Prerequisites

Microsoft Entra ID must either be the source of authority for all user accounts, or user accounts must be synchronized from on-premises Active Directory using the latest supported version of Microsoft Entra Connect to enable Microsoft Entra hybrid join.

• For more information, see Microsoft Entra Connect and Microsoft Entra hybrid join
• For more information on supported Microsoft Entra Connect versions, see Microsoft Entra Connect:Version release history.

At a minimum, the Windows Update, Device configuration, and Office Click-to-Run apps workloads must be set to Pilot Intune or Intune. You must also ensure that the devices you intend on bringing to Windows Autopatch are in the targeted device collection. For more information, see co-management requirements for Windows Autopatch.

Other device management prerequisites include:

• Devices must be corporate-owned. Windows bring-your-own-devices (BYOD) are blocked during device registration prerequisite checks.
• Devices must be managed by either Intune or Configuration Manager co-management. Devices only managed by Configuration Manager aren't supported.
• Devices must be in communication with Microsoft Intune in the last 28 days. Otherwise, the devices aren't registered with Autopatch.
• Devices must be connected to the internet.

See Register your devices for more details on device prerequisites and on how the device registration process works with Windows Autopatch.

For more information on co-management, see co-management for Windows devices.

When you use Windows Update for Business reports with the deployment service, using diagnostic data at the following levels allows device names to appear in reporting:

• Optional level (previously Full) for Windows 11 devices
• Enhanced level for Windows 10 devices

For more information on Windows Autopatch privacy practices, see Windows Autopatch Privacy.

• Windows Update policies workload
• Device configuration workload
• Office Click-to-Run apps workload

If you’re using Pilot Intune, in the Staging tab, the device must be in the collections that correspond to the three workloads that Windows Autopatch requires.

• If you selected Intune for one workload and Pilot Intune for the other two workloads, your devices only need to be in the two Pilot Intune collections.
• If you have different collection names for each workload, your devices must be in CoMgmtPilot.

You or your Configuration Manager administrator are responsible for adding your Autopatch devices to these collections. Windows Autopatch doesn’t change or add to these collections.

For more information, see paths to co-management.

1. Under Disable Software Updates > Device Settings > Enable software updates on clients, select No.
2. Under CoMgmtSettingsProd Properties > Staging tab > Office Click-to-Run apps, set to Co-Management – O365 Workload.
3. Under CoMgmtSettingsProd Properties > Staging tab > Windows Update policies, set to Co-Management – WUfB Workload.
4. Ensure the Disable Software Updates setting has a lower priority than your default client settings and target your co-management collection.
   1. If the co-management workload is set to Intune, deploy the Client Setting to a collection that includes all co-management devices, for example, Co-management Eligible Devices.
5. Configuration Manager disables the Software Updates agent in the next policy cycle. However, because the Software Updates Scan Cycle is removed, Configuration Manager might not remove the Windows Server Update Service (WSUS) registry keys.
1. Remove the registry values under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate because Windows Update for Business (WUfB) policies control the process.