AzureFeeds

For the devices that you manage where you can afford to tighten deployment timelines, we’ll explain updated recommendations and show you how to speed up patching. 

It starts with assessing your risk exposure for unpatched devices using the new Autopatch report in Microsoft Intune, then tightening deferral policies on the devices where it makes sense, using Hotpatch to activate protection on install — without requiring reboots. Windows Autopatch automates your update deployments using rings to progressively apply updates to the device groups that you help define, including updates for Windows, Microsoft 365 Apps and the Edge browser. And to keep internal resources protected, you can enforce access controls using Conditional Access to block non-compliant devices. 

Jeremy Chapman, Microsoft 365 Director, shares what’s changed along with the approaches you can take to help counter the growing number of AI-discovered vulnerabilities and stay protected.

Move AI vulnerabilities from discovery to exploit in hours. 

For Windows devices in your estate where you can tighten deployment timelines, Microsoft’s updated patching recommendations show exactly where to set the bar. See how it works.

Fewer reboots. Immediate protection. 

Hotpatch in Microsoft Intune applies security fixes the moment they install, no restart required. Check it out.

Configure once.

Ring-based Windows Autopatch policies paired with Microsoft 365 Apps on Monthly Enterprise Channel automate your full patching pipeline. See it here.

QUICK LINKS: 

00:00 — AI and Windows patch management 

01:13 — Updated patching deferral thresholds 

01:46 — Hotpatch on by default 

02:05 — Windows Autopatch report 

02:30 — Ring-based deployment + M365 Apps servicing profile 

02:50 — Conditional Access for non-compliant devices 

03:16 — Wrap up

Link References 

For what you can do beyond patching, go to https://aka.ms/securenow

Unfamiliar with Microsoft Mechanics? 

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. 

• Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries


• Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog


• Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social: 

• Follow us on Twitter: https://twitter.com/MSFTMechanics


• Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/


• Enjoy us on Instagram: https://www.instagram.com/msftmechanics/


• Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Intentionally delaying security patches might be a common practice, but it shouldn’t be, especially now. There’s been a significant increase in security updates across the industry. For Microsoft specifically, total addressed vulnerabilities have been on the rise since April this year with 206 in June, and this is only set to increase. The risk is real. 

-Ahead of May’s Patch Tuesday, Microsoft’s own MDASH multi-model agentic scanning harness, for example, found 16 new vulnerabilities across the Windows networking authentication stack, including four critical remote execution code flaws. 

-And this is on par with the rest of the industry with AI speeding up how quickly software vulnerabilities are found and exploited, often from weeks to hours, including zero days. And if you’re in IT, this means rethinking your organization’s risk, security posture and response, and ultimately getting your devices patched with the latest security updates as soon as possible. 

-If you’re not delivering critical quality updates with security fixes until a couple of weeks after they’ve been issued, that’s ample time for attackers using AI to find and exploit known security gaps. To address this, we’ve updated our recommendations for deploying Windows updates to less than three days as the deferral period for quality updates, setting deadlines for those updates to zero or one day, and the update grace period to a maximum of two days. 

-So, if you’re delivering updates using policy controls, these are all configurable via Windows Autopatch and Microsoft Intune. And you can put equivalent time-bound policies in place with other Windows software update tooling options like Microsoft Configuration Manager and Windows Server Update Services. 

-And back in Intune, using Hotpatch updates, which are now on by default, once the update is installed, protection takes effect immediately without waiting for a reboot to reduce exposure and minimize disruption. 

-So, even though you’re pushing out updates faster, it still means fewer reboots. In fact, let’s walk through the process you’d take to limit the risks associated with your out-of-date Windows clients, your browsers, including Edge, and Microsoft 365 Apps. 

-First, it starts with asking the question, “How bad is our exposure?” Here, the Windows Autopatch report helps you assess where your Windows desktop infrastructure stands with a baseline of which devices are up to date and which are missing updates. 

-Next, how can you set and forget security update policies? That way, you’re automating current and future update deployment. To do that, you can configure Windows Autopatch within Microsoft Intune for ring-based deployment, as well as set Microsoft 365 Apps servicing profiles to use the Monthly Enterprise Channel. 

-Then, how do you make sure non-compliant or unsafe devices don’t have access? Using Conditional Access policies, you can block access from non-compliant devices to ensure only trusted devices can access internal resources. 

-And for what you can do beyond patching, go to aka.ms/securenow to see a full list of actions you can take to limit your exposure to AI-accelerated threats. Following these approaches will help reduce your risk and improve your security posture. Thanks for watching.