Patch Management

Progressive Patch Deployment

Learn how to split a rollout into ordered rings, a small validation group and a larger pilot, each with its own promotion threshold and soak time, so a defective update is caught early instead of reaching the whole fleet at once.

1 min
June 27, 2026

What You'll Learn

How to target a progressive deployment by category, severity, and OS platform
Select the specific applications a deployment installs or updates
Configure a validation ring and a pilot ring with independent promotion rules
Schedule a rollout as a one-time or recurring deployment
Monitor ring progress, soak time, and per-endpoint task status in real time
Confirm a ring's promotion and read a completed rollout's per-ring summary

Frequently Asked Questions

What's the difference between Promotion Mode Auto and Manual Hold?

Auto advances the deployment to the next ring automatically once the current ring meets its Min Success % and completes its soak window. Manual Hold pauses at that point until an admin explicitly promotes the ring, giving a human the final say before a larger population is affected. See [how to configure progressive patch deployment](/learn/patch-management/how-to-configure-progressive-patch-deployment) for how each ring's thresholds are set.

Can I deploy Windows updates and third-party applications with the same progressive deployment?

The category and severity targeting is flexible, but it's clearer to keep OS patching and third-party application rollouts in separate deployments, since their risk profiles, thresholds, and rollback paths are usually different.

What happens if a ring's failure rate exceeds Max Cancelled %?

The ring halts rather than promoting, since it has exceeded the tolerance configured for it. Review the ring's Deployment Health and Ring Deployment Tasks to understand the failures before deciding whether to retry, adjust, or cancel the rollout.

How many rings should a progressive deployment use?

Two rings, a small validation population and a larger pilot, covers most application rollouts. Larger or higher-risk changes benefit from adding a broad production ring and a critical infrastructure ring after those, the same staged logic used in ring-based patch deployment for OS updates.

Does soak time delay the whole deployment even if installs succeed instantly?

Yes, intentionally. Soak time exists to catch problems that don't appear immediately at install, such as a service failing to restart cleanly. A soak time of 0 minutes skips that observation window entirely.

Can I add pre- and post-deployment scripts to only some rings?

Yes. Pre Deployment Scripts and Post Deployment Scripts are configured per ring, so an early validation ring can carry extra diagnostic scripts that later, larger rings don't need to run.