Robopatch

Robopatch automatically detects when an app vendor releases a new version, builds an updated package, and deploys it to your devices through configurable Deployment Waves.

How it works

A flow updates one app. A patch group is a separate object that can contain flows and provide their shared settings and deployment waves. You can create a patch group before any flows exist, then add apps to the group to create their flows. See Creating a patch group.

1. Create a Flow for an app (from Instant Apps or a custom upload)
2. Add Deployment Waves — define which groups of devices receive the update and in what order
3. Set thresholds — set the minimum response rate and minimum install success rate each wave must reach before Robopack moves to the next wave
4. Robopack handles the rest — new versions are detected, packaged, and deployed automatically

Once a flow is created with Auto-update enabled, new versions are detected from the Winget repository and automatically deployed through your configured waves. Robopack checks for new versions continuously — once a new version appears in Winget, it is typically available through Robopack within approximately 30 minutes.

Deployment Waves

Waves let you stage a rollout so problems surface in a small group before the update reaches your whole device estate. Each wave has two thresholds that decide when Robopack moves on to the next wave:

• Minimum response rate: the percentage of targeted devices that must report either "installation succeeded" or "installation failed" before Robopack evaluates the minimum install success rate.
• Minimum install success rate: the percentage of targeted devices that must report "installation succeeded" before Robopack moves to the next wave (if there is one).

Targeted devices are the devices that have checked in with Intune and picked up the assignment. This is not the number of members in the wave's Entra ID group. Read How the wave thresholds are calculated before you choose these values.

Example setup:

Wave	Group	Type	Minimum response rate	Minimum install success rate
1	IT Test Computers	Required	60%	100%
2	All Devices	Available	Not set	Not set

In this example, Robopack waits until at least 60% of the targeted IT test computers have reported a result, then checks whether 100% of the targeted devices reported success. Once both thresholds are met, the update rolls out to all devices as an available install.

You can also add a delay between waves (Delay after completion) to give your team time to verify everything works.

How the wave thresholds are calculated

Both percentages are calculated against targeted devices: the devices that have checked in with Intune and picked up the assignment. A device that has not yet checked in and picked up the assignment is not counted. Group membership is not part of the calculation.

Worked example. An Entra ID group has 100 devices. Only 20 of them have checked in and picked up the assignment, so there are 20 targeted devices. Those 20 attempt the install; 8 report success and 2 report failure. The other 10 have not reported yet.

Measure	Calculation	Result
Targeted devices	Devices that have picked up the assignment	20 (not 100)
Response rate	(8 succeeded + 2 failed) / 20 targeted	50%
Install success rate	8 succeeded / 20 targeted	40%

Two points follow from the arithmetic:

• The 80 group members that have not checked in are not in the denominator of either percentage.
• The install success rate is measured against the 20 targeted devices, not the 10 that have reported a result. Targeted devices that have not yet reported count against the success rate until they report success, as do devices that report failure.

With the thresholds from the example setup above (60% response, 100% success), this wave would not advance yet. Once the response rate is reached, Robopack checks the install success rate, and the wave advances when that is met too.

A wave can advance before most of the group has installed

Because the denominator is targeted devices (the devices that have picked up the assignment) rather than group members, a large group where only a handful of devices have checked in can satisfy both percentages early. If 5 devices out of a 500-device group check in and all 5 install successfully, a wave set to 60% response and 100% success is satisfied and, unless Proceed Mode is Manual, Robopack advances to the next wave (after any Delay after completion). The thresholds tell you how the targeted devices are doing; they do not tell you how much of the group has been reached.

Why it works this way. Robopack reads the app's installation status overview from Microsoft Graph, the same figures shown on the app overview page in the Intune admin center. That is a single request with immediate data. Graph has no reliable built-in way to resolve an assignment to the set of devices it will eventually reach: you would have to enumerate each group's direct and nested members, dynamic groups are harder still, and even then the app may not apply to every member because of platform requirements or requirement scripts. Assignment groups can also contain users as well as devices, and resolving users to their devices is not trivial. Counting targeted devices, the devices that have picked up the assignment, avoids all of that.

Practical advice

• Use a small test group for the first wave, made up of devices you know are online and checking in regularly. When every device in the group has picked up the assignment, the percentages mean what you expect.
• Set a Delay after completion on early waves so a wave that is satisfied quickly still gives your team time to verify before the next wave starts.
• For critical apps, set Proceed Mode to Manual on the wave. Robopack then never advances automatically; an admin reviews the results and clicks Skip to next wave. See Manual proceed mode.
• Wave Time Limit advances a wave on timeout; it does not hold one back. See Wave Time Limit.

