My greatest Intune Fear is a bad driver from Windows Update. We buy "clean" Autopilot enrolled Windows PCs and allow Windows Update to manage drivers. After the release of Driver Update policies (thank you!), we implemented two "rings"; automatic approval after a 0 day deferral, for our canary PCs; automatic approval after a 30 day deferral, for the rest of our PCs. The problem is, how to determine it is a driver causing a problem in time to hit the pause button. The logs collected by Intune are sparse and obtuse. The driver IDs in WindowsUpdate.log do not match the Microsoft Update Catalog. And then, what do you do if you miss the window to pause the roll out. There is no roll back. The driver will have been saved to the driver store and will survive a wipe -- like a zombie. Scary!