cloud. Autopatch uses WUfB as well but removes scheduling and approval from admins.

That means that with Autopatch, administrators can assign devices to one of the groups (First, Fast, Broad), but do not have control over when updates are pushed to devices, or when they move from one ring to another. Administrators cannot control the dates or times of patch deployments either.

Windows Autopatch has proven itself as a stable, hands-off patching option for Windows 10 and 11 workstations. For organizations heavily invested in the Microsoft ecosystem with E3 or higher licensing, it reduces the administrative burden of Windows patching.

Windows Server is not managed by Autopatch. Servers often run business-critical applications or are exposed to the internet, so a comprehensive patching and configuration product and process are essential to reducing your attack surface.

Linux, macOS, and third-party applications still require additional products and processes. Even though this feature helps manage Windows 10 and 11 updates, organizations cannot forget they will still need to patch everything else outside of the Microsoft workstation ecosystem.

Organizations using both WSUS and cloud-native tools can refer to WSUS + Automox FAQ: How to Implement Together for guidance on hybrid implementations.