{"id":10539,"date":"2019-10-09T15:42:52","date_gmt":"2019-10-09T22:42:52","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10539"},"modified":"2023-06-15T14:46:10","modified_gmt":"2023-06-15T21:46:10","slug":"deployment-rings-make-sequencing-windows-updates-fast-and-simple","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/deployment-rings-make-sequencing-windows-updates-fast-and-simple\/","title":{"rendered":"Deployment rings make sequencing Windows updates fast and simple"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Microsoft Digital shares its strategy for managing deployment rings inside the company.<\/p>\n
Like many businesses transitioning to the cloud, Microsoft\u2019s shift to Windows as a service meant that we had to rethink the way we deploy updates. This transition required us to make process changes, but it\u2019s also offered opportunities to fine-tune our approach to deployments overall. We\u2019ve utilized deployment rings, and as a result, it has never been easier for us to deploy Windows updates smoothly and invisibly.<\/p>\n
\u201cDeployment rings are making a magical difference for us,\u201d says Microsoft Program Manager Brent Barnett.<\/p>\n
While most enterprises understand that they need to break up large-scale deployments into more manageable rings, waves, or phases, determining how to delineate those waves is complicated. Here\u2019s a look into how we introduced deployment rings and even more specific waves to our process around Windows updates at Microsoft.<\/p>\n
Our original decision to break up deployments into multiple rings was informed by three main goals:<\/p>\n
First, a small team within Microsoft Digital is responsible for running Windows\u2019 daily engineering builds. This provides early insights into issues and helps us understand when a build is ready for deployment to larger groups. We then expand the deployment to a group of approximately 1,000 users who have volunteered to pilot prerelease builds. This group helps validate features, policies, and applications internally, guiding us into the broad deployment phase that will ultimately reach approximately 200,000 devices.<\/p>\n
When deployments need to reach broad communities of users across a huge number of devices, it\u2019s sometimes necessary to create additional sub-rings, called deployment waves, within a broad deployment ring. Within the broad deployment ring we create six smaller waves of 30,000 devices each. When delineating waves within the broad deployment ring, we took into consideration the need to comply with these business rules:<\/p>\n
We manage these business rules with a deployment solution built using SQL Server and a simple C# application. This solution provides the control we need to manage deployments in a way that minimizes the impact on users. The solution helps us identify and manage waves by:<\/p>\n
The solution first imports updated device and user data on a daily basis to ensure that we\u2019re making decisions based on the most recent data available. Every device in scope for the deployment is scored on applicable business rules through the associated points system, and is then assigned to a wave based on its points total. Devices with the most points are sorted into earlier waves, and devices with fewer points end up in later waves. We lock each wave when it\u2019s ready for a deployment, preventing its membership from changing further while those daily updates continue.<\/p>\n
Previously we deployed feature updates using System Center Configuration Manager Operating System Deployment (OSD). But with the 1809 Windows release, we moved to Windows Update for Business (WUfB). In both cases we use security groups for each wave, converting those groups to collections if we\u2019re using OSD, or applying deferral policies to them if using WUfB.<\/p>\n
Finally, the solution generates a list of devices in the wave with associated users. This allows us to send users information about the update in direct email communications, detailing when the update will occur and how to defer the update if there is a valid business reason to do so. As the deployment progresses through its broader rings, the ability to add or remove business rules, exclusion groups, and specific waves allows us to respond to issues faster. That minimizes the impact on productivity.<\/p>\n
There are multiple options for deploying Windows updates. This allows enterprises to base decisions on their risk tolerance and on the builds that are available to them. The\u00a0Windows Insider Program<\/a>\u00a0helps enterprise customers at the proof-of-concept stage. Once feature updates are publicly released, enterprises can expand to larger pilot groups within their organizations to start validating applications and hardware. Once the deployment is issue-free, or once they have identified and understood all potential issues, enterprises can expand to broad deployment.<\/p>\n