Setting up Windows Update for Business via Microsoft Intune

[Aria Carley]

Ensure your devices, whether at work or remote, are kept protected and keep end useres productive. Commercial customers can manage Windows Updates on-premises or from the cloud today using Microsoft Endpoint Manager. In this presentation, we will guide you through the options available for managing updates and monitoring their deployment from the cloud with Microsoft Endpoint Manager and Microsoft Intune.

[yogesh2215]

@Aria Carley  amazing content. Thank you. 

[ThBator]

Hello @Aria Carley thanks for the great presentation! One question: is there any guidance available on how to transfer from Update Rings to Feature Update Deployment policies?
Example: A user group currently has a deferral period of 180 days defined, keeping them on version 1909. If we assign a Feature Update Deployment policy to the same group targeting 2004, but not yet change the deferral period, will they get the update assigned? Or only when I change the Update Ring setting to 0 day feature deferral? Thanks!

[Aria Carley]

Hello @ThBator, thanks! In terms of transitioning from Update Rings to Feature Update Deployment policies, I'd recommend the following:

[Initial State] Update Rings Feature Update Deferrals = 180 days 

Step 1. Enable the Feature Update Deployment policy to 2004 for the desired group of devices. 

Step 1a. Give the policy enough time to apply, you want to avoid a race condition. :) 

Step 2. Change your Update Rings Feature Update Deferrals to 0 days (you can leave your Quality Update Deferrals at whatever you have previously configured for your monthly updates). 

That's it. Your device will now move to and/or stay on whatever version you have specified in the Feature Update Deployment policy. 

To your question, today in Intune deferrals will still apply in the sense that you will not be able to move to a specified version that has been released for a shorter amount of time than the specified deferral days. Please note, we understand this is confusing and are working on changing such in Intune for the future. :)

[ThBator]

Thanks for the explanation@Aria Carley, that makes sense! One further feedback point on the Feature Update Deployment feature, not sure if you're the right person for this – happy to address this somewhere else as well: 

We wanted to try the feature with release 2004 already, but in our tenant the new version wasn’t available in the dropbox selection until ~30 days after the official release. This led to us needing to check every 2 days if the new version is now selectable, since we had the pilot users ready. It would be good to either:

• Have the new version selectable on the official release date (which would be my personal preference)
• Have a notification somewhere(?) that a new Feature Update version is now available in the tenant.

[Aria Carley]

@ThBator that is great feedback! Thank you for sharing. We will take steps to ensure a better experience in that scenario for future. :)

[Thomas Førde]

@Aria Carley Hi Aria, maybe you can help me point me in the right direction figuring out where i can determine why update status is failed on the update ring. I have attached a screenshot from one of the rings as an example.

Both devices are on the correct version, they have the correct quality update version, but one of them is status failed. Been trying to google and go though many of the blogs/tech/docs of Microsoft but i cant seem to find where to look and why its failed. 

[Aria Carley]

@Thomas Førde thank you for reaching out! I'm sorry you are having problems with reporting. Do you utilize Update Compliance? If so, you should be able to drill into more information as to what update the device failed to take and why. 

Do both devices have the same Quality Update deferrals? If not, the one with a failure may have scanned and failed to take the next update. I will also look into the Intune reporting to note if we have any open bugs that may be causing this problem. 

That said, it does look like your devices are both in a healthy state, so that is a positive. :) 

[Thomas Førde]

@Aria Carley thanks for replying back.

This is an ongoing issue with basically every update ring available.

I have one ring that is fully automated that i use for kiosk devices..

Every device is Version 2004, and every device is reporting in the latest version installed. just like this one. Devices are okey, they are running latest update, this month is not released until next week. Yet so many display failed for unknown reasons. 

In update compliance blade they all look OK, I have compared 2 of the devices in the Update compliance blade, and they both look exactly the same, only difference is basically the computerID.

So i dont know where to look for reasons why they display failed.