Microsoft Defender Signature Update Fallback order for Co-managed Devices

[Abhishek_Pandey]

We have a Hybrid Infrastructure and have Windows 10 co-managed devices. AS per consideration we don't allow windows 10 devices to go directly to internet for Signature update as a first fall back. We wanted to do with the SCCM / WSUS server for the first fallback order for definition update. Need assistance on below point.

1. how can we define the fallback order as a Internal Definition Server in MS Defender policy from Intune. It showing only Internal definition update server not option to specify the server.

[#2]

Internal definition update server setting will use your on-prem WSUS as update source
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-protection-updates-...

[#3]

Thanks for the update I know this is way to configure the updates but how can we configure the Update server information in the configurations and one more thing if we can offload Windows update workloads for co-managed devices from SCCM what will happened.? updates is also happing from the WSUS / SCCM ? Kindly confirm