Approve and monitor an agent release
Choose adoption mode and maintenance times, approve an exact policy revision, and verify device update attempts and reported versions.
Before you start
- A verified published release in the deployment.
- An agent policy with its updater, rollout ring, and percentage configured.
- MFA available for preference changes and release decisions.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Choose how the organization adopts releases
Open Admin → Agent releases. In Tenant update preferences, choose Approve each release, Automatically adopt eligible releases, or Hold current versions, then choose Stable or Beta. Approval is the default. Automatic adoption applies to future eligible releases in that channel within policy rollout limits. Hold pauses new attempts; an installation already in progress may finish.
Set the maintenance window and save it
Enter a Maintenance time zone such as America/New_York, choose Maintenance days, and set Start time and End time. Equal start/end times mean all day; an overnight window belongs to the day it starts. Enter a specific Reason for change, choose Save update preferences, and complete MFA. Saving any preference invalidates earlier individual release approvals.
Inspect a release against the intended policy
Under Available releases, choose Agent policy and read its revision, rollout ring, percentage, and paused state. Expand Notes and compatibility for the candidate version and check channel, availability, expiry, and the release notes. The table shows the latest 50 verified releases. Withdrawn or Expired releases cannot be approved; neither can a release in a different selected channel.
What you should see: The selected policy and release form the exact scope of the next decision.
Record the release decision
In approval mode, choose Approve or Reject beside the version. Read the confirmation’s policy name and revision, enter Reason, and choose Confirm decision. Approval selects the target version but still respects rollout and maintenance limits. A policy at 0% or paused does not update devices. If you edit the policy or update preferences afterward, record a new approval for that revision.
Track attempts and verify device reports
In Device update progress, choose Reported state to isolate Scheduled, Downloading, Installing, Awaiting local checks, Deferred, Failed, or other outcomes, then choose Refresh progress. Read Report freshness and Connection separately from the reported update state; use Attempt details for the policy and attempt IDs. Previous devices and Next devices page through matches. Compare Reported fleet versions and choose Inspect devices for individual heartbeats.
Investigate a health stop before resuming
Under Rollout health stops, choose Refresh rollout health and inspect the stopped release’s reason, sampled/failed/critical/stalled counts, and evaluation time. Follow Inspect device update progress to investigate the affected devices. After incident review, choose Review resume beside the exact release, enter Incident review reason, and choose Verify and resume with a new MFA verification. Refresh and inspect the audit log to confirm the result.
- A critical local failure, a stalled installing/verifying report older than 15 minutes, three failed devices, or a failure rate of at least 20% with five or more samples stops further release eligibility.
- Stops remain in place until explicit review; there is no automatic resume or rollback. A fresh snapshot is required to resume, and new reports begin a new monitoring period that can stop the release again.
Pause expansion and retain the decision trail
Use Configure rollout to adjust the selected policy’s ring/percentage or Emergency halt. Halt withholds the target from future configurations; it does not roll already-updated devices back. Use Recent release decisions and Open audit log to inspect reasons and acting administrators. A downgrade requires the separate authorization supported by the release controls, not simply typing an older target into a policy.
If something doesn’t work
Approve is disabled.
Select a policy, use Approve each release mode, and check that the release matches the chosen channel and is neither expired nor withdrawn.
The approved version is not reaching devices.
Check 0%/paused state, updater enablement, rollout cohort, maintenance window, and whether a later policy/settings edit invalidated the approval. Then inspect per-device attempts and fresh heartbeats.
A fleet count looks successful but an endpoint is unhealthy.
The count uses the last reported version/status. Inspect the individual device’s attempt outcome, heartbeat, and operational telemetry before concluding the update is healthy.