How to Configure Progressive Patch Deployment

Overview:

Why a single deployment wave is a single point of failure

Pushing an application update to every endpoint at once is fast, and that speed is exactly the problem. If the update is defective, incompatible with a subset of hardware, or breaks a dependent workflow, the entire fleet finds out at the same time. There's no early warning, no small population absorbing the damage first, and rollback becomes an emergency response instead of a routine step.

Progressive deployment solves this by splitting a single rollout into ordered rings, each with its own success threshold, soak time, and promotion gate. A small validation population goes first. Only once it clears its bar does the rollout move to the next ring. A bad update is contained to a handful of machines instead of the whole estate, and the person running the rollout gets real signal from ring 1 before ring 2 is even in play. They have total four. (1.Validation ring, 2.Pilot ring, 3.Controlled ring and 4.Production ring.)

This guide walks the full workflow end to end: creating a progressive deployment, targeting it by category and severity, selecting the applications to deploy, scheduling the rollout, configuring a validation ring and a pilot ring with independent promotion rules, publishing the deployment, and monitoring it ring by ring through to completion.

• Contain failure: a defective update reaches a validation ring, not the estate, before it can do estate-wide damage.
• Promote on evidence: each ring only advances once its success rate clears the threshold you set, not on a fixed timer alone.
• Automate or hold deliberately: promotion mode can advance automatically when a ring meets its bar, or wait for manual sign-off.
• See real-time health: per-ring success rate, failure count, and soak countdown are visible while the rollout is in progress, not only after it finishes.
• Cover third-party and OS updates alike: the same ring model applies whether you're rolling out a browser update or a Windows patch.

Prerequisites

Confirm all four before creating a progressive deployment. A ring with no computer group assigned, or a threshold nobody agreed on, is the most common cause of a rollout stalling with no clear reason.

1. Administrator access: your account holds a role permitted to manage Progressive Patch Deployment. Read-only operators can view deployment status but cannot create or publish deployments.
2. Agent installed and reporting: the endpoint agent is installed, registered, and reporting healthy on every target device across every ring you plan to configure.
3. Application catalog populated: the applications you intend to deploy (browsers, utilities, or other third-party software) are available in the application catalog to select from.
4. Computer groups or endpoint scope defined: each ring needs its own target population, typically a small validation group, then a larger pilot group, then broader production. Decide this grouping before configuring rings, not while configuring them.

Architecture: how a deployment becomes a sequence of rings

A progressive deployment is one definition (what to deploy, to whom, and when) that fans out into an ordered list of rings, each with independent targeting and independent promotion rules. The platform evaluates each ring's health against its own threshold before advancing to the next.

Step 1: Open Progressive Patch Deployment

Get oriented before creating anything, so you know what's already been configured.

Instructions

1. From the main console, go to Endpoints → Progressive Patch Deployment.
2. Review the existing deployment list: each row shows Name, Platform, Enabled status, Rings count, Schedule, Severities, Category, and Created On.

Path: Console / Endpoints / Progressive Patch Deployment

Result: You have visibility into existing progressive deployments before creating a new one, including how many rings each already uses.

Step 2: Create a progressive deployment and set targeting

Define what this deployment is for and what category of update it covers.

Instructions

1. Select Create Progressive Deployment.
2. Enter a Name describing the rollout, e.g. Install VLC & Chrome, and toggle Enabled.
3. Optionally add a Description.
4. Under Targeting, set Category (e.g. Tools, Third Party) and Patch Severities (e.g. Unspecified, Critical, Moderate).
5. Set Expedite Severities if certain severities should skip standard soak time.
6. Set OS Platform to the target operating system.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment

Console: targeting fields

Result: The deployment has a name and a targeting scope, but no applications or rings yet.

Step 3: Select the applications to deploy

Choose the specific applications this deployment will install or update, rather than leaving it to the category filter alone.

Instructions

1. Under Applications, choose All Applications, Include Applications, or Exclude Applications depending on how precisely you want to scope this deployment.
2. Select Add Applications to open the application picker.
3. Search the catalog (hundreds of entries are typically available) and select the specific applications, e.g. Google Chrome and VLC Media Player.
4. Confirm the Selected Applications list shows exactly the applications intended, with no extras carried over from a broad search.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment / Applications / Add Applications

Console: selected applications

Result: The deployment now has a concrete application list, separate from the broader category/severity targeting set in Step 2.

Step 4: Configure the schedule

Decide when the rollout begins and whether it repeats.

Instructions

1. Under Schedule, set the Schedule type: Once, Daily, Interval, Weekly, or Monthly.
2. For a one-time rollout, select Once and set the Start At date and time using the calendar picker.
3. For a recurring rollout, select Monthly and set the Days of Month and start time instead.
4. Optionally set Notify to so a team is alerted as the deployment progresses.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment / Schedule

Result: The deployment has a defined start time. Rings, configured next, inherit this schedule as their starting point.

Step 5: Configure the first ring (Validation)

Define the smallest, earliest ring: its target population, promotion rule, and the thresholds that decide whether the rollout is allowed to continue.

