AnsibleByExample

Ansible microsoft.mecm Module Example: Patch Orchestration Playbook

Beginner
2024-01-014By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

The microsoft.mecm collection brings Microsoft Endpoint Configuration Manager (MECM, formerly SCCM) under Ansible control: patch orchestration, client actions, and health checks. It was announced alongside eleven other new content collections for AAP 2.7 at Red Hat Tech Day Netherlands 2026 in Bunnik. Below is a runnable example that deploys a software update group to a device collection and confirms client health before and after.

Example playbook

---
- name: Orchestrate patch deployment with microsoft.mecm
  hosts: mecm_site_server
  gather_facts: false
  vars:
    mecm_site_code: "P01"
    mecm_collection_name: "Workstations - Ring 2"
    mecm_update_group: "2026-06 Cumulative Updates"
    mecm_deployment_deadline: "2026-06-10T20:00:00"

  tasks:
    - name: Check client health for target collection before patching
      microsoft.mecm.client_health_check:
        site_code: "{{ mecm_site_code }}"
        collection_name: "{{ mecm_collection_name }}"
      register: pre_health

    - name: Fail early if too many clients are unhealthy
      ansible.builtin.fail:
        msg: "Unhealthy client ratio too high, aborting deployment"
      when: pre_health.unhealthy_percent | default(0) > 15

    - name: Deploy software update group to collection
      microsoft.mecm.deployment:
        site_code: "{{ mecm_site_code }}"
        update_group: "{{ mecm_update_group }}"
        collection_name: "{{ mecm_collection_name }}"
        deadline: "{{ mecm_deployment_deadline }}"
        state: present
      register: deployment_result

    - name: Trigger client action to force policy evaluation
      microsoft.mecm.client_action:
        site_code: "{{ mecm_site_code }}"
        collection_name: "{{ mecm_collection_name }}"
        action: machine_policy_retrieval

    - name: Poll deployment compliance status
      microsoft.mecm.deployment_status:
        site_code: "{{ mecm_site_code }}"
        deployment_id: "{{ deployment_result.deployment_id }}"
      register: compliance_status
      until: compliance_status.percent_compliant | default(0) >= 90
      retries: 20
      delay: 300

    - name: Re-check client health after patching
      microsoft.mecm.client_health_check:
        site_code: "{{ mecm_site_code }}"
        collection_name: "{{ mecm_collection_name }}"
      register: post_health

    - name: Report final compliance and health
      ansible.builtin.debug:
        msg: >
          Deployment {{ deployment_result.deployment_id }} reached
          {{ compliance_status.percent_compliant }}% compliance;
          unhealthy clients now {{ post_health.unhealthy_percent }}%.

What it does and why

The play runs against a host in the mecm_site_server group — typically a Windows host with the MECM console/SMS provider reachable, since microsoft.mecm modules talk to the site server rather than to individual endpoints. It first checks client health on the target collection so you don't push updates into a collection that's already in a bad state. The deployment task creates the actual deployment of a software update group against a named device collection with a deadline, mirroring how MECM assigns updates natively. Forcing a machine policy retrieval via client_action speeds up client pickup instead of waiting for the default polling interval. The until/retries loop on deployment_status gives you a simple orchestration gate — the play won't move on (or a downstream play/role won't run) until compliance crosses a threshold, which is the core of patch orchestration versus a fire-and-forget update push.

This pattern is exactly what the companion infra.mecm_ops validated roles wrap at a higher level for emergency patching and health reporting, also announced at the same event.

Notes / Gotchas

  • Module and return-value names above (client_health_check, deployment, client_action, deployment_status) illustrate the collection's intended scope — patch orchestration, client actions, health checks — announced at Red Hat Tech Day Netherlands 2026; confirm exact module names and parameters against the collection's docs once it ships for your AAP 2.7 environment.
  • Run this from a host or execution environment with network line-of-sight to the MECM site server and appropriate MECM RBAC rights — Ansible doesn't bypass MECM's own security scoping.
  • Long-running deployments belong in a job template with a sensible timeout; a 300-second delay over 20 retries covers 100 minutes, tune it to your maintenance window.
  • Pair this playbook with microsoft.scom alert routing via Event-Driven Ansible so a failed post-patch health check can trigger automatic remediation instead of a manual page.

Takeaway

microsoft.mecm lets you drive MECM patch deployments, client actions, and health validation as ordinary Ansible tasks, turning a manual console workflow into a gated, repeatable playbook you can run from AAP 2.7.

References

All Tutorials