Protect devices · Topic 5 of 6
Autopatch, Hotpatch and Delivery Optimization
MD-102 managed updates: Windows Autopatch groups and rings, Hotpatch requirements and policy, and Delivery Optimization download modes and Connected Cache.
- 5 min
- Autopatch uses groups with deployment rings and needs Intune, Entra ID P1 or P2 and an Autopatch eligible Windows license.
- Hotpatch needs Windows 11 24H2 or later, VBS running, the latest baseline and an Autopatch quality update policy with hotpatch on. Quarterly baselines still restart.
- Delivery Optimization modes are HTTP only, LAN, Group, Internet and Simple. Group ID is only used with Group mode.
What it is
Windows Autopatch is a managed service that automates Windows, Microsoft 365 Apps, Edge and Teams updates with built in rings. Hotpatch installs some monthly security updates without a restart. Delivery Optimization reduces bandwidth by letting devices share update content with each other and with cache servers. These features let you keep devices current with less manual effort.
How it works
Windows Autopatch
Autopatch builds Windows Update rings and feature update policies for you and monitors the result.
| Fact | Detail |
|---|---|
| Licenses | Windows Enterprise E3 or E5 (or an equivalent that includes Autopatch), plus Microsoft Intune and Microsoft Entra ID P1 or P2 |
| Devices | Entra joined or hybrid joined, Intune managed and in contact with Intune within the last 28 days |
| Autopatch groups | A group defines deployment rings (the default is Test, then rings of increasing size, and a Last ring). Each ring becomes a Windows Update ring policy with its own deferral, deadline and grace period |
| Distribution | The Test and Last rings use assigned group membership. Other rings can use dynamic distribution |
| Release management | Autopatch monitors the rollout and can pause a ring if a problem is detected |
| Registration | Register devices into an Autopatch group by adding them to the device registration group |
Autopatch groups cannot be assigned to All devices. That matters for the ESP setting that installs quality updates during OOBE, which needs update rings assigned to All devices or groups of Autopilot registered devices.
Hotpatch
Hotpatch applies certain monthly security updates (the B release) without requiring a restart. Baseline releases each quarter are still standard cumulative updates that do need a restart.
| Requirement | Detail |
|---|---|
| OS | Windows 11 24H2 or later, Enterprise |
| License | Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Education A3 or A5, Business Premium or Windows 365 Enterprise |
| Management | Windows Autopatch quality update policy with the hotpatch setting turned on |
| Virtualization based security (VBS) | Must be running on the device |
| Baseline | The device must be on the latest baseline release, or it is offered the normal update until it catches up |
| Arm64 | Needs CHPE (compiled hybrid PE) disabled |
You turn it on in a Windows quality update policy with Hotpatch enabled and assign it to groups, and a device uses the hotpatch setting of the policy it is in. Autopatch alerts, such as "Hotpatch: VBS not running", tell you why a device is not eligible. Devices that are not eligible get the normal restart update.
Delivery Optimization
Delivery Optimization (DO) downloads update and app content from other devices, not only from Microsoft. Configure it with a settings catalog policy (the older template was retired in April 2025).
| Download mode | Meaning |
|---|---|
| HTTP only (0) | No peering |
| LAN (1) | Peers behind the same NAT |
| Group (2) | Peers in a private group, using a Group ID |
| Internet (3) | Peers across the internet too |
| Simple (99) | HTTP only, with no DO cloud service |
| Bypass (100) | Deprecated in Windows 11, uses BITS |
- Group ID applies only with mode Group. Without one, the default groups by AD site, domain SID or tenant ID. A custom group ID (a GUID) lets branches on different domains or networks share.
- Microsoft Connected Cache is a cache server inside your network that stores content. Devices find it with the Cache server host name (DOCacheHost) setting in the settings catalog. You can run it on a Windows server or through Configuration Manager. Peer settings are not required for Connected Cache.
- Devices fall back to HTTP if the cache and peers have no content. A well performing cache node should have an efficiency above 90 percent.
- Check on a client with
Get-DeliveryOptimizationStatus, and look at the bytes from the cache server. - Delivery Optimization data appears in Windows Update for Business reports (the Delivery Optimization section of the workbook).
Choosing the approach
| Need | Choice |
|---|---|
| Managed, automatic rings for Windows and Microsoft apps | Autopatch |
| Fewer restarts for monthly security updates | Hotpatch |
| Branch office with slow WAN | Delivery Optimization with Group mode or Connected Cache |
| Full control over each ring and timing | Update rings (previous page) |
A worked scenario
A retailer with 300 stores uses Autopatch with a Test ring of IT devices, and larger rings after it. Servers at head office need no restarts for most months, so the company enables Hotpatch for Windows 11 Enterprise devices that have VBS turned on. Each store has a Microsoft Connected Cache node, and a DO policy with Group mode and a store specific Group ID so tills download from the cache and from each other, not over the slow link.
What to remember for the exam
- Autopatch uses groups with deployment rings and needs Intune, Entra ID P1 or P2 and an Autopatch eligible Windows license.
- Hotpatch needs Windows 11 24H2 or later, VBS running, the latest baseline and an Autopatch quality update policy with hotpatch on. Quarterly baselines still restart.
- Delivery Optimization modes are HTTP only, LAN, Group, Internet and Simple. Group ID is only used with Group mode.
- Microsoft Connected Cache is configured on clients with the cache server host name.
- DO is configured with the settings catalog, because the old template is retired.
If Hotpatch is not applied, check VBS and whether the device is on the latest baseline.
How the exam asks about this
- "Reduce restarts for monthly security updates." Hotpatch.
- "Branch offices should share updates locally." Delivery Optimization with Group or LAN mode.
- "Branch needs a local cache server for update content." Microsoft Connected Cache.
- "Automate staged update rollout with minimum admin work." Windows Autopatch groups.
Common mistakes
Expecting Hotpatch every month. Baseline months restart.
Skipping VBS. The device is not offered hotpatch updates.
Setting a Group ID without Group mode. It is ignored.
Using the retired DO template. Use the settings catalog.
Check yourself
Which setting must be running for Hotpatch?
Virtualization based security (VBS).
Which DO mode uses a Group ID?
Group (mode 2).
What do Autopatch rings become in Intune?
Windows Update ring policies, one per ring.
Topic 5 of 6 in Protect devices
Test yourself on Protect devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.