In This Article
- What Windows Autopatch does
- Which licenses include Windows Autopatch
- Which devices Autopatch can manage
- Autopatch groups and deployment rings
- Automatic or manual approval for each update type
- Hotpatch: security updates without the restart
- Feature updates, drivers, and Microsoft 365 Apps
- How Autopatch maps to the FFIEC patch management process
- A five-step Autopatch rollout
- Licensing and the free Security Assessment through ABT
- Frequently Asked Questions
On the second Tuesday of each month, Microsoft releases its monthly security updates, and someone at your institution has to get them onto every teller workstation, loan officer laptop, and branch PC without interrupting a member at the counter or a borrower on a closing call. Windows Autopatch, Microsoft's cloud update service, takes on that planning and deployment. It releases each Windows update to a small test group first, then to the rest of your devices in rings. In the eight planned hotpatch months of each year, eligible Windows 11 devices install the security update without a restart.
Many institutions already own it. In April 2025, Microsoft removed the feature activation step and made Windows Autopatch features available to Business Premium and A3+ licenses. Today Microsoft lists Autopatch for Microsoft 365 Business Premium, Windows Enterprise E3 and E5 (included in Microsoft 365 F3, E3, and E5), and Windows Education A3 and A5.
ABT, a Tier-1 Microsoft Cloud Solution Provider serving 750+ financial institutions, wrote this guide for IT teams at community banks, credit unions, and mortgage companies. The goal is monthly patching that keeps staff working, gets Microsoft's security fixes onto every eligible device on a schedule you set, and leaves a record an examiner can read.
What Windows Autopatch does
Windows Autopatch is a cloud service that automates updates for four products: Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams. In Microsoft's words, it "helps you minimize the involvement of your scarce IT resources in the planning and deployment of updates." For a two- or three-person IT team at a community institution, that's the whole point: the monthly patch cycle runs from the Microsoft Intune admin center on the schedule you configure.
Autopatch releases updates in sequential deployment rings and responds to reliability and compatibility signals as each ring installs, so your test devices see each release before the branch does. It covers:
- Windows quality updates, the monthly security and non-security releases, including .NET Framework updates.
- Windows feature updates, the annual Windows version, with version targeting and phased releases.
- Driver and firmware updates, applied automatically or held for approval.
- Microsoft 365 Apps, Microsoft Edge, and Microsoft Teams, with Edge on progressive rollouts of the Stable channel and Teams on the standard automatic update channel.
Microsoft publishes two service level objectives for the service. For Windows quality updates, Autopatch aims to keep at least 95% of Up to Date devices on the latest quality update. For Microsoft 365 Apps, it aims to keep at least 90% of eligible devices on a supported version of the Monthly Enterprise Channel. Both are Microsoft's targets for the service.
Autopatch works alongside the Windows settings your team already knows. Windows Update client policies, formerly known as Windows Update for Business, still set what happens on each device: restart settings, deadlines, notifications, and grace periods. Autopatch adds the cloud orchestration on top, deciding which update goes to which ring and when.
Which licenses include Windows Autopatch
Microsoft's prerequisites page lists the licenses below. Autopatch also requires Microsoft Entra ID P1 or P2 and Microsoft Intune, and Business Premium includes both, with Entra ID P1 and Intune Plan 1.
| License | Where it usually comes from | Autopatch features | Hotpatch on eligible devices |
|---|---|---|---|
| Microsoft 365 Business Premium | The Business Premium plan, up to 300 users | Yes | Yes |
| Windows Enterprise E3 or E5 | Microsoft 365 E3, E5, or F3 | Yes | Yes |
| Windows Education A3 or A5 | Microsoft 365 A3 or A5 | Yes | Yes |
Windows Enterprise E3 or E5 Virtual Desktop Access (VDA) subscriptions also carry Autopatch. One distinction matters for Business Premium. Submitting support requests to the Windows Autopatch Service Engineering Team is listed for E3+ and F3 licenses only, so a Business Premium institution gets the Autopatch features without that support request option.
