Microsoft has announced that Windows Autopatch has become generally available for all enterprise customers.
Companies holding Windows Enterprise E3 and E5 licenses can now benefit from the feature that was first announced in April before going into public preview in June.
Windows Autopatch aims to automate the updating of Windows 10 and Windows 11, Microsoft Edge, and Microsoft 365 software while continuing to release its monthly updates on the second Tuesday of every month, known commonly as ‘Patch Tuesday’.
Autopatch configures the Windows Update for Business client on behalf of the customer, including all policies and the deployment service, and Microsoft claimed that it can help protect businesses from threats before they reach their IT environments.
If businesses choose to make use of Autopatch, they can expect to access features like report generation, access to the service health dashboard, file support requests, and fine-tune ring membership through Microsoft Endpoint Manager, in addition to the automatic installation of updates.
To enrol a device into Autopatch, holders of enterprise licenses E3 and above can follow these steps:
- Find the Windows Autopatch entry in the Tenant Administration blade of the Microsoft Endpoint Manager admin centre
- Select Tenant enrolment
- Select the check box to agree to the terms and conditions and select Agree
- Select Enrol
Admins remain sceptical
Microsoft understands that IT admins may have some reservations about enrolling in the programme considering the erroneous security updates that have attracted headlines in recent months.
“The idea of delegating this kind of responsibility may give some IT administrators pause,” said Lior Bela, senior product marketing manager at Microsoft. “Changing systems in any way can cause hesitation, but unpatched software can leave gaps in protection, and by keeping Windows and Microsoft 365 apps updated you get all the value of new features designed to enhance creativity and collaboration.”
Microsoft has been criticised recently for pushing ‘broken’ Patch Tuesday updates to customers that leave other components in their IT estate malfunctioning or otherwise broken.
At the start of the year, Windows Server admins congregated on social media, agreeing to forgo January’s round of patches due to the disruption caused by an emergency out-of-band update to fix issues in the then-current Windows Server patch list.
Admins faced the difficult decision to leave their IT environments unprotected from the latest security threats due to the update itself causing more harm than a potential security breach, the community suggested at the time.
In May, more Windows Server admins said the then-latest updates broke authentication policies leading many to roll them back entirely - again, leaving their estates unprotected.
To combat this, Microsoft said Autopatch could detect potential issues “among an incredibly diverse array of hardware and software configurations” and can pause or roll back updates before disruption is ever caused.
Many IT admins are likely to approach Autopatch with scepticism given the recent operational disruption caused by updates and may wait to see how the service affects others before enrolling.
Microsoft is also aware of the confusion among some members of the admin community over the difference between Autopatch and deployment rings in Microsoft Intune.
“In some organisations, where update deployment rings are already in place, and the update process is robust, the appetite for this kind of automation may not be as strong,” said Bela, before adding that the company will take user feedback to evolve the product over time.
Microsoft is due to release July’s round of Patch Tuesday security updates later today.
