Intune Update Ring not applying to co-managed Windows 11 device

Those CoManagementHandler.log errors are definitely worth looking into. Especially the repeated “Could not find one of the mandatory rules” and 0x8000ffff messages. However I would not assume they are directly causing the Update Ring issue yet. I would first separate the co management workload evaluation from the actual Intune MDM policy delivery.

The fact that the Update Ring settings are not showing up under the Update Policy CSP or in the MDM diagnostics report makes me think the policy may not actually be reaching the device. If the policy was reaching the endpoint but one setting was failing I would expect to see some evidence of it locally.

I would check these things first.

1. Make sure the device is included in the Update Ring assignment and is not affected by an exclusion or assignment filter.
2. In Intune check the device specific policy status instead of only looking at the overall policy status. This can help show whether the whole policy is missing or only specific settings are failing.
3. Force an MDM sync and then check Event Viewer under DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Look for CSP activity around the time of the sync.
4. Check these registry locations:

HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update

and

HKLM\SOFTWARE\Microsoft\PolicyManager\providers

If there are no Update CSP values after a successful sync then I would look more closely at policy delivery.

1. Run dsregcmd /status and confirm that the Entra ID and MDM enrollment information looks healthy. Also check that there is no old or duplicate Intune enrollment.
2. On the Configuration Manager side verify that the Windows Update workload is actually switched to Intune for this device. I would also review CoManagementHandler.log around the time the workload is evaluated.
3. Check the Configuration Manager Software Updates client settings as well. Moving the workload to Intune does not always remove older Configuration Manager or WSUS settings.
4. Check for leftover WSUS or GPO settings under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

Pay particular attention to WUServer and WUStatusServer as well as any scan source settings.

The Microsoft Update connectivity issue is also worth treating separately. An Intune Update Ring only controls Windows Update settings. It does not provide the update service itself. The device still needs access to the required Microsoft Update endpoints.

I would also avoid manually creating the Update Ring registry values. First confirm whether Intune is actually sending the Update CSP commands to the device https://wordle-unlimited.app/blog/wordle-vowels. If you force a sync and still see no CSP activity then the issue is probably somewhere between the Intune assignment and MDM policy processing.

As a final test I would try refreshing or re enrolling the MDM enrollment on one affected test device. Then force another sync and check the PolicyManager registry and MDM event logs. If the Update Ring appears after a clean enrollment then that would strongly suggest an enrollment or policy processing issue.

Overall I would trace the process step by step from assignment to co management to MDM enrollment to CSP processing to the PolicyManager registry and finally to the Windows Update client. That should help identify exactly where the policy is being lost.