Windows update rings in Intune, set up properly

What Intune actually controls

Microsoft has renamed Windows Update for Business: it is now called Windows Update client policies. In Intune you apply those client settings through update ring policies, assigned to groups of devices. A ring decides deferral periods, deadlines, restart behaviour, active hours and what users are told.

Three other policy types sit alongside the rings: feature update, quality update and driver update policies. Microsoft runs these through the Windows Autopatch service in the background, which is why they have extra requirements:

• Licensing. Update rings need Intune Plan 1. Feature, quality and driver update policies also need a Windows licence that includes the Autopatch entitlement, and Microsoft lists Microsoft 365 Business Premium among the licences that have it.
• Join type. Those three policy types need devices that are Microsoft Entra joined or hybrid joined. A device that is only Entra registered can still take update rings, but nothing more.
• Diagnostic data and one Windows service. Devices must send diagnostic data at the Required level, and the Microsoft Account Sign-In Assistant service (wlidsvc) must be able to run. If a hardening script has disabled that service, Windows Update doesn't offer feature updates.
• Edition. Update rings support Windows Pro, Pro Education, Enterprise and Education, among others. Windows Home isn't on the list.

Quality updates and feature updates are different problems

Update rings can also defer feature updates, by up to 365 days. A feature update policy is the clearer tool, because it names the version. If you use one, Microsoft says to set the ring's feature update deferral to 0 and make sure feature updates aren't paused in the ring, or the two settings delay each other. Feature update policies don't apply during Autopilot setup; they take effect at the first Windows Update scan after the device is provisioned.

Microsoft's Intune documentation notes that Windows 10 reached end of support on 14 October 2025. Any Windows 10 laptop still in the fleet should be near the top of your upgrade or replacement list.

A ring structure for 10 to 150 devices

Microsoft's deployment planning guidance describes a common three-ring structure (Preview, Limited and Broad) and says plainly that there is no fixed rule for how many rings to have. For a small business we use three rings with plainer names:

Two points from Microsoft's guidance matter most when you pick the pilot. The pilot should be a representative sample of your hardware and applications, and IT staff or people with the newest laptops usually aren't representative. Pick people who use their devices every day and will tell you quickly when something breaks.

Assign each ring to a device group, as Microsoft recommends, so the policy applies without anyone having to sign in first. Put each device in exactly one ring. If two rings with different values reach the same device, Intune reports a settings conflict and leaves you to resolve it.

Microsoft describes two ways to move between rings: a "red button" approach, where updates flow until someone spots a problem and stops them, and a "green button" approach, where nothing moves until someone approves it. Microsoft notes that manual approval steps slow updates down. For a small fleet, the red button approach with staggered deferrals is the one that actually keeps devices patched.

Deferrals, deadlines and grace periods

A deferral delays when an update is offered. A deadline decides when it installs whether or not the user has got round to it. Intune's ring settings allow:

• Deadline for quality updates and deadline for feature updates: 2 to 30 days each.
• Grace period: 0 to 7 days, the minimum time after the deadline before restarts happen automatically.
• Auto reboot before deadline: Microsoft recommends Yes, so the device can restart outside active hours while nobody is using it. With No, it waits until the deadline and grace period expire and then restarts, possibly in the middle of the working day.

On Windows 11 22H2 and later, the deadline counts from when the device first found the update in a scan, and the grace period counts from when a restart becomes pending. The effective deadline is whichever of those two comes later. That is what stops someone coming back from three weeks of leave and being restarted the moment they open the lid. Once the effective deadline passes, the device restarts regardless of active hours. On Windows 11 23H2 and later, users get a notification in the middle of the screen 15 minutes before that happens.

A few user experience settings are worth setting deliberately:

• Automatic update behaviour: "Reset to default" is the value Microsoft recommends if you want expedited updates to work smoothly.
• Option to pause Windows updates: set it to Disable, so staff can't postpone updates themselves.
• Change notification update level: never choose the option that turns off all notifications including restart warnings. Users then get a forced restart with no warning.

Windows 11 24H2 and later also offer maintenance windows (from the January 2026 update), aimed at kiosks and devices without a regular user. Microsoft recommends using either maintenance windows or deadlines, not both. For staff laptops, deadlines are the right tool.

Driver and firmware updates

By default, driver updates come through Windows Update with everything else. The ring setting Windows drivers turns that on or off. For more control, a driver update policy lets you approve drivers centrally:

• Automatic approval approves each new recommended driver as it appears, then holds it for a deferral of 0 to 30 days ("Make updates available after") counted from the day it was added to the policy. That delay is your window to spot a problem and pause it.
• Manual approval holds every new driver as "Needs review" until someone approves it, with an optional start date.
• Other drivers, including firmware and optional drivers, always need manual approval, even in an automatic policy.

Three rules catch people out. A driver that has been approved can never be declined, only paused. Driver update policies can't roll back or remove a driver once it is installed. And each device should be in only one driver policy, or a driver declined in one can be approved in another. If the ring's Windows drivers setting is Block, driver policies can't deliver anything.

