1 Deployment rings SCCM
The classic set-up: a few collections that split all devices into rings, used for every application.
- Create device collections for the rings, for example Ring 1 – IT (20 devices), Ring 2 – Early adopters (200) and Ring 3 – Everyone (the rest). Query-based collections keep themselves up to date.
- In Create Phased Deployment, add one phase per ring. Give the small ring a success criteria of a number of devices (for example 15) and the large rings a percentage (for example 90 %).
- Save it as a template, for example Three rings (SCCM), with your team’s mail address in the notifications.
- For each new application: Create Phased Deployment › Template Three rings (SCCM) › choose the software › Deploy.
Because a phase reads its collection when it starts, new devices that join a ring are included in every rollout that has not reached that ring yet.
2 A hand-picked pilot SCCM
When the first phase should be a few named devices, not a collection.
For phase 1 click Select Devices and pick, for example, the devices of the application owner and two key users. Give it the criteria Number of devices successfully deployed = the number you picked, and tick Approval required on phase 2, so the application owner confirms it works before anyone else gets it. Phases 2 and 3 use collections as usual. A fixed list is saved in a template too, so it is useful for an application owner who tests every version.
3 Approval gates and change windows
Combine the phase options to fit your change process.
| You need… | Use |
|---|---|
| A change board to sign off production | Approval required on the first production phase. Its people get a mail with a link; give them only the permission to approve. |
| Production installs out of office hours | Deployment Time 20:00 on the production phases, or a weekday such as Saturday. |
| Time to collect feedback from the pilot | Wait at least 48 hours after the previous phase is completed on phase 2, so users have two days to report problems even when every pilot device installed it in an hour. |
| Everyone to have it by a fixed date | A Deadline. Until then the phases follow their criteria; at the deadline all remaining phases are started. |
| A rollout that never waits for results | The installation-wide setting Always Continue (it applies to all phased deployments): phases follow each other on their schedule, whatever the install results. |
4 Intune rings for every rollout size Intune
One template of ring groups, and Limit to for the audience of each application — so you never create groups per rollout.
- Create Entra ID groups for the rings once, for example Ring Pilot, Ring Early and Ring Broad, that together hold all users (or all devices).
- Make an Intune template with one phase per ring group, the success criteria, and Assign as Required or Available.
- Application for everyone (2,000 users): use the template as it is.
- Application for a few (50 users of a department): use the same template and set Limit to to the department’s group. Each ring then only reaches the department’s users in that ring. Tick When a phase is empty › Skip the phase, so a ring without anyone from the department is passed instead of waiting.
The users and devices are added to the application’s own install group; the ring groups and the department group are only read, never changed. Use user groups throughout, or device groups throughout: Limit to compares members, so a user group cannot limit a device group.
5 Automatic updates with Robopack
A Robopack Patch Flow imports every new version of an application and rolls it out with a phased deployment template — no one has to touch it.
- Make the phased deployment template first: a small pilot phase, then the larger rings. Put a mailbox someone reads in the notifications.
- In the download and import wizard, choose it in step 3 (SCCM Phased Deployment) and/or step 5 (Intune Phased Deployment), and create the Patch Flow.
- Every new version then gets its own phased deployment, named <application> - Robopack, which starts straight away. Follow it on the Phased Deployments page or next to the version in Application Manager, where you can also pause it.
Useful options in the wizard for this:
| Wizard option | Why |
|---|---|
| Remove the devices from the previous versions install collection. / Remove the endpoints from the previous versions install group. | As each phase reaches a device, the device leaves the old version’s install collection or group, so it does not keep both. |
| Permanent Collection SCCM | Devices that were given the application directly (for example with Assign Software) are carried into one collection from version to version. Use it as the source of a phase, so those devices are upgraded too. |
| Wait at least … hours in the template | Lets a new version prove itself on the pilot ring for a day or two before production gets it. |
| Approval required in the template | For applications where someone must test each version before production. |
6 Only upgrade who has it
For updates, you usually only want devices that already have the application — not every device in the ring.
Tick Limit devices to install collections (SCCM) or Limit endpoints to the following groups (Intune), and/or Limit devices to program name / Limit endpoints to program name in the wizard. A device in a ring then only gets the new version if it had a previous version (or has the program installed). When you tick more than one of these, a device qualifies when it matches at least one.
In the phased deployment template, tick When a phase is empty › Skip the phase and continue with the next one. Rings where nobody has the application are then skipped, and the rollout continues instead of waiting with No target resources.
To narrow a Patch Flow down further — for example to only one site’s devices — set Limit to in its phased deployment template: unlike the wizard’s limits, a device must also be a member of that collection or group.
7 SCCM and Intune in one Patch Flow
A Patch Flow that imports to both SCCM and Intune creates a separate phased deployment for each.
Choose an SCCM template in step 3 and an Intune template in step 5 (one per tenant). The two rollouts run side by side and independently: SCCM devices follow the SCCM rings, Intune users and devices the Intune rings. The Intune phased deployment is named <application> - Robopack - Intune.
8 Auto Update Plus download rules SCCM
An Auto Update Plus download rule can roll out each newly downloaded application with a phased deployment template.
Select the template in the rule’s deployment settings. Each new application gets a phased deployment named <application> - Auto Update Plus; the rule can also remove the devices from the previous version’s install collection. The phased deployment starts at the same time as the rule’s test deployment. See Auto Update Plus.
9 Troubleshooting
| Symptom | Cause | What to do |
|---|---|---|
| Status: “Phase x of y has no target resources” on a Patch Flow ring. | The program name or install collection limit matched no device in that ring, so nobody in the ring has the application yet. | In the template, tick Skip the phase and continue with the next one under When a phase is empty. |
| Status: “Not enough devices to complete phase x of y” on a hand-picked pilot. | The success criteria asks for more successful devices than the pilot has. | Pick at least as many devices as the number in the success criteria, before you save. Once the phase has started, use Continue to next phase in the status window. |
| “There are only 'x' licenses left. You have selected 'y' devices.” when you save a ring. | The rings together target more devices than there are licences left for the package. The window does not save. | Reduce the targets, for example with a smaller first ring, or add licences, then save again. |