Manage Windows Updates, Feature Releases and Drivers with Intune

Two layers behind the word 'updates'

Intune splits Windows update management into two jobs that are easy to blur together. The first is client behaviour. An update ring is a policy that tells Windows how to act on the device: deferrals, deadlines, grace periods, notifications and restarts. The second is approval. Feature update, quality update and driver update policies pass your decisions to Windows Autopatch, which decides which content a device may be offered. The device still downloads from Windows Update itself.

The split matters because the two layers fail differently. A ring cannot sensibly choose a Windows version for you, and a quality update policy cannot decide that a laptop should not restart during a client call. Surprise restarts are almost always a client-layer setting (or a hotpatch baseline month, covered below), not an approval problem.

One more thing to know before you start: if a device is not targeted by a policy for a given content type, it gets all the latest content from Windows Update. No policy means fastest, not safest.

Microsoft regularly updates the Windows updates experience in Intune, so check labels and available options in your tenant before assigning policies. Start with test devices and verify results before extending rollout.

Before you begin

The requirements differ between the two layers, and the licensing is the part that trips people up.

• Update rings need Microsoft Intune Plan 1. Feature, quality and driver update policies also need a Windows licence that includes the Autopatch entitlement.
• Microsoft's entitlement list (page dated 26 February 2026) names Microsoft 365 Business Premium, Windows Education A3 or A5, Windows Enterprise E3 or E5 (included in Microsoft 365 F3, E3 and E5) and Windows Enterprise E3 or E5 VDA. Microsoft 365 Business Basic, Business Standard and Windows Pro on its own are not on that list. In our reading that means those tenants are limited to update rings, but confirm with your licensing partner before you plan around it.
• Devices must be enrolled in Intune and either Microsoft Entra joined or hybrid joined. Entra registered devices are limited to update rings and Windows Update client policies.
• Driver update policies support Windows Pro, Pro Education, Enterprise and Education. Windows Enterprise LTSC is not supported for driver policies.
• Devices need diagnostic data set to Required or higher, the Microsoft Account Sign-In Assistant service (wlidsvc) not disabled, and access to Windows Update and Autopatch endpoints.
• Microsoft names the Policy and Profile manager role for driver policies, and Read Only Operator, Help Desk Operator or Endpoint Security Manager for viewing driver reports. Check the role needs for the other policy types in your tenant rather than reaching for Global Administrator.
• Three device groups in your lab: Test, Pilot and Production, with each device in only one of them. Assign to device groups rather than user groups so a policy applies without anyone signing in.

Test, pilot, production: the decision path

In a small organisation the point of rings is not statistics. It is making sure a bad update meets a spare laptop before it meets the finance team. For example, the Test ring might contain a spare VM and a couple of IT-owned devices, Pilot a handful of volunteers using different hardware, and Production the remaining devices.

Use this path to decide when anything moves on. The gates are our judgement, not Microsoft's, and every gate needs a named person to look at the reports.

• Test gets everything first: quality updates with no deferral, feature updates as soon as available, driver updates approved automatically so you can see what is coming. If Test shows failed installs, repeated restarts or a safeguard hold, stop there and pause the later rings.
• Pilot follows a day or two later for quality updates and a deliberate date for feature updates. Move on only if the reports show the update installed and nobody has raised a new fault.
• Production follows once Pilot is clean. For drivers, use manual approval in Pilot and Production and approve a driver only after it has behaved on Test.
• If anything goes wrong at any stage, pause first, investigate second. Rolling back is a last resort, and for some content it is not possible at all.

Create the update rings

Start with the rings because they decide how disruptive everything else feels. Microsoft recommends you stop using feature update deferrals in rings once you use feature update policies, so set both deferrals to 0 here and let the cloud policies do the staging. Where a cloud quality update policy applies, its deferral overrides the ring's quality deferral rather than adding to it, and ring deadlines and grace periods still apply.

The following values are an example starting point for a staged rollout. Microsoft documents the ranges (deadlines 2-30 days, grace period 0-7 days) but not these specific choices. Test: quality deadline 2 days, feature deadline 7 days, grace period 1 day. Pilot and Production: quality deadline 3 days, feature deadline 7 days, grace period 2 days.

Avoid the setting 'Auto install and reboot without end-user control' and avoid turning off all notifications including restart warnings. Those two are the usual routes to a restart nobody saw coming. 'Auto install at maintenance time' is gentler but Microsoft notes users are prompted for up to seven days and then a restart is forced.

