Windows Autopatch now gives you even more control over how quality updates reach your devices. In Microsoft Intune, a single quality update policy can now manage multiple update types. This includes Windows quality updates, supported .NET Framework updates, and quick machine recovery updates. For each type of update, you can choose automatic or manual approval and see device status in new Windows Autopatch reports.
Learn what's new, how it works with your current setup, and what to know before you start.
Why approvals matter
With multiple monthly updates that help keep your devices protected and productive, how can you keep up with approvals? Until recently, devices in your update ring policies would get security updates but not the preview or out-of-band updates. In many cases, you'd want to carefully choose a group of devices to get certain updates early or only when they need it.
Quality update policies now give you this control. You decide how to approve each type of update and for which devices.
Windows quality update policy in Windows Autopatch
If you already use Windows Autopatch, find the new quality update policy in the Microsoft Intune admin center. Navigate to Windows Updates > Devices > Manage updates > Windows updates > Quality updates.
Starting with a fresh quality update policy
Create a quality update policy to set an approval method for different update types. The top section applies to both Windows quality updates and Windows 11 .NET Framework updates. Set the approval method and offer available dates for these updates together. Then configure quick machine recovery updates right below them.
-
We recommend automatic approval for security updates. Use Make updates available after to defer 0–30 days.
-
Use manual approval for optional updates or strict change control. Devices get updates once approved with no deferral.
One policy can use both approval methods.
Already using update rings or Windows Autopatch Groups?
If you already have update ring policies, you don't have to start again. Quality update policies work together with your update rings. To plan your setup, understand what the quality update policy takes over, and what stays the same.
The quality update policy now determines when devices take each update based on the approval method you choose.
-
Automatic approval: Devices get the update after the policy's deferral. This replaces your update ring or Windows Autopatch Group deferrals rather than adding to them. For example, with a 5-day update ring deferral and a 2-day deferral in quality update policy, devices get the update 2 days after release, not 7.
-
Manual approval: No deferral. Devices get the update once you approve it.
Other settings in your update ring policy or Windows Autopatch Groups stay the same, such as deadlines and grace periods. Devices continue to follow them when updates become available.
You can also use update rings to gradually deploy quality updates and use approvals. To do this, create one quality update policy for each ring and assign it to the same groups as that ring. For example, if your rings use 0, 1, and 5 days of deferral, create three quality update policies with the same deferrals and assignments. You keep your current timing, and you get approvals for each update type.
Tip: Did you create a quality update policy for hotpatch updates before approvals were available in your tenant? Open the policy, review the approval settings, and save it. Updates that need manual approval appear under Needs review on Windows Update > Quality updates > Manage updates.
Manage different updates with one policy
Besides managing monthly Windows quality updates, use quality update policy in Windows Autopatch to also manage .NET Framework updates and quick machine recovery updates.
.NET Framework updates follow the same policy
While by default your approval settings apply to both Windows quality updates and .NET Framework updates, you can still control them separately if needed. Review, approve, and pause .NET Framework updates on their own in Windows Update > Quality updates > Manage updates. Pausing one type of update doesn't pause the other.
To learn more about these update controls on Windows Autopatch, visit Windows quality updates and .NET Framework updates.
Note: When you deploy .NET Framework updates in the same update cycle as Windows quality updates (the new default), users see fewer interruptions and restarts.
Quick machine recovery updates
Quick machine recovery helps Windows devices recover when a large-scale problem stops them from starting. If a device fails to start two times in a row, it goes into the Windows Recovery Environment (WinRE). If Microsoft has a fix for the problem, the device downloads and applies it to recover.
You can now manage these fixes in the same quality update policy. The default approval method is manual. If interested in an automatic approval, you can also configure an optional deferral. Approve, pause, and resume these fixes in Manage updates, like other quality updates. Follow detailed guidance in Quick machine recovery updates in Windows Autopatch.
Reporting: See where your devices stand
There are two Windows Autopatch quality update reports that show you the status of devices in the quality update policies. Their data refreshes every four hours.
To open the reports, go to Reports > Windows Autopatch > Windows quality updates, and select Reports.
In most cases, start with the Quality update status report to view the update status of each device. Two columns help most with the new controls.
-
Target release shows the latest approved quality update. For devices in update rings, this is the latest B week updates.
-
Target release available shows the date by which the device must install the update.
Note: For devices in both an update ring and a quality update policy, the Target release available date with automatic approval is the release date plus the quality update policy's deferral and deadline days. With manual approval, it's the approval date plus the deadline days.
The new Quick machine recovery updates report shows devices that had a boot failure. This report stays empty until a boot-critical issue occurs.
Check each device in this report for its recovery status:
-
In boot failure
-
In progress
-
Remediated
That's where you'll also find the fix version and the policy that deploys it.
Get started with new controls and reporting
Try these features in your Windows Autopatch tenant and tell us what you think in the comments below.
To learn more, see our documentation:
Continue the conversation. Find best practices. Join the Windows Tech Community.
For updates on new releases, tools, and resources, bookmark the Windows IT Pro Blog and follow @WindowsUpdate on X. For the latest on how Windows is evolving for organizations and the people who support them, follow Windows at Work on LinkedIn.
Microsoft