Event details

Get answers to your questions about adopting Windows 11 and managing Windows devices across your organization. Find out how to proactively implement and monitor Zero Trust practices. Get tips on keeping devices up to date. Learn how to move forward with cloud-native workloads, even if you have on-premises or hybrid needs.

Windows Office Hours is our continuing series of live Q&A for IT professionals here on Tech Community.

How does it work?

We will have a broad group of product experts, servicing experts, and engineers representing Windows, Microsoft Intune, Configuration Manager, Windows 365, Windows Autopilot, security, public sector, FastTrack, and more. They will be standing by here -- in chat -- to provide guidance, discuss strategies and tactics, and, of course, answer any specific questions you may have.

Post your questions in the Comments early and throughout the one-hour event.

Note: This is a chat-based event. There is no video or live meeting component. Questions and answers will appear in the Comments section below.

Heather_Poulsen
Updated Dec 18, 2025
Office Hours

1 Comment

  • isamFER's avatar
    isamFER
    Occasional Reader
    Jan 18, 2026

    Hello All, thanks for this lovely collaboration with top notch engineers from MS directly, 

     

    We’re building an automated compliance pipeline for Intune / AVD–managed Windows 11 devices and need a programmatic, Microsoft-supported source for the current Patch Tuesday “B” CU baseline.

     

    Requirement (monthly, 2nd Wednesday):

    For each Windows 11 release (22H2, 23H2, 24H2, 25H2, future 26H2), determine:

     

    Expected CU KB

    Expected UBR

    Security revision

     

    This baseline is then used to compare against device-reported OS/UBR from Graph.

     

    Question:

    Is there an authoritative API or dataset (Graph, WUfB, Update Compliance, Intune internal metadata, or Microsoft Update) that exposes the current expected Patch Tuesday CU + UBR per OS version?

     

    Specifically:

     

    How does Intune internally determine “latest update installed / compliant”?

    Is KB → expected UBR mapping available programmatically?

    Is scraping Update History / Catalog the only option today?

    Any supported alternative or roadmap for exposing this via Graph?

     

    We want to avoid manual KB tables or HTML scraping.

     

    Looking for guidance from Intune / WUfB / Graph teams.