For a side-by-side of the three plans most institutions weigh, see our Microsoft 365 E3 vs E5 vs Business Premium comparison for financial institutions. Whichever plan fits, ABT sells it at Microsoft's price, quoted on its own line, and M365 Guardian Foundation is included at no additional charge when your licensing runs through ABT.
Which devices Autopatch can manage
Licensing makes a device eligible. These prerequisites decide whether Autopatch can register it.
Windows bring-your-own devices are blocked during registration, so personal laptops stay outside Autopatch.
Co-managed devices need at least the Windows Update and Device configuration workloads set to Pilot Intune or Intune.
Autopatch supports both join types. Devices joined only to an on-premises domain need to be Entra joined or hybrid joined first.
Devices out of contact for longer aren't registered with Autopatch until they check in.
Windows 10 or 11 Pro, Enterprise, Education, Pro Education, or Pro for Workstations, plus Windows 10 or 11 IoT Enterprise.
Each device needs internet access to the Intune, Windows Update, and Autopatch endpoints Microsoft lists.
At a community institution, check two of these first: older branch PCs still joined only to the on-premises domain, and laptops that sat in a drawer past the 28-day window. Our guide to Windows Autopilot covers getting new laptops enrolled in Intune from day one.
Check your devices before you roll out Autopatch
The free Microsoft 365 Security Assessment connects read-only and covers, in a written report:
- Intune enrollment status across managed and unmanaged devices
- OS patch levels and compliance policies
- Encryption settings
- A comparison to ABT's benchmark of 750+ financial institutions
Autopatch groups and deployment rings
An Autopatch group is a container that pairs Microsoft Entra device groups with the update policies that govern them: update rings, feature updates, driver updates, Microsoft 365 Apps, and Microsoft Edge. Every Autopatch group starts with two deployment rings, Test and Last. You can add your own rings between them, for up to 15 deployment rings per group, and a tenant can hold up to 300 groups.
Once a group is set up, each Windows quality or feature update release moves through its rings in order. Microsoft's own example is a branch office: an Autopatch group for a Chicago branch, with its rings broken down by department. A community bank, credit union, or mortgage company can follow the same pattern:
- Test ring: IT staff devices, a few volunteers who will report a problem the same day, and a workstation from one representative branch.
- Middle rings: back-office departments first, such as accounting and operations, then lending and member or customer service.
- Last ring: the remaining branch workstations and any device you want updated after the rest of the institution has run the release.
Build rings from device-based Microsoft Entra groups, create them before you set up the Autopatch group, and keep their memberships from overlapping so each device lands in one ring.
Automatic or manual approval for each update type
Autopatch sets an approval method for each quality update type: monthly security updates, non-security preview updates, and out-of-band security and non-security releases. The setting applies to both the Windows cumulative update and the matching .NET Framework update. When you create a policy, monthly security updates default to automatic approval and the other types default to manual. Microsoft recommends automatic approval for security updates and manual approval for optional updates, and describes manual approval as "ideal for environments needing strict change management."
Automatic approval
- The default for monthly security updates
- Each ring waits 0 to 30 days after release, set with "Make updates available after"
- Compliance date: release date plus the ring's deferral plus the device deadline
- Best for the security fixes you want everywhere, quickly
Manual approval
- The default for non-security and out-of-band updates
- An update deploys once an administrator approves it
- Compliance date: approval date plus the device deadline
- Best for optional updates and strict change control
When an approved update causes trouble, you can pause it. Autopatch revokes the approval, and no new devices receive it. Devices that already installed it keep it, since a pause stops the rollout going forward.
Devices can take up to eight hours to pick up the pause, because they check in with Intune on a regular cycle. Re-approve the update and Autopatch offers it again to the devices that still need it.
Each of those decisions, the deferral per ring, a manual approval, a pause, is a change-control event. Record them in your change management log with who decided and why, and the monthly patch cycle produces its own audit trail.
Hotpatch: security updates without the restart
Restarts are where patching collides with the workday. Hotpatch updates are monthly security updates that install and take effect without restarting the device, so the teller in the middle of a transaction and the processor in the middle of a file keep working.
