Intune Update Ring not applying to co-managed Windows 11 device

Those CoManagementHandler.log errors are definitely worth looking into. Especially the repeated “Could not find one of the mandatory rules” and 0x8000ffff messages. However I would not assume they are directly causing the Update Ring issue yet. I would first separate the co management workload evaluation from the actual Intune MDM policy delivery.

The fact that the Update Ring settings are not showing up under the Update Policy CSP or in the MDM diagnostics report makes me think the policy may not actually be reaching the device. If the policy was reaching the endpoint but one setting was failing I would expect to see some evidence of it locally.

I would check these things first.

1. Make sure the device is included in the Update Ring assignment and is not affected by an exclusion or assignment filter.
2. In Intune check the device specific policy status instead of only looking at the overall policy status. This can help show whether the whole policy is missing or only specific settings are failing.
3. Force an MDM sync and then check Event Viewer under DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Look for CSP activity around the time of the sync.
4. Check these registry locations:

HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update

and

HKLM\SOFTWARE\Microsoft\PolicyManager\providers

If there are no Update CSP values after a successful sync then I would look more closely at policy delivery.

1. Run dsregcmd /status and confirm that the Entra ID and MDM enrollment information looks healthy. Also check that there is no old or duplicate Intune enrollment.
2. On the Configuration Manager side verify that the Windows Update workload is actually switched to Intune for this device. I would also review CoManagementHandler.log around the time the workload is evaluated.
3. Check the Configuration Manager Software Updates client settings as well. Moving the workload to Intune does not always remove older Configuration Manager or WSUS settings.
4. Check for leftover WSUS or GPO settings under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

Pay particular attention to WUServer and WUStatusServer as well as any scan source settings.

The Microsoft Update connectivity issue is also worth treating separately. An Intune Update Ring only controls Windows Update settings. It does not provide the update service itself. The device still needs access to the required Microsoft Update endpoints.

I would also avoid manually creating the Update Ring registry values. First confirm whether Intune is actually sending the Update CSP commands to the device https://wordle-unlimited.app/blog/wordle-vowels. If you force a sync and still see no CSP activity then the issue is probably somewhere between the Intune assignment and MDM policy processing.

As a final test I would try refreshing or re enrolling the MDM enrollment on one affected test device. Then force another sync and check the PolicyManager registry and MDM event logs. If the Update Ring appears after a clean enrollment then that would strongly suggest an enrollment or policy processing issue.

Overall I would trace the process step by step from assignment to co management to MDM enrollment to CSP processing to the PolicyManager registry and finally to the Windows Update client. That should help identify exactly where the policy is being lost.

Have you confirmed enrollment status and join state for the impact device? For co-management you should use automatic enrollment. Please confirm if it is enabled at your Entra ID https://learn.microsoft.com/en-us/intune/device-enrollment/windows/enable-automatic-mdm

To avoid any policy conflict, configure controlpolicyconflict to set MDM wins over GPO https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict

Make sure that Intune endpoints and Windows update agent endpoints are whitelisted https://learn.microsoft.com/en-us/intune/fundamentals/endpoints?tabs=north-america 

I’d check the device’s workload/co-management settings first, especially which update workload is actually assigned to Intune. Then check for conflicting policies from ConfigMgr and confirm the device has synced with Intune recently. A policy conflict or workload not being switched over can make the update ring look like it’s being ignored.

This scenario was already addressed in the original post. I have already checked Configured update policies, Group Policy, local policy, WSUS, and the per-category scan-source settings. I am aware that the device isn't currently reaching Microsoft Update, but we haven't found an active on-premises update-source policy causing this behavior, so this does not appear to be the issue in this case.

Wua will not go over internet using the Windows Update for business channel if there is a policy for using on-prem update source. You can check the Windows Update->Advanced Options->Configuration update policies to verify if the policy provider is still showing as GPO\local policy etc. If that is the case, then you must address the source for conflicts.