Create Windows Update Rings in Microsoft Intune

Dylan Shade
23 steps
2 minutes

Microsoft

Navigate to [https://intune.microsoft.com/#home](https://intune.microsoft.com/#home)

Click "Devices"

Click "Windows updates"

Click "Update rings"

Click "Create profile"

Type in a Name and Description for your update ring and click "Next"

**Microsoft Product Updates** - Permits updates for other Microsoft apps including Office, Visual Studio, and other Microsoft Software. \ *Recommended Setting: Allow*

**Windows Drivers** - Determines if you want to allow driver updates via Windows update. *Recommended Setting: Allow - but also configure a driver update policy. I'll cover this in a future blog post and put the link here later.*

**Quality update deferral period (days)** - Specifies the number of days you want to defer quality updates for. Example, if you defer for 5 days, updates will be applied 5 days after being released by Microsoft, typically on patch Tuesdays. Max of 30 days. *Recommended Setting: Will vary per update ring*

**Feature update deferral period (days)** - Specifies the number of days you want to defer feature updates for. Example, if you defer for 5 days, updates will be applied 5 days after being released by Microsoft, typically on patch Tuesdays. Max of 365 days.\ \ *Recommended Setting: Will vary per update ring. - You'll also likely want to control feature updates via feature update policies, I'll cover this in a future blog post and put the link here later.*

**Upgrade Windows 10 devices to Latest Windows 11 release** - Updates devices to the latest Windows 11 release. \ \ *Recommended Setting: No*

**Set feature update uninstall period (2-60 days)** - How long you'll have the option to uninstall the recent feature update in case there are issues. The longer time period, the longer more disk space is used to hold update files. *Recommended Setting: 30 - if disk space is not an issue.*

**Enable pre-release builds** - Option for pre-release builds. *Recommended Setting: Not Configured - Unless you have specific needs for this, such as development.*

**Automatic update behavior** - How and when updates are installed.\ \ *Recommended Setting: Auto install and restart at a scheduled time - This way you can specify the update timing in this policy, rather than having a seperate maintenance hours policy.*

When you have **Auto install and restart at a scheduled time** set, you'll have options to set the behavior frequency, install days, and install time as seen below.

**Option to pause Windows updates** -Specifies if you want to allow end users to pause updates.\ \ *Recommended Setting: Disable*

**Option to check for Windows updates** - Specifies if you want to allow end users to check for updates manually.\ \ *Recommended Setting: Enable*

**Change notification update level** - Sets how and what notifications end users see. *Recommended Setting: Turn off all notifications, excluding restart warnings. - This will block all Windows update notifications, but still prompt users to restart when needed.*

**Use deadline settings** - Deadline updates must be installed by. *Recommended Setting:* \ *Deadline for feature updates: 30*\ *Deadline for quality updates: 2*\ *Grace Period: 2 - This specifies the amount of time after the deadline until the endpoint reboots automatically without giving any option to the end user to delay or schedule the reboot.*

**Auto reboot before deadline** - Reboots the device automatically during non-active hours to apply updates. *Reccomended Setting - Yes*

Click "Next"

Click Add groups and assign the update ring policy to your specified Entra ID security group.

Click "Create" to create your policy.

Create Windows Update Rings in Microsoft Intune

Dylan Shade
23 steps
2 minutes