Hotpatch runs on a quarterly calendar. The first month of each quarter is a baseline month that installs the full cumulative update and requires a restart; the next two months are hotpatch months.
One planned restart in January.
One planned restart in April.
One planned restart in July.
One planned restart in October.
Microsoft notes that, occasionally and for security reasons, a hotpatch month can become an extra baseline that requires a restart. Plan the four quarterly restarts into your maintenance calendar and treat an unplanned one as an exception.
To receive hotpatch, a device needs Windows 11 version 24H2 or later, the current baseline installed, and virtualization-based security (VBS) turned on. In the Intune quality update policy, set "When available, apply without restarting the device ("Hotpatch")" to Allow. Devices that fall short of those requirements receive the standard update and restart as usual, so one policy covers the whole fleet.
Hotpatch licensing includes Microsoft 365 Business Premium, Windows 11 Enterprise E3 and E5, Microsoft 365 F3, Windows 11 Education A3 and A5, and Windows 365 Enterprise. Users and IT can still restart a hotpatched PC anytime.
Feature updates, drivers, and Microsoft 365 Apps
Monthly security updates are the headline, and Autopatch also handles the rest of the Windows servicing calendar.
- Feature updates. Autopatch provides a controlled rollout of annual Windows feature updates, with version targeting, phased releases, and options for moving Windows 10 devices to Windows 11. Our guide to Microsoft end of support for Windows 10 and Office explains why that move matters.
- Drivers and firmware. Each ring or group runs in Automatic or Manual mode. Pick the mode deliberately: switching later generates new policies that replace the old ones, and the approvals, paused drivers, and declined drivers already set for those rings are lost.
- Microsoft 365 Apps, Edge, and Teams. Autopatch aims to keep Microsoft 365 Apps on a supported Monthly Enterprise Channel version, Edge on progressive Stable channel rollouts, and Teams on its standard automatic update channel.
- Alerts. A tenant-level alert report shows conditions that can keep devices from staying up to date or compliant. Find it in the Intune admin center under Devices, Windows updates, Feature or quality updates, then Alerts and remediations.
Autopatch's scope is your Windows client devices and those Microsoft apps. Servers, routers, switches, firewalls, and phones stay in your existing patch process, and hotpatching for Windows Server 2025 runs through Azure Update Manager. For a worked example of prioritizing one month's releases, see our October 2026 Patch Tuesday guide for banks, credit unions, and lenders.
How Autopatch maps to the FFIEC patch management process
Bank and credit union examiners work from the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook, and its Information Security booklet gives patch management its own section.
Management should implement automated patch management systems and software to ensure all network components (virtual machines, routers, switches, mobile devices, firewalls, etc.) are appropriately updated.
The same section lists the process elements an institution's patch management should include. The four below map most directly to Autopatch. Autopatch supplies the automation and much of the evidence for Windows devices; your institution supplies the policy, the judgment, and coverage for everything else.
| FFIEC process element (II.C.10(d)) | Where Autopatch helps | What your institution keeps |
|---|---|---|
| "A monitoring process that identifies the availability of software patches." | Each Microsoft release appears in the quality update workflow; alerts flag devices that fall behind | Monitoring for non-Microsoft software, servers, and network gear |
| "A prioritization process to determine which patches to apply across classes of computers and applications." | Approval method per update type and a deferral per ring | The risk ranking that decides which ring each class of device sits in |
| "An exception process, with appropriate documentation, for patches that management decides to delay or not apply." | Manual approval and pause stop a release from reaching more devices | The written exception: what was delayed, why, who approved, and when it was reviewed |
| "A documentation process to ensure the institution's information assets and technology inventory and disaster recovery plans are updated as appropriate when patches are applied." | A compliance date for every device and reports on update status | Updates to the asset inventory and the disaster recovery plan |
The section leaves patch timeframes to the institution. You set them in policy, and Autopatch's deferrals, device deadlines, and compliance dates apply them to every device Autopatch manages. For why speed matters, see what six zero-days in one month meant for financial institutions.
