How to Manage Windows Update for Business Policies via Intune

Introduction

Ensuring that Windows devices are up-to-date is critical for security and performance. In modern enterprise environments, traditional on-premises tools like WSUS (Windows Server Update Services) are increasingly being replaced by cloud-native solutions. Windows Update for Business (WUfB) allows administrators to manage updates directly from the cloud. By integrating WUfB with Microsoft Intune, you can precisely control when and how feature updates, quality updates, and drivers are deployed across your organization.

Prerequisites

To successfully deploy WUfB policies, you need an active Microsoft Intune subscription, devices enrolled in Intune (either Azure AD Joined or Hybrid Azure AD Joined), and appropriate administrative permissions (Intune Administrator or Global Administrator).

Step 1: Create an Update Ring Profile

Update Rings define the settings that govern how updates are delivered to a group of devices.

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Devices > Windows > Update rings for Windows 10 and later.
3. Click Create profile.
4. Provide a descriptive name, such as Pilot Group - Windows Updates, and optionally a description. Click Next.

Step 2: Configure Update Settings

The core of the policy is determining which updates are allowed and when they are applied.

• Update settings: Choose whether to allow Microsoft product updates and Windows drivers. It is generally recommended to allow both for comprehensive security.
• Quality update deferral period (days): Quality updates are monthly security patches. For a pilot group, you might set this to 0 days. For production, setting it to 7 or 14 days gives you time to monitor for issues.
• Feature update deferral period (days): Feature updates (like upgrading from Windows 10 to Windows 11) introduce major changes. You can defer these for up to 365 days.
• Upgrade Windows 10 devices to Latest Windows 11 release: Set this to Yes if you are ready to transition your fleet to Windows 11.

Step 3: Configure User Experience Settings

User experience settings dictate how end-users interact with the update process.

• Automatic update behavior: Select Auto install at maintenance time to prevent disruptions during working hours.
• Active hours: Define your organization’s standard working hours (e.g., 8:00 AM to 5:00 PM). Updates and restarts will not occur during this window.
• Deadline settings: Enabling deadlines ensures that users cannot postpone updates indefinitely. For example, setting a quality update deadline to 5 days means the device will force a restart if it hasn’t been updated within 5 days of the deferral period expiring.

Step 4: Assign the Profile

After configuring the settings, click Next to reach the Assignments tab. Assign the profile to the appropriate Azure AD security group. For staged deployments, create multiple rings (e.g., Pilot, Fast Ring, Broad Deployment) and assign different groups to each profile with progressively longer deferral periods. Click Next, review your settings, and click Create.

Monitoring Update Compliance

Once policies are deployed, you can monitor their effectiveness. In the Intune admin center, go to Reports > Windows updates. Here you can generate reports on feature update deployments and expedited quality updates, allowing you to quickly identify devices that are failing to patch and troubleshoot compliance issues.