1. In the Microsoft Intune admin center, go to Devices, then By platform, then Windows, then Manage updates, then Windows updates. (Some Microsoft pages abbreviate this path to Devices, then Windows, then Windows updates; follow whichever your tenant shows.)
2. Select the Update rings tab, then Create profile. Name the first one something plain such as Lab - Ring Test.
3. On Update ring settings, under Update settings, set Microsoft product updates as you prefer and set Windows drivers to Allow. A ring set to Block stops driver updates from installing, which would silently undermine the driver policy later. Set Quality update deferral period (days) to 0 and Feature update deferral period (days) to 0. Leave Set feature update uninstall period (2 - 60 days) at a value you can live with, because it decides how long a feature update can be rolled back.
4. Under User experience settings, set Automatic update behavior to Reset to default, which lets Windows choose active hours and the best install time. Set Use deadline settings to Allow, enter the deadlines and grace period for this ring, and set Auto reboot before deadline to Yes so restarts happen when the device is not in use. Set Change notification Update level to Use the default Windows Update notifications.
5. Consider setting Option to pause Windows updates to Disable. That is our judgement: it stops individual users postponing patching, while you keep the admin Pause in the portal.
6. Select Next through Scope tags, then under Assignments choose Select groups to include and pick the matching device group. Review the settings and select Create. Repeat for Pilot and Production, changing only the deadlines and group.
7. Open each ring and check that the overview shows the group assigned. Policy reaches devices at their next check-in, which is not instant.

Quality updates and hotpatch

Quality update policies are the newer, cloud-based way to approve the monthly cumulative updates and supported .NET Framework updates. Microsoft's quality update page (dated 20 October 2026) describes four approval categories you set independently: monthly security updates, monthly non-security preview updates, out-of-band security updates and out-of-band non-security updates. Microsoft's Windows message centre lists this as rolling out from 1 September 2026 to all tenants by 15 October 2026, so a tenant that still shows the old experience is worth a question to Microsoft rather than a workaround.

Monthly security updates can be approved automatically while other update types are reviewed before release. In Make updates available after, choose a delay from 0 to 30 days; Microsoft suggests keeping quality deferrals under three days. Example approval delays are 0 days for Test, 1 day for Pilot and 2 days for Production. Use out-of-band security updates with the same automatic approval and no delay, which is our judgement because those releases are usually urgent.

Two cautions. You cannot change the approval method on an existing policy, so a wrong choice means a new policy. And if you pick manual approval for monthly security updates, nothing is offered until someone approves it. A manual setting without an owner is just a slow way to go unpatched.

Hotpatch deserves its own paragraph because it changes restart behaviour. Hotpatch installs monthly security updates without a restart. Microsoft says Windows Autopatch turns it on by default for eligible devices, starting with the May 2026 security update, and that it applies to devices that are not members of a quality update policy. A device in a policy follows the policy's hotpatch setting. Eligibility is not universal: Microsoft lists Windows 11 24H2 or later, virtualization-based security running, being on the latest baseline update, and one of Windows 11 Enterprise E3/E5, Microsoft 365 F3, Windows 11 Education A3/A5, Microsoft 365 Business Premium or Windows 365 Enterprise. Ineligible devices get the standard cumulative update instead.

The catch is the baseline. Microsoft's cycle has a restart-requiring baseline update in January, April, July and October, and hotpatch months in between. So hotpatch means fewer restarts, not none. Two knock-on effects: approving a non-security preview update for a hotpatch-enabled device means the device will not receive it, and upgrading a device to a new Windows version in a hotpatch month switches it to standard updates until the next baseline.

1. Go to Devices, then Manage updates, then Windows updates, then the Quality updates tab. Select Create, then Windows quality update policy.
2. Under Basics, name the policy for its ring, for example Lab - Quality - Test.
3. Under Settings, choose automatic approval for monthly security updates and out-of-band security updates, and set Make updates available after to the ring's number of days. Set non-security updates to manual approval. Set the hotpatch option to Allow if you want eligible devices to use it, or Block to opt that group out. Microsoft's pages word that label slightly differently, so look for the one that mentions Hotpatch.
4. Choose Scope tags or leave Default, assign the matching device group, review and select Create. Repeat for the other two rings.
5. To opt a whole tenant out of the hotpatch default instead, Microsoft's announcement places the toggle under Tenant administration, then Windows Autopatch, then Tenant management, then the Tenant settings tab. This only governs devices that are not in a quality update policy.
6. When a manually approved release appears, go to Quality updates, then Manage updates, select the release name to read its severity and KB details, select the X of Y figure under Approved policies and approve the Test policy first. Approve Pilot and Production only after Test looks clean. Policies still waiting are marked Needs review.

Feature updates: lock a version, then release it on dates

A feature update policy names a Windows version and keeps devices at that version until you change or delete the policy. It does not downgrade devices, and it stays in force until you edit it, unlike an update ring pause, which expires after 35 days. When a feature update installs, the latest applicable monthly quality update is included. If a device is targeted by several policies, Windows Update offers only the latest applicable version.