A sensible small-fleet setup is one automatic-approval policy for the pilot ring with no deferral, and one for everyone else with a deferral of about a week. Review the "Drivers to review" count once a month for firmware.

When an update goes wrong

This is where rings earn their keep. The order we follow:

1. Pause the rings that haven't updated yet. In Intune, open the broad and late rings and select Pause for quality (or feature) updates. A pause lasts up to 35 days. Resuming and pausing again resets it to 35 days, and Extend resets it without resuming.
2. Remember the pause isn't instant. Devices receive the pause at their next check-in. A device that installs on schedule before checking in, or one that was switched off when you paused, can still pick up the update. Pause as soon as the pilot shows a real problem, not after a day of watching.
3. Roll back if you have to. Uninstall removes the latest quality or feature update from devices in a ring. It goes out immediately, ignores maintenance schedules, and restarts the device without letting the user delay. Intune also pauses that update type in the ring. A feature update can only be removed within the ring's uninstall period, which you set between 2 and 60 days.
4. For a bad driver, pause the driver. In the driver update policy, set the driver to Paused. That stops it reaching more devices but doesn't remove it where it is already installed. If an older version is still approved, devices are offered that one instead.
5. Resume deliberately. Write down when each pause expires. When the 35 days are up, devices scan and install whatever is applicable, fixed or not. Resume once Microsoft has released the fix, and watch the pilot ring again.

The opposite case is an urgent security fix you want everywhere now. An expedite policy installs one chosen security update as soon as possible, overriding the ring deferral for that update only, with a restart deadline of 0 to 2 days. Windows Update may install a newer cumulative update if one supersedes it. On Windows versions earlier than 24H2 expediting needs the Update Health Tools; on Windows 11 24H2 and later, Microsoft says not to install them.

Where Windows Autopatch fits

Windows Autopatch is Microsoft's cloud service for automating updates to Windows, Microsoft 365 Apps for enterprise, Microsoft Edge and Teams. Microsoft made its features available to Business Premium licences from April 2025, and Intune now uses Autopatch behind the scenes for feature, quality and driver update policies. What that means in practice:

• Autopatch groups can spread devices across rings automatically and run gradual rollouts, instead of you maintaining the groups by hand.
• Hotpatch installs most monthly security updates without a restart. Microsoft's Intune documentation says Autopatch now turns hotpatch on by default for eligible devices, and you can opt out with a quality update policy. Eligibility is specific: Windows 11 24H2 or later, a qualifying licence (Business Premium is listed), virtualisation-based security switched on, and the device on the latest quarterly baseline. Baseline months (January, April, July and October) still need a restart. Devices that don't qualify get the normal cumulative update.
• Device requirements. Devices must be corporate-owned (Windows personal devices are blocked at registration) and must have checked in with Intune in the last 28 days.
• Don't double up. Microsoft says admins typically shouldn't assign their own update rings to devices that Autopatch manages.
• Support. Raising support requests with the Autopatch engineering team needs E3, E5 or F3 licensing. Business Premium tenants get the features, not that support channel.

Update rings don't cover the Office apps. Microsoft notes that Click-to-Run installs of Office can't be updated through Windows Update client policies, so Microsoft 365 Apps need their own update settings.

Reporting: what to check each month

• Each ring's check-in status shows how many devices report Succeeded, Error, Conflict or Not applicable. The per-setting view shows which setting is in conflict, and drilling into a device lists every profile that manages that setting.
• Reports > Windows Updates holds the feature update report per policy and the expedited update report. To populate them, the tenant must allow Intune to use Windows diagnostic data. Data from Windows Update arrives within about an hour; data from devices refreshes every eight hours.
• The feature update failures report lists alerts with a recommended fix for each. The ones we see most are a safeguard hold (Microsoft is holding the update back from that hardware), a full disk, and policy conflicts where a pause or deferral on the device is blocking the update.
• Windows Update for Business reports, in the Azure portal, give a fleet-wide view of update compliance for Entra joined devices and are included with Windows licences.

Our monthly list: devices that haven't checked in, devices sitting at "restart required", any ring that is still paused and how many days it has left, and any device on a Windows version at or near end of service.

Pitfalls we see

• Old Group Policy or WSUS settings left behind. Settings such as an intranet update server location or "Configure Automatic Updates" from Group Policy interfere with Intune's policies. Microsoft lists them and says to set them back to Not configured.
• A feature deferral in the ring as well as a feature update policy. The two delay each other. Set the ring's feature deferral to 0.
• A forgotten pause. It expires after 35 days and devices install whatever is waiting.
• The wlidsvc service disabled by a hardening script, so feature updates are never offered.
• Very short deadlines with no grace period. People get restarted mid-meeting and start leaving their laptops at home.
• A pilot made up only of IT. It finds nothing, because IT doesn't use the accounting package.

How 365msp runs updates

Update management is part of our Windows update management service, inside the flat $150 per user monthly fee. Every tenant we manage gets pilot, broad and late rings, a feature update policy that names the Windows version, and a monthly look at the reports. When the pilot ring shows a problem, we pause the other rings and tell you what happened. The same discipline runs through our configuration profiles and compliance policies.