A five-step Autopatch rollout
Windows Autopatch Rollout for Banks, Credit Unions, and Mortgage Companies
Check that your plan includes Autopatch and that each device is corporate-owned, managed in Intune or co-managed, Entra joined or hybrid joined, on a supported edition, and checked in within 28 days.
List your current update ring policies, Group Policy update settings, and any other patch tool, so that one system owns Windows updates on each device once Autopatch takes over.
Start with the Test ring for IT devices and one representative branch workstation, add middle rings by department or branch, and keep the remaining branch workstations in the Last ring.
Approve monthly security updates automatically with short deferrals in early rings and longer ones in later rings, keep optional updates on manual approval, and allow hotpatch for eligible Windows 11 devices.
Check the alert report after each release, pause an update when a ring reports trouble, and file every approval, pause, and exception in your change log for the next exam.
Most of the work sits in steps 1 and 2. Once rings and approvals are set, each month's cycle is a review of the reports and a few decisions. Autopatch pairs well with two other device controls you manage from Intune: Intune Endpoint Privilege Management to retire standing local admin rights, and App Control for Business to keep unapproved software from running.
Licensing and the free Security Assessment through ABT
If your institution holds Microsoft 365 Business Premium, E3, E5, or F3, the licensing piece of Autopatch is already in place. Run that licensing through ABT, a Tier-1 Microsoft Cloud Solution Provider, and Guardian Foundation, the hardened tenant baseline, is included at no additional charge. M365 Guardian configures the device controls that sit beside Autopatch: Microsoft Intune compliance policies, BitLocker encryption, OS security baseline settings, and Microsoft Entra ID Conditional Access gates. It monitors your tenant for configuration drift, and Autopatch, Microsoft's service, keeps delivering the updates.
Autopatch reaches the devices that meet its prerequisites, so the first question is which of yours do. ABT's free Security Assessment helps answer it with a read-only review of Intune enrollment status, compliance policies, OS patch levels, and encryption settings across managed and unmanaged devices. You receive a written report and a review call, and most assessments complete within two weeks.
Put the Windows Autopatch you already license to work
ABT licenses Microsoft 365 at Microsoft's price, quoted on its own line, with Guardian Foundation included. The free Security Assessment shows which devices are enrolled, compliant, and current, so you know where Autopatch can start.
Frequently Asked Questions
Windows Autopatch is Microsoft's cloud service for automating updates to Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams. You manage it in the Microsoft Intune admin center. It releases each Windows update through deployment rings, starting with a test group, so problems surface on a few devices before they reach the rest.
Yes. In April 2025, Microsoft made Windows Autopatch features available to Business Premium and A3+ licenses with no separate activation. Windows Enterprise E3 and E5, included in Microsoft 365 E3, E5, and F3, also carry it. Support requests to Microsoft's Autopatch Service Engineering Team are listed for E3+ and F3 licenses only.
Windows Update for Business is now called Windows Update client policies. Those policies still control restarts, deadlines, notifications, and grace periods on each device. Autopatch groups bundle them with feature, driver, and app update policies and orchestrate the rollout from the cloud, deciding which update reaches which ring and when.
Not every month. Hotpatch removes the restart for the monthly security update in the eight planned hotpatch months each year. January, April, July, and October are baseline months that install the full update and restart, and Microsoft occasionally adds an unplanned baseline for security reasons. Devices need Windows 11 version 24H2 or later and virtualization-based security turned on.
Yes. In Windows Autopatch, pausing an approved quality update revokes its approval, so no new devices receive it, while devices that already installed it keep it. Devices can take up to eight hours to apply the pause. Re-approve the update to resume. Microsoft also supports rolling back quality and feature updates through update rings.
Windows Autopatch supports several process elements in section II.C.10(d) of the FFIEC Information Security booklet for Windows devices: automated deployment, prioritization through approvals and rings, and exception handling through manual approval and pause. The booklet expects patching across all network components, so servers, network gear, and phones need their own process, plus your written exceptions and inventory updates.