What is Microsoft's recommended way to prove that Intune Update Rings / WUfB are actually in control of a Windows 11 device?

We have devices where the Update Ring reports Succeeded, but Windows Autopatch reports “AU option settings conflict”, even though the legacy Windows Update Group Policy registry keys are no longer present.

Which client-side data should be considered authoritative for identifying the winning policy provider and actual update source, and for ruling out interference from legacy GPO, WSUS, RMM tools, or other management systems?

We are also testing the IgnoreWindowsUpdateGroupPolicies CSP, which succeeds on some devices but returns errors on others.