Rollout options control when the offer appears. You can make the update available as soon as possible, on a specific date, or gradually. The gradual option sounds ideal, but Microsoft says offer groups are kept evenly sized with a minimum of 100 devices each, so in a small organisation it gives you little staging. Our recommendation is three policies, each with its own date, rather than one gradual rollout.

If you ever move from ring deferrals to feature update policies on an existing estate, create the policy first, wait for Windows Update to process it, confirm devices show OfferReady in the feature update report, and only then set the ring's Feature update deferral to 0. Otherwise a device that scans in the gap can be offered something you did not intend.

1. Go to Devices, then Windows, then Windows updates, then the Feature updates tab, and select Create profile.
2. Under Deployment settings, enter a Name and choose the version from Feature update to deploy. Only versions still in support are listed. Pick the release you have validated in Test, not simply the newest.
3. Choose Make available to users as a required update so devices install it automatically according to their ring settings. The optional choice leaves the install to the user and needs an Autopatch licence.
4. Under Rollout options, use Make update available as soon as possible for Test. For Pilot and Production use Make update available on a specific date, with Pilot at least a couple of weeks ahead of Production to allow time to identify problems. Consider timing the dates around a baseline month (January, April, July or October) so hotpatch devices stay on their cycle.
5. Assign the matching device group, review and select Create. Repeat for the other two rings.
6. Windows Update normally evaluates a new or changed policy within about 10 minutes, though it can take longer. Wait before changing anything else on those devices.

Driver updates: approve rather than hope

Driver update policies list the driver and firmware updates Windows Update considers applicable to devices in the policy and let you approve, decline or pause each one. The list is not an inventory of installed drivers. Windows Update only installs a driver that is newer than what is already on the device, so a policy will not downgrade anything.

Automatic approval deploys each new recommended driver after a deferral you set (0 to 30 days, counted from when the update is added to the policy). Manual approval leaves everything at Needs review until you approve it, optionally with a start date. Anything that is not the recommended driver, including firmware, always needs manual approval. You cannot change the approval type after creation, and Microsoft advises targeting each device with only one driver policy so a driver declined in one is not approved in another.

For driver updates, start with automatic approval after 0 days for Test and manual approval for Pilot and Production. There is no rollback for drivers in these policies, which is the whole argument for letting Test see them first. If your vendor offers device-specific drivers you rely on, note that Microsoft says these policies do not enforce OEM hardware ID targeting, so a device can receive a newer recommended version instead.

1. Before creating anything, check your update rings and any Settings catalog policies. In a ring, Windows drivers must be Allow. In the Settings catalog, Exclude WU Drivers in Quality Update must be set to Allow Windows Update drivers.
2. Go to Devices, then Windows updates, then the Driver updates tab, and select Create profile.
3. On Basics, enter a Name and a Description. On Settings, choose Automatically approve all recommended driver updates and set Make updates available after (days) to 0 for Test. For Pilot and Production choose Manually approve and deploy driver updates.
4. Skip or set Scope tags, assign the matching device group, review and select Create. Devices must be assigned and the policy saved before Autopatch can add applicable drivers to its list, so give it some time.
5. Later, in a manual policy, open the policy, use the Recommended drivers and Other drivers tabs to review items marked Needs review and select Approve or Decline. When approving, Make available in Windows Update sets the start date. Bulk actions can approve, pause or decline up to 100 drivers at a time, but you cannot mix actions in one go.

Check it worked

Reports lag behind reality. Microsoft says service-side feature update data usually arrives in under an hour, while client-side data refreshes in batches roughly every eight hours. Do not conclude a rollout is broken because a report is empty five minutes after you save a policy.

All of the checks below are read-only. The device-side commands run in PowerShell on the Test device and need no administrator rights. The Graph example reads update ring settings only and does not change anything.

1. Open each update ring from Devices, then Windows updates. Check the Device and user check-in status tile, and open Device assignment status and Per setting status to confirm the Test device has the settings you expect.
2. For feature updates, go to Reports, then Windows Updates, select Windows Feature Update Report, choose your profile and select Generate report. A healthy device shows an Update State of OfferReady or later. If Last Scan Time is old, the device has not looked for updates recently. Devices > Monitor > Feature update failures shows any alerts.
3. For drivers, go to Reports, then Windows Updates, the Summary tab and the Windows Driver updates section for per-policy counts of Success, In progress, Paused, Error, Cancelled and NeedsReview. Devices > Monitor > Driver update policies with alerts shows failures. In Devices > Windows updates > Driver updates, the Drivers to review column shows new items waiting for you.
4. For quality updates, open Devices, then Manage updates, then Windows updates, then Quality updates, then Manage updates, and check the Approved policies figure for the current release. Microsoft's rollout notice also points to a Quality update status report; look under the Reports area for it; its location may vary between portal versions.
5. On the Test device, open Settings, then Windows Update, then Advanced options, then Configured update policies. If hotpatch is on, you should see Enable hotpatching when available listed.
6. Still on the Test device, run the following in PowerShell. It reads the Windows release and lists the most recent installed updates. It does not change anything, though Get-HotFix may not list every update, so Update history in Settings is the fuller view.
   powershellCopy

