> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-publisher/requirements/configmgr-requirements/sup-requirements/selection.md).
# ConfigMgr Software Update Point Selection for Patch My PC Publisher
*Applies to: Patch My PC Publisher V3.x*
Patch My PC (PMPC) Publisher should be installed on the top-level Software Update Point (SUP) in your Microsoft ConfigMgr environment.
The top-level SUP is the WSUS instance that typically (but not exclusively) synchronizes directly with the Microsoft Update catalog and is responsible for authoring update metadata before it is replicated downstream.
Publishing updates at the top-level SUP ensures that third-party update metadata flows correctly to all downstream SUPs/WSUS servers, enabling client devices, regardless of which SUP/WSUS instance they scan against, to successfully scan for, install, and report compliance on third-party updates.
{% hint style="info" %}
**Note**
In more complex or highly customized environments, it is possible to install Publisher on a SUP that is not the top-level one. However, this requires very careful WSUS and SUP configuration to ensure update metadata is correctly authored and replicated downstream as expected.
These scenarios are uncommon and should only be implemented with a clear understanding of ConfigMgr/WSUS synchronization behavior, as misconfiguration can prevent clients from detecting or reporting on third-party updates.
{% endhint %}
{% hint style="danger" %}
**Important**
Installing Publisher on a downstream SUP will prevent third-party update metadata from flowing correctly, which can result in clients connected to an upstream SUP being unable to scan for or report compliance on published third-party updates.
{% endhint %}
## Identifying the top-level SUP
The top-level SUP is typically (but not exclusively) the SUP that synchronizes directly with Microsoft Update.
In most environments, this is the first SUP installed when more than a single Site System with the SUP role is configured.
In a Central Administration Site (CAS) hierarchy, the CAS SUP is typically the top-level SUP.
Consider the following scenarios to help you select the correct Site System on which to install Publisher:
* [Scenario 1: Single SUP, Microsoft Update is the Synchronization Source](#scenario-1-single-sup-microsoft-update-is-the-synchronization-source)
* [Scenario 2: Multiple SUP's, Microsoft Update is the Synchronization Source](#scenario-2-multiple-sups-microsoft-update-is-the-synchronization-source)
* [Scenario 3: Multiple SUP's, Microsoft Update is *not* the Synchronization Source](#scenario-3-multiple-sups-microsoft-update-is-not-the-synchronization-source)
### Scenario 1: Single SUP, Microsoft Update is the Synchronization Source
In this example, a single Site System **cm.lab.local** holds the SUP role and is considered the top-level SUP as its synchronization source is Microsoft Update.
### Scenario 2: Multiple SUP's, Microsoft Update is the Synchronization Source
In this example, multiple Site Systems hold the SUP role, but **bb-cm1** is considered the top-level SUP as its synchronization source is Microsoft Update.
### Scenario 3: Multiple SUP's, Microsoft Update is *not* the Synchronization Source
In this example, the upstream synchronization source is not Microsoft Update, but **sus.lab2.local**. This is common in environments where the WSUS server that synchronizes with the Microsoft Update catalog is located in a DMZ.
Even in this configuration, **sus01.lab2.local** is still considered the top-level SUP as it is the authoritative source for update metadata within ConfigMgr.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.patchmypc.com/patch-my-pc-publisher/requirements/configmgr-requirements/sup-requirements/selection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.