How should we manage Windows updates with Intune?

Key facts

• Update rings control deferral, deadlines and restart behavior for quality updates.
• Feature update policies pin devices to a chosen Windows version until you move them.
• Expedited quality updates override deferrals for urgent security fixes.
• Deadlines and grace periods matter more than deferrals for getting devices patched.
• Do not mix Intune update policies with old Group Policy or WSUS settings on the same devices.

The Intune update toolset

Intune uses Windows Update for Business through the Windows Update client policies and the deployment service. Devices get updates straight from Microsoft, and Intune sets the rules. That removes the need for WSUS or Configuration Manager for most SMB and mid-market fleets.

Design your rings

Rings let problems show up on a few devices before they reach everyone. Assign rings with Entra ID groups, and make sure every device is in exactly one ring.

• Pilot: IT staff and a few willing users, no deferral, short deadline.
• Early: a cross-section of departments and hardware models, a few days of deferral.
• Broad: everyone else, about a week of deferral.
• Critical: a small set of devices such as front desk or production PCs, longest deferral and controlled restarts.

Deadlines, restarts and the user experience

Deferrals decide when an update is offered. Deadlines decide when it must be installed. Without deadlines, devices can sit unpatched for weeks while users postpone restarts. Set a deadline of a few days after the update is offered and a short grace period so devices that were offline get time to catch up.

Set active hours and notifications so restarts happen outside working time where possible. Tell users what to expect, especially on the first cycle, and make sure laptops that sleep at night are not the ones always missing updates.

Feature updates, drivers and urgent fixes

Use a feature update policy to hold devices on an approved Windows 11 version and move them on your schedule. Check the Windows release health page and test line-of-business apps before moving a ring forward.

Driver and firmware update policies let you approve or pause specific drivers from Windows Update, which helps avoid a bad driver hitting the whole fleet. When a critical vulnerability is being exploited, an expedited quality update can push the fix to devices quickly, regardless of ring deferrals.

Reporting and cleanup

Use the Windows update reports in Intune and Windows Update for Business reports in Log Analytics to see which devices are behind, failing or not checking in. A device that is not checking in is usually a bigger issue than a failed update.

Remove conflicting settings. Old Group Policy objects, WSUS registry keys or co-management workloads that still point updates to Configuration Manager are the most common reason Intune update policies do not apply. Move the Windows Update workload to Intune deliberately, and confirm with a device that policies apply as expected.

How Accred Consulting approaches it

Accred Consulting sets up Windows update management in Intune as part of endpoint projects. Discovery reviews current update tooling, Group Policy and WSUS settings, hardware models and critical devices. The proposal sets a clear scope, fixed price and timeline. US-based specialists then design rings, deadlines, feature and driver policies, remove conflicting settings, evaluate Windows Autopatch where licensed and set up reporting. A roughly 280-device estate across 11 locations moved to Autopilot and Intune with this kind of work. Handover includes documentation and knowledge transfer, with optional support retainers for monthly patch oversight.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions