Windows updates¶
Intune manages Windows updates through Windows Autopatch, which is now built into Intune. You don't need to adopt every Autopatch feature, but it helps to understand the pieces and which one controls what.
Find everything under Devices > Manage updates > Windows updates, and tenant-wide Autopatch settings under Tenant administration > Windows Autopatch.
The pieces¶
| Policy | Controls | Think of it as |
|---|---|---|
| Update rings | Client behavior: deferral days, deadlines, grace period, restarts, active hours, notifications, pause | How and when the device installs |
| Feature update policies | Which Windows version a device may move to, with optional gradual rollout | Which version |
| Quality update policies | Approval of monthly security and non-security updates, hotpatch, and quick machine recovery | Which monthly updates |
| Expedite policies | Push one specific security update now, with a restart deadline of 0 to 2 days | Emergency patching |
| Driver and firmware update policies | Review and approve drivers and firmware from Windows Update, manually or automatically | Which drivers |
| Autopatch groups | Automatically split devices into rings and create the matching policies for each ring | Ring automation |
Autopatch groups or your own rings, not both
If you use Autopatch groups, Autopatch creates and maintains the update rings for those devices. Don't also assign your own update rings to the same devices.
A sensible ring design¶
| Ring | Who | Quality deferral | Quality deadline | Grace period |
|---|---|---|---|---|
| Test | IT test devices | 0 days | 2 days | 1 day |
| Pilot | About 5% of users, a cross-section of hardware and departments | 2 days | 3 days | 2 days |
| Broad | Everyone else | 5 days | 3 days | 2 days |
| Sensitive (optional) | Devices where a surprise restart is costly, such as lab or production-line PCs | 7 days | 5 days | 2 days |
Microsoft's guidance is that deferral plus deadline plus grace period should keep the gap between release and installation to about 7 days or less for quality updates. Longer than that leaves you exposed to vulnerabilities that are already being exploited.
Other update ring settings worth setting deliberately:
- Automatic update behavior: Reset to default lets Windows choose restart times intelligently. Combine it with deadlines rather than forcing restarts at fixed times.
- Active hours: set to your working day so automatic restarts avoid it before the deadline.
- Option to pause Windows updates: disable it, so users can't pause security updates.
- Feature update uninstall period: 10 to 30 days gives you a rollback window after a feature update.
Controlling Windows versions¶
Use feature update policies to choose the Windows version each group runs, for example to hold devices on Windows 11 24H2 while you test 25H2, or to move Windows 10 devices to Windows 11.
Set the update ring's feature deferral to 0 when you use feature update policies
Combining feature update deferrals in rings with feature update policies can delay or block feature updates. Create the feature update policy first, wait until targeted devices show OfferReady in the Windows feature updates report, then set Feature update deferral period (days) to 0 in the matching update rings. Also make sure feature updates aren't paused in the ring.
Things to know:
- Feature update policies don't apply during Autopilot setup. They take effect at the first Windows Update scan after provisioning.
- Safeguard holds block a feature update on devices with a known compatibility issue. The feature update report shows which devices are held and why. Don't override safeguard holds unless you've tested the specific issue.
- Feature updates need the Microsoft Account Sign-In Assistant service (
wlidsvc) to be running. If a hardening script or baseline disables it, Windows Update stops offering feature updates while quality updates continue.
Hotpatch¶
Hotpatch installs monthly security updates without a restart in most months. Windows Autopatch turns hotpatch on by default for eligible devices. Control it with the tenant setting under Tenant administration > Windows Autopatch > Tenant management > Tenant settings, or per group with a quality update policy (When available, apply without restarting the device ("Hotpatch")).
Devices are eligible when they:
- run Windows 11 version 24H2 or later,
- have Virtualization-based security (VBS) turned on,
- are on the current quarterly baseline update (baseline months still need a normal restart),
- and have a qualifying license (Windows 11 Enterprise E3/E5, Microsoft 365 F3, Windows 11 Education A3/A5, Microsoft 365 Business Premium or Windows 365 Enterprise).
Ineligible devices simply get the normal cumulative update. Arm64 devices also need compiled hybrid PE usage (CHPE) turned off.
Expediting an emergency update¶
When a zero-day lands, use an expedite policy (Devices > Manage updates > Windows updates > Quality updates > Create > Expedite policy):
- Select the security update by release date. One policy covers all supported Windows versions.
- Set number of days before a restart is enforced: 0, 1 or 2. Zero restarts as soon as the update installs, with little warning.
- Assign it to the devices that need it, usually everyone.
- Remove the policy once the update is deployed or superseded.
Expediting uses push notifications, so devices start without waiting for their normal scan, as long as they're online.
Drivers and firmware¶
Driver update policies let you approve drivers and firmware from Windows Update instead of letting every device take every driver.
- Automatic approval of recommended drivers is the low-effort option for most fleets.
- Manual approval suits regulated environments or hardware with a history of bad drivers.
- If you manage drivers some other way (OEM tools, Configuration Manager), set Windows drivers to Block in update rings so Windows Update doesn't install them too.
Windows 10 and ESU¶
Windows 10 reached end of support on October 14, 2025. Without Extended Security Updates (ESU), Windows 10 devices no longer get security fixes. Intune still lets Windows 10 devices enroll and apply eligible features, but Microsoft doesn't guarantee functionality.
| ESU year | Coverage ends |
|---|---|
| Year 1 | October 13, 2026 (ended) |
| Year 2 | October 12, 2027 |
| Year 3 | October 10, 2028 |
What to do:
- Upgrade what you can. Target eligible Windows 10 devices with a Windows 11 feature update policy, in rings.
- Find what you can't. The Work from anywhere and Windows 11 readiness reports in endpoint analytics show devices that fail hardware requirements.
- Cover the rest with ESU. Commercial ESU needs Windows 10 version 22H2 with the required servicing updates, and an ESU key activated on each device (a script or remediation works well). Devices used to access Windows 365 Cloud PCs get ESU entitlement through Windows 365.
- Track ESU devices yourself. Microsoft's admin tools don't give you a complete per-device ESU report.
Other update traffic¶
- Microsoft 365 Apps: choose an update channel (Monthly Enterprise Channel is the usual enterprise choice) with a settings catalog profile, or let Autopatch manage Microsoft 365 Apps updates.
- Microsoft Edge and Teams: both update themselves. Autopatch can manage Edge's progressive rollout.
- Delivery Optimization: configure download mode, peer caching and Microsoft Connected Cache in the settings catalog so thousands of devices don't download the same update over your WAN.
Troubleshooting¶
| Symptom | Likely cause |
|---|---|
| Devices never get updates, or get updates from WSUS | Leftover Group Policy pointing at WSUS (HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, values such as WUServer), or the Configuration Manager Windows Update workload still owned by Configuration Manager |
| Feature update stuck "in progress" | Ring feature deferral not set to 0, feature updates paused, safeguard hold, or wlidsvc disabled |
| Users complain about surprise restarts | Deadlines too short or grace period 0. Check active hours and the restart notification settings. |
| Device shows as not up to date in reports | Reporting lags. Check the device itself with Settings > Windows Update > Update history before escalating. |
Reports live under Reports > Windows updates and the Windows Autopatch reports.