Windows Autopatch for Business Premium: Scope, Setup and First Month

Windows Autopatch sits inside Intune. You enroll the tenant once, put devices into Autopatch groups, and the service creates and maintains the Windows Update for Business policies for each deployment ring: which devices get a quality update on which day, how long a feature update is deferred, and when a device is forced to restart. The administrator reads reports and approves exceptions; the service does the scheduling.

What it manages on a Business Premium tenant, per Microsoft's prerequisites page:

• Windows quality updates, the monthly cumulative updates, rolled out ring by ring with deferrals and deadlines.
• Windows feature updates, the version moves such as Windows 11 24H2 to 25H2, with a schedule per ring and a minimum version you choose.
• Driver and firmware updates from the Windows Update driver catalog, with automatic or manual approval per ring.
• Autopatch groups and update rings, the structure that maps Entra ID device groups to rings and carries the cadence.

Beyond Windows, Autopatch keeps eligible devices on a supported version of the Monthly Enterprise Channel for Microsoft 365 Apps, moves Microsoft Edge to the Stable channel's progressive rollout, and keeps Teams on its automatic update channel. Enterprise E3 and E5 tenants go through a feature activation step that unlocks the full set; without it, Microsoft's overview says, a tenant still gets the features included with Business Premium and A3 and up.

Microsoft lists the licenses that make a tenant eligible on the Windows Autopatch prerequisites page, and separately the two services that have to be present. Prices are per user per month on an annual commitment, Microsoft list price, October 2026 price list.

Two conditions apply to every row. First, Microsoft Intune and Microsoft Entra ID P1 or P2 must be on the tenant, and the Autopilot licensing page adds that the Intune license has to be assigned to the users whose devices are managed, even when it arrives inside a Microsoft 365 bundle. Second, if a required license lapses, Autopatch marks the tenant inactive until it is restored, a renewal-date item for the license cleanup checklist.

The feature table on the same page marks Autopatch groups, update rings, quality updates, feature updates and driver and firmware updates for all four tiers (Business Premium, A3 and up, E3 and up, F3). Support requests to the Windows Autopatch service team are marked only for the A3 and E3 tiers. A Business Premium tenant gets the engine and not the Microsoft support desk behind it; the Intune licensing article explains why Plan 1 is enough for all of this.

An Autopatch group is a set of Entra ID device groups mapped to deployment rings, with a cadence per ring. Microsoft creates a Default Autopatch group at enrollment with five rings: Test, Ring1, Ring2, Ring3 and Last. The default Windows feature update policy is assigned to Test, Ring1, Ring2 and Ring3 and not to Last, so the last ring is where you hold devices that must stay on a version. A custom Autopatch group starts with only Test and Last, which Microsoft calls the recommended minimum, and can hold up to 15 rings. Test and Last only accept assigned device groups; the rings between them can take dynamic distribution, where the service spreads devices across rings by share.

The cadence lives under Windows Update settings, Manage deployment cadence, per ring: a deferral (days after release before the ring sees the update), a deadline (days after that before the device is forced) and a grace period for restarts. A pattern we set for a 100-device firm: Test on release day with two IT devices, the first production ring within the week, the bulk of the fleet the following week, and the executives' and finance team's devices in Last with the longest deadline. The day counts are yours; what Autopatch adds is that the policies are built and kept consistent, and a release can be paused for a ring from the same page.

• WSUS. Microsoft announced the deprecation of Windows Server Update Services in September 2024; it still works but gets no new features. For client devices Autopatch is the replacement; for servers the path is Azure Update Manager, which the WSUS replacement service covers.
• Group Policy update settings. Windows Update for Business settings in Group Policy conflict with Intune rings and must be removed from devices that enroll; the Group Policy to Intune migration article lists which settings translate.
• Manual Intune update rings. Autopatch replaces the single All devices ring with a seven-day deferral that many tenants built in 2022. Keep a manual ring only for a device group that stays outside Autopatch, and never assign both to one device.
• Third-party patching tools. Autopatch does not patch Adobe Reader, Chrome or other third-party applications. Keep that tool for applications and let Autopatch own Windows, Microsoft 365 Apps, Edge and Teams.

1. Licenses assigned. Business Premium (or an eligible Enterprise or Education license) on the users; Intune Plan 1 and Entra ID P1 are inside Business Premium, so this is one assignment.
2. Devices joined to Entra ID. Microsoft Entra joined or Microsoft Entra hybrid joined; registered-only devices (personal devices with Workplace Join) are not eligible.
3. Devices managed by Intune. Enrolled, with a working MDM sync. Co-managed devices with Configuration Manager need the Windows Update policies, device configuration and Microsoft 365 Apps workloads switched to Intune.
4. Supported Windows. Windows 10 or 11 Pro, Enterprise or Education on a version still in support; Windows 10 reached end of support on 14 October 2025, so a device still on it needs the Windows 11 migration or Extended Security Updates first.
5. Network. Devices must reach the Windows Update, Intune and Autopatch endpoints; TLS-inspecting proxies need the Microsoft endpoint list allowed.
6. An account to enroll. Global Administrator or Intune Administrator; enrollment also creates first-party app registrations, Entra ID groups and policies that security reviewers should expect.

1. Sign in to the Intune admin center, open Tenant administration, then Windows Autopatch, then Tenant enrollment.
2. Run the readiness assessment. It checks the license, the Intune and Entra ID settings it depends on, and conflicting policies, and reports each as ready, advisory or not ready. Fix the not-ready items.
3. Choose Enroll. Enrollment takes a few minutes and creates the Default Autopatch group, its rings and the update policies.
4. On an Enterprise E3 or E5 tenant, complete feature activation when prompted; Business Premium tenants skip this and keep the Business Premium feature set.
5. Open Devices, Windows Autopatch, Autopatch groups. Edit the Default group or create one per site: assign an Entra ID device group to Test, decide whether the middle rings are assigned or dynamic, and put the hold-back devices in Last.
6. Open Manage deployment cadence for the group and set deferral, deadline and grace period per ring.
7. Add devices by putting them in the assigned Entra ID groups. Registration into the service runs on a schedule, and a device shows as registered in the Autopatch device list within a day.
8. Remove conflicting Intune update rings and Group Policy settings from the enrolled devices.

The next three Patch Tuesdays are 13 October 2026, 10 November 2026 and 8 December 2026. Counting from an enrollment completed before 13 October 2026:

• Week 1. Devices register. Expect a short list that fail readiness, usually hybrid-joined machines with a stale Intune sync or an unsupported build; fix those by hand.
• Patch Tuesday, 13 October 2026. The Test ring installs the cumulative update on the day; Ring1 follows after its deferral, the others on their schedule. Watch the quality update status report daily for the first ring.
• Weeks 2 to 3. The bulk of the fleet updates. Users see restart deadline notifications; tell them in advance, because the forced restart is the part that generates tickets.
• Week 4. The feature update policy moves devices below your minimum version, such as Windows 11 23H2, to the target version on the ring's schedule.
• 10 November 2026. The second cycle runs with no manual work. That is the measure of success.

Devices still on an old build after two cycles are almost always offline, out of disk space or blocked by a driver; the readiness and update status reports list them with the reason.

Autopatch reports live under Reports, Windows Autopatch in the Intune admin center: the Windows quality update status report (per device and ring, with the update state and any alert), the feature update status report and the driver and firmware update report. Each exports to CSV, which is what a cyber insurer or a SOC 2 auditor asks for as proof that patches land within 30 days.

There is no Autopatch line on the Microsoft price list; it comes with the eligible license. The costs are the licenses you already have and the setup work:

A 60-device Business Premium tenant with Intune in place spends nothing more on licenses and one fixed project; a tenant with devices still on a domain and Group Policy does the Intune setup first and Autopatch inside it.

Is Windows Autopatch included in Microsoft 365 Business Premium?

Yes. Microsoft's prerequisites page lists Microsoft 365 Business Premium among the eligible licenses, and the service became available to Business Premium and Education A3/A5 tenants in April 2025. There is no separate Autopatch charge; the tenant needs Intune and Entra ID P1, which Business Premium includes.

What does Windows Autopatch cost?

Nothing beyond the eligible license. Business Premium is $22.00 per user per month on an annual commitment, Microsoft 365 E3 is $39.00 and E5 is $60.00 (Microsoft list price, October 2026 price list). Setup is a fixed-price project; ours is $1,950.00 when Intune is already in place.

Does Windows Autopatch require Intune?

Yes. Devices must be enrolled in Intune and joined to Entra ID (joined or hybrid joined), and the tenant must have Microsoft Intune and Microsoft Entra ID P1 or P2. The Intune license has to be assigned to the users whose devices are managed, even when it comes inside Business Premium.

Does Windows Autopatch replace WSUS?

For Windows client devices, yes; Microsoft announced WSUS deprecation in September 2024 and Autopatch is the Intune-based replacement. For servers, Autopatch does not apply, and Azure Update Manager is the path.

What does Windows Autopatch update?

Windows quality updates, feature updates, and driver and firmware updates through deployment rings, and on eligible devices Microsoft 365 Apps on the Monthly Enterprise Channel, Microsoft Edge on the Stable channel and Microsoft Teams. It does not patch third-party applications.

Can I use Windows Autopatch with Microsoft 365 Business Standard?

No. Business Standard is not on the eligible list, and adding Intune Plan 1 by itself does not make it eligible. The step up to Business Premium is $8.00 per user per month on the October 2026 price list ($22.00 against $14.00) and brings Defender for Business, Intune and Entra ID P1 with it.

How long does Autopatch enrollment take?

The readiness assessment and enrollment take under an hour in a tenant that passes the checks. Device registration completes within a day, and the first full update cycle lands on the next Patch Tuesday, 13 October 2026 for an enrollment completed before that date.

• Commercial price list, October 2026: Microsoft 365 Business Premium, Business Standard, Business Basic, E3, E5 and F3, Microsoft Intune Plan 1, Microsoft Entra ID P1
• Windows Autopatch prerequisites — Microsoft Learn, checked 2026-10-11 (eligible licenses, Intune and Entra ID P1 requirement, features by license, support requests)
• Windows Autopatch FAQ — Microsoft Learn, checked 2026-10-11
• Windows Autopatch groups overview — Microsoft Learn, checked 2026-10-11 (Test and Last rings, 15-ring limit, feature update policy assignment)
• Maintain the Windows Autopatch environment — Microsoft Learn, checked 2026-10-11 (tenant marked inactive when licenses lapse)
• Windows Autopilot licensing requirements — Microsoft Learn, checked 2026-10-11 (Intune licenses must be assigned to users)
• Microsoft Windows Autopatch: New Eligible Licenses — Schneider, checked 2026-10-11 (the April 2025 extension to Business Premium and A3/A5)
• Windows Autopatch step-by-step guide — LazyAdmin, checked 2026-10-11 (support requests not included with Business Premium)