   (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
   Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5

7. Optionally, from an admin workstation with the Microsoft Graph PowerShell SDK installed, run the script below. It signs in interactively with the read-only DeviceManagementConfiguration.Read.All permission, follows paging and lists update ring settings including deferrals, pauses and deadlines. It lists update rings only, not the newer cloud-based quality, feature or driver policies, so use the portal for those. Disconnect afterwards.
   powershellCopy

   Connect-MgGraph -Scopes 'DeviceManagementConfiguration.Read.All'
   $uri = 'https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations'
   $rings = @()
   while ($uri) {
       $page = Invoke-MgGraphRequest -Method GET -Uri $uri
       $rings += $page['value'] | Where-Object { $_['@odata.type'] -eq '#microsoft.graph.windowsUpdateForBusinessConfiguration' }
       $uri = $page['@odata.nextLink']
   }
   $rings | ForEach-Object {
       [pscustomobject]@{
           Name                = $_['displayName']
           QualityDeferralDays = $_['qualityUpdatesDeferralPeriodInDays']
           FeatureDeferralDays = $_['featureUpdatesDeferralPeriodInDays']
           QualityPaused       = $_['qualityUpdatesPaused']
           FeaturePaused       = $_['featureUpdatesPaused']
           QualityDeadlineDays = $_['deadlineForQualityUpdatesInDays']
           FeatureDeadlineDays = $_['deadlineForFeatureUpdatesInDays']
           GracePeriodDays     = $_['deadlineGracePeriodInDays']
       }
   } | Format-Table -AutoSize
   Disconnect-MgGraph

Pause, recover and when updates do not arrive

Each layer has a different brake, and they behave differently. Know which one you are reaching for before an incident, not during it.

Lab note: none of the recovery actions below were exercised in a real tenant for this article, so rehearse them on the Test ring first.

• Update ring Pause: select Pause on the ring, then Feature or Quality. It lasts up to 35 days and then expires. Devices only learn about it at their next check-in, and a device that was off may install a scheduled update first. Resume restores updates and Extend resets the period to 35 days. A ring pause of feature updates also stops feature offers.
• Update ring Uninstall: this rolls back the latest feature or quality update and is the most disruptive control here. Microsoft says devices start removing the update as soon as they receive the policy, outside maintenance schedules, and restart without offering the user a delay. It also pauses that update type on the ring, and the update can reinstall once the pause lapses. Feature updates can only be uninstalled within the ring's uninstall period (2-60 days) and not when installed via an enablement package. Tell people first and prefer Pilot devices.
• Quality update policy: pause a single release from Quality updates, then Manage updates, select the release, the X of Y under Approved policies, choose the policies and select Pause. Approval is revoked so no new devices receive it, but devices that already installed it are not rolled back. Devices can take up to eight hours to apply a pause. Re-approve to resume.
• Feature update policy: Microsoft's page lists Delete and Edit but we found no documented pause action. You can edit rollout dates or remove the assignment, and Windows Update attempts to retract the offer from devices that have not started processing it. A device in a safeguard hold will not receive the update until Microsoft clears the hold.
• Driver update policy: pause an individual driver. Pausing does not undo a completed install. If an older version is still approved, Windows Update can start offering that older version, so check what else is approved.
• Hotpatch: there is no automatic rollback, but a hotpatch update can be uninstalled and the standard cumulative update installed. That needs a restart.
• Policy removed or unassigned: a device no longer in any quality update policy stays enrolled in Autopatch for 24 hours, then falls back to its client settings.
• Nothing arrives on a device: check the device is Entra joined or hybrid joined rather than only registered, that the Microsoft Account Sign-In Assistant service is not disabled, that diagnostic data is at least Required and that the device has scanned recently. The feature update report shows Not scanned yet until a user signs in and a scan runs.
• Drivers never appear: check Windows drivers in the ring is Allow, that the device is in exactly one driver policy and that the policy has been saved with the device assigned.
• Hotpatch not applying: check virtualization-based security is running, the device is on the latest baseline and the policy hotpatch setting is Allow. Ineligible devices are not an error, they simply get the standard update and restart.