Instructions

1. Under Deployment Rings, the first ring is created by default, e.g. Ring 1: Validation.
2. Set Promotion Mode to Auto (advances automatically once thresholds are met) or Manual Hold (waits for an admin to promote it).
3. Set Computer Groups to All Computers or Specific Groups, or set Scope Endpoints to Specific Endpoints and select the exact target device(s) for this ring.
4. Set Deployment Policy (e.g. OOB Instant deployment policy, type Instant) and Batch Size for how many endpoints install concurrently within the ring.
5. Set Min Success %, the minimum success rate required before promotion, Max Cancelled %, the cancellation threshold that halts the ring, and Soak (minutes), how long to wait and observe after installation before evaluating promotion.
6. Optionally add Pre Deployment Scripts and Post Deployment Scripts to run before or after installation on this ring.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment / Deployment Rings / Ring 1: Validation

Console: Ring 1 configuration

Result: Ring 1 is fully defined with its own target, its own promotion threshold, and its own soak window, independent of any ring that follows it.

Step 6: Add a second ring (Pilot)

Extend the rollout to a larger population once Ring 1 is defined, with its own independent thresholds.

Instructions

1. Select Add Ring to append a new ring, e.g. Ring 2: Pilot.
2. Configure it the same way as Ring 1: Promotion Mode, Computer Groups or Scope Endpoints, Deployment Policy, Batch Size, Min Success %, Max Cancelled %, Soak (minutes), and optional pre/post deployment scripts.
3. Set a tighter or looser threshold than Ring 1 deliberately. A pilot ring often carries a higher Min Success % (e.g. 95%) since it's a larger, more consequential population than validation.
4. Repeat Add Ring for as many stages as the rollout needs (validation, pilot, broad, critical infrastructure) before publishing.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment / Deployment Rings / Add Ring

Console: Ring 2 configuration

Result: A two-ring sequence exists, Validation then Pilot, each independently scoped and independently gated.

Step 7: Publish the deployment

Save and activate the progressive deployment so it begins on its scheduled start time.

Instructions

1. Review the full deployment: targeting, applications, schedule, and every ring's configuration.
2. Confirm the Enabled toggle is on.
3. Select Save (or the equivalent publish action) to activate the deployment.

Path: Console / Progressive Patch Deployment / Create Progressive Deployment / Save

Result: The deployment appears in the Progressive Patch Deployment list as Enabled, and will begin running at its scheduled start time.

Step 8: Monitor ring progress in real time

Track the rollout as it moves through each ring, watching success rate and soak status rather than waiting for a final report.

Instructions

1. Open the running deployment, e.g. Install VLC & Chrome, to see its live Run view.
2. Read the top summary: overall status (IN PROGRESS, COMPLETED), Current Ring (e.g. 1 of 2), Started Time, Duration, and Patches count.
3. Review Ring Progress: each ring shows its state (IN PROGRESS, PENDING, COMPLETED) and success percentage.
4. Select a ring under Ring Details to see its Deployment Health: Success Rate, Cancelled rate, and counts for Total, Success, Failed, Cancelled, and Pending endpoints.
5. Watch the Soak countdown (e.g. Soak 0 min: until 11:06 AM) alongside the configured Min Success % and Max Cancelled % thresholds for that ring.

Path: Console / Progressive Patch Deployment / <Deployment Name> / Run view

Console: ring progress (mid-rollout)

Result: A live, per-ring view of exactly where the rollout stands, with enough detail to decide whether to promote, hold, or intervene.

Step 9: Review per-endpoint ring deployment tasks

Drill into the actual install tasks behind a ring's success rate, endpoint by endpoint and application by application.

Instructions

1. From the ring's detail view, open Ring Deployment Tasks.
2. Review each row: Endpoint, Name (the specific application and version, e.g. Google Chrome(151.0.7922.72)), Status (SUCCESS, IN PROGRESS, FAILED), and Last Updated.
3. Use this view to confirm that a ring's aggregate success percentage is backed by real, individual task completions, not just a rollup number.

Path: Console / Progressive Patch Deployment / <Deployment Name> / Ring Details / Ring Deployment Tasks

Console: ring deployment tasks (example)

Result: Individual task-level evidence for every endpoint in the ring, the detail behind the ring's headline success rate.

Step 10: Confirm ring promotion and full completion

Follow the rollout from the first ring's soak completion through to every ring finishing, and confirm the deployment closes out cleanly.

Instructions

1. Once Ring 1 meets its Min Success % and completes its soak window, its state changes to COMPLETED (shown as Soak completed).
2. If Promotion Mode is Manual Hold, promote the next ring deliberately once you're satisfied with Ring 1's result; if Auto, confirm Ring 2 begins on its own.
3. Watch Ring 2 move from PENDING to IN PROGRESS, with its own success rate climbing as its endpoints complete.
4. Once every ring reports COMPLETED, the overall deployment status changes to COMPLETED, e.g. All rings deployed successfully, with a final Duration and Rollout Summary (Success / Failed / Cancelled / Pending counts) shown per ring.
5. Return to the Progressive Patch Deployment list to confirm the deployment's overall record reflects the completed run.

Path: Console / Progressive Patch Deployment / <Deployment Name> / Run view

Console: final state

Result: A fully promoted, fully completed rollout with a per-ring audit trail from validation through to the last ring, rather than a single all-at-once push with no staged evidence behind it.

Best practices for progressive patch deployment

Troubleshooting: common issues and resolutions

Frequently asked questions