Managing Windows Updates with Intune

Tip

Consider using Autopatch! It seems great! Details added.. Eventually!

Using a ring-based approach

Deploying updates in controlled “rings” lets you detect issues early prior to full scale deployments. The typical suggested groups are as follows:

• Small group of IT members and power users. Likely to catch and resolve issues quickly.
• Representative mix of departments and hardware profiles. Still small enough to pivot, and reach a few edge cases.
• Business-critical devices that need extra validation time.
• The remainder of the estate once confidence is high.

---

1 · Create Windows Update rings

In Intune portal → Devices → Update rings for Windows 10 and later, create four separate Update ring policies, one per ring:

Setting	Preview	Pilot	VIP	Broad
Quality update deferral (days)	7	14	30	30-60
Feature update deferral (days)	0¹	0¹	0¹	0¹
Microsoft product updates	Enable	Enable	Enable	Enable
Windows drivers	Enable²	Enable²	Enable²	Enable²
Install day/time	Daily 1 AM	Daily 2 AM	Weekly Sat	Weekly Sun

Tip

¹ Set Feature update deferral period to 0 so you can manage feature releases with the separate Feature update policy (next section).
² Keep driver updates enabled unless your OEM tooling handles drivers out-of-band.

---

2 · Pin specific feature releases

Use Devices → Feature updates for Windows 10 and later to lock devices on a targeted release (e.g., Windows 11 24H2) until you choose to move them:

Feature update: Windows 11, version 24H2
Rollout options:
  • Update all devices in this policy as soon as possible
Uninstall window: 14 days    # Safety-net rollback period

Assign the policy to all four rings so quality updates follow the ring cadence while feature updates stay aligned.

---

3 · Driver & firmware servicing (optional)

If you rely on tooling such as Lenovo Commercial Vantage, Dell Command Update, etc etc, you may wish to disable driver updates in Intune and delegate to OEM tools. Otherwise, leaving Windows drivers = Enabled lets Windows Update deliver approved drivers automatically. I personally do not suggest leaving drivers unmanaged.

---

4 · Monitor, test & iterate

• Endpoint analytics → Windows updates shows compliance, failure rates and install times.
• Intune → Reports → Windows updates → Update failures highlights problem KBs.
• Validate line-of-business apps after each Preview/Pilot rollout; hold back Broad if blockers appear.
• For critical issues, pause the affected update in Update rings → Pause quality updates.

Caution

Pausing stops all quality updates—including security patches—on that ring. Lift the pause as soon as the issue is resolved to maintain compliance.

---

5 · Production-readiness checklist

Health monitoring

✅ Endpoint analytics enabled
✅ Compliance settings configured and updated

Rollback strategy

✅ 14-day uninstall window set
✅ Support staff aware of manual rollback wusa /uninstall /kb:kbID

Communication

✅ Change calendar published
✅ End-user FAQs in self-service portal

Security baseline

✅ Update ring scope tags reviewed
✅ Windows 10 end-of-service devices identified

---

Next steps

• Automate reporting: Pipe Update Compliance data into Power BI for weekly dashboards.
• Explore Windows Autopatch: If you later add Enterprise licensing, Autopatch can manage ring logic automatically while integrating with existing Intune reporting.

---