A computer-implemented method for administering upgrades to a plurality of devices (341-343), comprising: receiving , via an interface, device information associated with a device upgrade and the plurality of devices (341-343), wherein the device information includes risk parameters including values associated with a minimum health value that is associated with a minimum acceptable number of healthy devices among the plurality of devices (341-343) and a confidence value (α) that is associated with a minimum acceptable probability that the number of healthy devices among the plurality of devices (341-343) is at least as great as the minimum health value, and wherein the device information further includes, for each device of the plurality of devices (341-343), a probability of successful upgrade (pn) that the device will be healthy after the device upgrade is performed on the device, wherein the α is an input to a device upgrade process and is the confidence probability that βn devices from among the plurality of devices (n) in a tenant will remain healthy ; iteratively using a Poisson binomial distribution to determine, based in part on the probability of successful upgrade of the plurality of devices (341-343), a set of devices among the plurality of device for which the largest possible number of devices are included in the set of devices while meeting the risk parameters, according to the Poisson binomial distribution; after determining the set of devices, automatically performing the device upgrade on each device of the set of devices; further comprising selecting a number of devices that have low probability of successful upgrade and that are thus at high risk to be included in a number of the distribution iterations to perform the device upgrade on each device of the selected number of devices. receiving , via an interface, device information associated with a device upgrade and the plurality of devices (341-343), wherein the device information includes risk parameters including values associated with a minimum health value that is associated with a minimum acceptable number of healthy devices among the plurality of devices (341-343) and a confidence value (α) that is associated with a minimum acceptable probability that the number of healthy devices among the plurality of devices (341-343) is at least as great as the minimum health value, and wherein the device information further includes, for each device of the plurality of devices (341-343), a probability of successful upgrade (pn) that the device will be healthy after the device upgrade is performed on the device, wherein the α is an input to a device upgrade process and is the confidence probability that βn devices from among the plurality of devices (n) in a tenant will remain healthy ; iteratively using a Poisson binomial distribution to determine, based in part on the probability of successful upgrade of the plurality of devices (341-343), a set of devices among the plurality of device for which the largest possible number of devices are included in the set of devices while meeting the risk parameters, according to the Poisson binomial distribution; after determining the set of devices, automatically performing the device upgrade on each device of the set of devices; further comprising selecting a number of devices that have low probability of successful upgrade and that are thus at high risk to be included in a number of the distribution iterations to perform the device upgrade on each device of the selected number of devices. <EOS>