AnsibleByExample

Ansible infra.mecm_ops Role Example: Emergency Patch Windows Fleet

Beginner
2024-01-013By Luca Berton

Lesson 1 of 20 in Production Playbooks

Production Playbooks and Troubleshooting — full curriculum
  1. 1. Advanced Playbook Structure & Execution Strategies
  2. 2. Deep Dive: Variable Precedence & Best Practices
  3. 3. Jinja2 Templating Beyond Basics
  4. 4. Advanced Conditionals
  5. 5. Loops Masterclass
  6. 6. Blocks, Rescue, Always (Error Handling)
  7. 7. Handlers Advanced
  8. 8. Change Control: changed_when, failed_when
  9. 9. Tags and Selective Runs
  10. 10. Performance Tuning
  11. 11. Delegation Patterns
  12. 12. Local Actions and Remote Actions
  13. 13. Dynamic Inventory & Runtime Host Management
  14. 14. Includes & Imports (Structuring Large Codebases)
  15. 15. Role Design Patterns
  16. 16. Ansible Galaxy & Collections in Real Projects
  17. 17. Working with APIs (uri + JSON workflows)
  18. 18. Testing and Linting (Quality Gates)
  19. 19. Advanced Debugging Playbook Failures
  20. 20. Capstone: Multi-Stage Deployment
View path overview →

At Red Hat Tech Day Netherlands 2026 (3 June 2026, Bunnik), the Ansible team announced infra.mecm_ops as one of 12 new content collections coming to AAP 2.7. It ships higher-level validated roles on top of microsoft.mecm, packaging patch orchestration and health reporting into a single call instead of chaining raw modules. Here's a playbook that triggers an emergency patch cycle across a Windows fleet managed by Microsoft Endpoint Configuration Manager.

Example playbook

---
- name: Emergency patch a Windows fleet via MECM
  hosts: mecm_site_server
  gather_facts: false
  vars:
    mecm_collection_id: "COL00123"
    emergency_kb_list:
      - "KB5041234"
      - "KB5041987"
    patch_deadline_minutes: 60
    reboot_if_required: true

  tasks:
    - name: Run pre-patch health report
      infra.mecm_ops.health_report:
        collection_id: "{{ mecm_collection_id }}"
        report_scope: pre_patch
      register: pre_report

    - name: Fail fast if unhealthy clients exceed threshold
      ansible.builtin.fail:
        msg: "Too many unhealthy MECM clients: {{ pre_report.unhealthy_count }}"
      when: pre_report.unhealthy_count | int > 5

    - name: Trigger emergency patch deployment
      infra.mecm_ops.emergency_patch:
        collection_id: "{{ mecm_collection_id }}"
        kb_articles: "{{ emergency_kb_list }}"
        deadline_minutes: "{{ patch_deadline_minutes }}"
        allow_reboot: "{{ reboot_if_required }}"
        deployment_priority: critical
      register: patch_result

    - name: Wait for deployment compliance to settle
      infra.mecm_ops.health_report:
        collection_id: "{{ mecm_collection_id }}"
        report_scope: post_patch
      register: post_report
      until: post_report.compliance_percent | int >= 95
      retries: 12
      delay: 300

    - name: Show final compliance summary
      ansible.builtin.debug:
        msg: "Compliance after emergency patch: {{ post_report.compliance_percent }}%"

What it does and why

The play targets the MECM site server (the collection communicates with the ConfigMgr SMS Provider, not each Windows endpoint directly), runs a pre-patch health check, and aborts if too many clients are already unhealthy — patching on top of a broken client base just produces noisy failures. emergency_patch then deploys a specific set of KB articles as a high-priority, short-deadline collection instead of waiting for the normal maintenance-window cadence, which is the whole point of an emergency patch role versus the lower-level microsoft.mecm modules. The final loop polls health_report until compliance clears a threshold, giving you a clean pass/fail signal for a job template rather than a fire-and-forget deployment.

This is exactly the "Efficiency and Resilience" pitch Red Hat gave the validated-role collections at Tech Day: wrap the multi-step MECM workflow (health check → deploy → verify) that admins currently script by hand into one supported role interface.

Notes / Gotchas

  • infra.mecm_ops sits on top of microsoft.mecm; both collections need to be installed and the site server credentials configured in AAP before these roles will resolve.
  • Module and parameter names above (emergency_patch, health_report, collection_id, etc.) are illustrative — Red Hat announced the collection at Tech Day Netherlands 2026 without publishing full module reference docs yet, so confirm exact argument specs against the collection's docs once GA'd for AAP 2.7.
  • deployment_priority: critical still respects MECM maintenance window exceptions only if your collection is configured to allow them — check the ConfigMgr collection settings, not just the Ansible role.
  • Keep retries/delay realistic: large fleets can take well over an hour to report compliance, especially when allow_reboot is true.
  • Pair this with infra.windows_ops for baseline drift checks after the emergency patch lands, since a hotfix can sometimes flip a STIG or CIS control.

Emergency patching a Windows fleet through MECM used to mean stitching together several microsoft.mecm calls by hand; infra.mecm_ops turns that into a short, auditable playbook you can drop straight into an AAP job template.

References

All Tutorials