MicrosoftAndre, thank you for looking into this and for your explanations. However, I am still unclear on the 'Windows Autopatch Device Registration' security group. My understanding is that to register devices with Microsoft Autopatch they need to be added to this group. However. When added here they are automatically assigned to one of the deployment groups (aka rings). Refer https://docs.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices#details-about-the-device-registration-process for supporting document.
Device automatically assigned by 'Auto'.
The following article also supports what happened to my tenant. https://docs.microsoft.com/en-us/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management#update-rings I found 90% of my devices in Broad, 9% in Fast, and 1% in First. Is does go to say that you can move devices between rings but must be done so through Microsoft Autopatch and not directly between the security groups that were automatically created. Ideally there should be a holding group of some sort where devices are registered but no deployment is applied, thus allowing IT to decide which device goes into which ring.
Also, Microsoft Managed Desktop seems to be a better place to go to manage Microsoft Autopatch because it shows far more useful information, such as the assigned user. This is useful because I can assign devices to the appropriate rings based on the user's role in the company (e.g. Tier 2, Dev).
