Windows Update Management: Rings, Autopatch & Delivery Optimization

An update ring is a policy that controls when and how a group of devices receives Windows feature and quality updates — deferral periods (delay updates by N days after release, giving you time to catch problems before your fleet hits them), deadlines (how long a user can postpone before the update installs automatically), active hours (the window in which updates won't force a restart), and whether users can pause updates temporarily. The standard pattern for a fleet of any size: multiple rings with staggered deferrals — a small "pilot" ring gets updates first with a short deferral, a broad "production" ring gets a longer deferral so any problem the pilot ring surfaces gets caught before the whole fleet is exposed to it. In Intune: Devices > By platform > Windows > Manage updates > Windows updates, on the Update rings tab.

Windows 10 is out of support. It reached end of support on October 14, 2025: Windows 10 devices now get security updates only through paid Extended Security Updates, and there are no new Windows 10 feature updates. Intune still labels the platform "Windows 10 and later", but in a mixed fleet the job is to move devices to Windows 11 with a feature update policy, and to track Extended Security Updates enrollment for any device that can't move yet.

Autopatch is Microsoft's service for teams that don't have the headcount to run a ring strategy by hand. You create an Autopatch group; Autopatch splits its devices into deployment rings, either by your direct assignment or by dynamic distribution, and paces releases through them — Windows quality and feature updates, Microsoft 365 Apps, Edge and drivers, under one service. You can pause or resume a release. Rolling back is narrower than most people assume: Autopatch doesn't roll back Windows feature updates or Microsoft 365 Apps updates, pausing a quality update doesn't roll back devices that already installed it, and rolling back a quality update is an admin action through update rings. The value for an MSP managing several small clients is consistent release pacing without building and maintaining a ring strategy per client.

Hotpatch is deployed for Windows 11 through a hotpatch-enabled Windows quality update policy in Intune, part of Autopatch. On an eligible device, monthly security updates install without a restart. Eligible means all of these: a qualifying license (for example Windows 11 Enterprise E3 or E5, or Microsoft 365 Business Premium); Windows 11 version 24H2 or later; virtualization-based security turned on; the device on the current quarterly baseline; and x64 hardware, or Arm64 with CHPE turned off. The baseline months (January, April, July and October) still need a restart, so Hotpatch cuts restart-required security updates to four months a year rather than removing them. It covers monthly security updates, not feature updates.

Rings and Autopatch control when a device updates; Delivery Optimization controls how the bytes get there efficiently. Instead of every device on a network independently downloading the same multi-gigabyte update from Microsoft's servers, Delivery Optimization lets devices share already-downloaded update content with each other over the local network (or even across the internet in some modes) — meaningfully reducing bandwidth consumption on a site with more than a handful of devices. Configure it in Intune at Devices > Manage devices > Configuration > Create > New Policy > Windows 10 and later > Templates > Delivery Optimization (the template uses the Settings Catalog format): download mode (LAN-only peer sharing is the safe default for most SMB environments), bandwidth limits, and cache size. This is a small, easy-to-overlook setting that has a real, measurable impact on a client's internet connection during a major feature update rollout.

Deploying rings and creating Autopatch groups doesn't guarantee every device actually updates on schedule — a device that's off the network, a driver conflict, or a policy that never applied can all leave a device silently behind. Windows updates reporting in Intune (Reports > Windows updates) breaks down compliance by ring, showing exactly which devices are on the latest quality update and which are lagging. Autopatch has its own reports: a summary dashboard, Quality update status and Feature update status, and trending reports, with device readiness shown inside them. Known issues affecting specific builds are published on the Windows release health page in the Microsoft 365 admin center — worth checking before a release reaches your production ring, rather than discovering a bad update the same way your users do.

A 40-device office: 4 IT staff and power users, 30 office staff on laptops, and 6 shared front-desk PCs that must never restart between 8:00 and 18:00. Write a one-page plan:

1. The rings. Who goes in each, the quality and feature update deferrals, the deadline and grace period, and active hours for each ring.
2. The gate between rings. What you'll watch in the pilot ring before the next ring receives an update, and what makes you pause.
3. Delivery Optimization. The download mode you'd choose for this office, and why 40 devices downloading the same feature update separately is a real bandwidth problem.
4. Hotpatch. Whether it could apply to the front-desk PCs, and what you'd check first.

Optional, if you already have an Intune tenant: build your pilot ring at Devices > By platform > Windows > Manage updates > Windows updates > Update rings, and compare the settings Intune offers with your plan.