Wave Time Limit

Set a time limit on waves to prevent them from getting stuck indefinitely. When the time limit is reached, the flow advances to the next wave automatically — even if the wave's minimum response rate and minimum install success rate have not been met. If you want to wait until the flow has completed instead, use Delay after completion.

Exclusion groups

Deployment waves support exclusion assignments — you can add Entra ID groups containing devices or users that should be excluded from a particular wave's deployment.

warning

Do not use the same Entra ID group in multiple waves of the same flow. This causes deployment errors.

Patch groups

A patch group exists independently of Robopatch flows. You can create and save a patch group on its own, before adding any apps or creating any flows. Once created, it can contain flows for the apps you add.

Object	Purpose
Patch group	Holds shared settings and deployment waves for its app flows. It can be created before it contains any flows.
Robopatch flow	Manages updates and deployments for an individual app. Adding an app to a patch group creates its flow in that group.

Creating a patch group

1. Create and save a patch group independently of any app or flow.
2. Configure the group's shared settings and deployment waves for the apps you intend to manage together.
3. Add apps to the patch group. Adding an app creates a Robopatch flow for that app in the group. You can add both Instant Apps and custom uploaded apps.

For example, you can create a browser patch group first, then add browser apps to it. The group exists before those apps' flows are created.

Adding apps to an existing patch group

Add apps to the patch group to create their flows. You can also start from an app package: view the package, select Setup Robopatch Flow, and choose the existing patch group from the list. This is an app-first way to populate a group; it is not a prerequisite for creating the patch group itself.

Use patch groups to manage related apps together and apply shared settings and deployment waves to their flows.

note

A flow cannot be moved between patch groups once it has Intune deployments. To change an app's patch group, remove it from the current group and add it to the new one — see Known Limitations.

note

If you change settings in a patch group, you need to Stop and Start each flow for the changes to take effect.

Manual proceed mode

For critical applications that need human approval before rolling out, you can set the Proceed Mode to Manual on any deployment wave. When enabled, Robopack will never advance to the next wave automatically — instead, you go to the deployment and click Skip to next wave to approve.

Flow options for new versions

When a new version becomes available while a deployment is in progress, you can configure how Robopack handles it:

Option	Behaviour
Pause current version and start new one	Stops the current deployment and starts deploying the new version immediately
Wait for current version to complete	Finishes the current deployment before starting the new version
Run new version alongside current one	Deploys both versions simultaneously

Supersedence

Supersedence is managed by the patch flow. When a new version is deployed:

• The old version is automatically superseded in Intune
• Robopack keeps a configurable number of previous versions (default: 3) before deleting them from Intune
• The "Last version" vs "All versions" setting controls how many old versions are superseded

Detection method options

Setting	Behaviour
Equals (default)	Detects only the exact version deployed
Match newer versions (Greater than or equals to)	Detects any version equal to or newer than the deployed version. Prevents Intune from re-deploying when a newer version is already present

After changing the detection method, click Sync app settings to push the change to Intune.

Syncing app settings

If you make changes to an application's Custom App Settings or flow configuration after a flow is already running, click Sync app settings in the deployment to update the content in Intune for all tenants in that deployment.

Additional Intune properties

When configuring a deployment flow, you can specify additional properties that are set in Intune:

• App name
• Publisher
• Developer
• Owner
• Comments

Uninstall via patch flow

To uninstall an application from all machines in a group:

1. Add the group to a wave in the patch flow
2. Set the Assignment type to Uninstall

The app will be removed from all devices in that group.

Autopilot support

Robopack supports updating apps marked as Required in an Intune Enrollment Status Page. When an app is superseded by Robopack to a newer version, any enrollment profiles where the app is set as required will be updated to the newer version automatically.

note

This feature requires the DeviceManagementServiceConfig.ReadWrite.All permission. You may need to re-grant permissions in Settings > Tenants.

Requirements

• Intune tenant connected with Admin Consent authorization
• DeviceManagementApps.ReadWrite.All permission

info

If your tenant was connected using the user-based method, Robopatch will not be available. You'll need to reconnect with Admin Consent.

Related

• Tutorial: Automating App Updates
• Radar Tracking — combine with Robopatch to patch discovered software
• Troubleshooting: Robopatch Flows