Windows Update with Intune: rings, deadlines and active hours

Updates were deliberately excluded from provisioning: the Enrollment Status Page in chapter 2 has Install Windows updates during OOBE set to No. That was not laziness. It was so they could be governed here, where you can decide when a machine is allowed to restart and what happens if nobody lets it.

What a ring is

You update a small pilot group first, wait, then extend to everyone else. If an update breaks something, you find out on three machines instead of three hundred.

In production the usual shape is:

Ring	Deferral	Who
Pilot	0 days	IT and a few volunteers
Broad	7–14 days	The bulk of the fleet
Critical	30 days	Servers, machines that must not stop

A lab has one ring, which makes the mechanism easy to see: the deferral is what staggers them, and everything else stays identical.

The configuration

Intune → Devices → Windows updates → Update rings → Create profile.

Setting	Value
Microsoft product updates	Allow
Windows drivers	Allow
Quality update deferral	0 days
Feature update deferral	0 days
Upgrade Windows 10 devices to Windows 11	No
Feature update uninstall period	20 days
Enable pre-release builds	Not configured

Microsoft product updates set to Allow is worth noticing: it extends Windows Update to Office and the other Microsoft products on the machine, which otherwise update on their own schedule.

The uninstall period is a rollback window. Twenty days is the room you have to reverse a feature update that turned out badly.

User experience

Setting	Value
Automatic update behaviour	Auto install at maintenance time
Active hours	08:00 → 17:00
Option to pause Windows updates	Disable
Option to check for Windows updates	Enable
Change notification update level	Default
Use deadline settings	Allow
‣ Deadline for feature updates	5 days
‣ Deadline for quality updates	2 days
‣ Grace period	2 days
‣ Auto reboot before deadline	Yes

Why these values

Deadlines are the whole policy

Quality tight, feature loose

Two days for quality updates, five for feature updates. That is not a typo, and the asymmetry is deliberate.

Quality updates are the monthly security patches. They close vulnerabilities that are, by definition, already public — often with proof-of-concept code available the same week. Every day of delay is a day of exposure to something known.

Feature updates are the major releases. They change behaviour, occasionally break drivers, and are rarely urgent from a security point of view. More room to discover a problem before the whole fleet has it.

Grace period

Two days during which nobody can be forcibly restarted, regardless of the deadline. It exists for the person coming back from two weeks off, whose machine is behind on six updates and whose first action would otherwise be an unrequested reboot.

Pause: disable

The pause button is the most abused feature in Windows Update. Left available, it turns a patching policy into a suggestion.

Note that Option to check for Windows updates stays enabled. Taking away the pause is reasonable; taking away the ability to ask for updates is just annoying.

Auto install at maintenance time

This installs but does not restart on its own. What forces the restart is the deadline. It is the gentler of the two variants — the alternative, auto install and restart, does exactly what it says at a moment nobody chose.

Combined with active hours of 08:00 to 17:00, a restart never happens during the working day.

Pre-release builds

Assignment and verification

Assign the ring to the device group. Then, on a device: