How to manage Windows Updates with Microsoft Intune

How to manage Windows Updates with Microsoft Intune? Updates are one of the most important things when considering a secure environment. But how can we mange Windows Updates with Microsoft Intune? The solution is Windows Update Rings which is directly integrated in the Microsoft Intune environment. In this blog post we will show you everything you need to know.

What are we going to set up?

In this blog post we will show you, How to manage Windows Updates with Microsoft Intune. We will have a look at the Update rings for Windows 10 and later in Microsoft Intune. We will have a look at all the settings you can configure and what the best practices are. We will also enable the Windows Update reporting so you have some good analytics directly in Intune. The reporting is not enabled on default so we need to enable it manually. After this blog post you will fully understand the Windows Update ring settings in Microsoft Intune.

• Step 1: Create a Windows Update Ring.
  In this step we will create the update ring in Microsoft Intune and configure the settings.
• Step 2: Activate Windows Update Reporting [optional]
  This optional step will allow you to have a good basic reporting of the Windows updates. You dont need to enable it, but I recommend it.
• Step 3: Additional Pop-up configurations [optional]
  For the End User Experience its sometimes difficult to schedule the device restart actions. In this step we will generate a new configuration policy which will leave the restart popup visible until the user has choosen an action. This will force the user to choose, when the update should be installed on the device.

How to manage Windows Updates with Microsoft Intune

Create a windows update policy

In this step we are going to create a new configuration profile in Microsoft Intune and deploy the policy to the users or devices. Just follow these steps:

• Go to intune.microsoft.com
• Click on Devices
• Click on Windows
• Click on Update rings for Windows 10 and later
• Click on Create profile

• Give it a meaningful name and description. 
  Some Ideas for good Names are for example Update Ring Production or Update Ring Early Bird.
• Click on Next

Now we can configure the settings for the update ring. In the table you will find a short description what the settings are. I will configure the settings which I found are the most useful.

For the User experience settings there are a lot of options. I will show you the one, which I found is the best option.

On the Assignments tab assign the policy to your group, users or devices. On the Review + create tab click on Create. Congrats, you have successfully deployed an update ring.

On the Update Ring Policy you will find the different options you can perform. You will also see some basic reports which are not really helpful. Because of that, we will enable some additional reporting in the next step.

Activate Windows Update Reporting [optional]

To enable some advanced reporting we will create a new configuration policy with the Windows health monitoring settings. Just follow the steps below.

• Go to intune.microsoft.com
• Click on Devices
• Click on Windows
• Click on Configuration profiles
• Click on Create and New Policy
• Choose Windows 10 and later for Platform
• Choose Templates for Profile type
• Search for the Windows health monitoring and click on Create.

IMPORTANT: If you already have the Windows health monitoring configuration you will need to edit the existent policy. Otherwise you will get a conflict error. Its mostly called Intune data collection policy.

• Give it a meaningful name and description. 
• Click on Next

On the configuration settings:

• Enable the Health monitoring
• In the scope choose Windows Updates

Now it can take some time until the reports are ready. You can find the Reports under Reports > Windows Updates.

Additional Pop-up configurations [optional]

Sometimes we had some problems with the automatic restarts. Some users just never restarted their device until it did it automatically. So I found a pretty neat setting which will leave the restart needed popup on the bottem right until the user has choosen an option. When a restart is required to install updates, the auto-restart required notification is displayed. By default, the notification is automatically dismissed after 25 seconds. With this setting we will change this.

To set this policy we will create a new configuration policy with the Restart Required Notification Dismissal.

• Go to intune.microsoft.com
• Click on Devices
• Click on Windows
• Click on Configuration profiles
• Click on Create and New Policy
• Choose Windows 10 and later for Platform
• Choose Settings catalog for Profile type

• Give it a meaningful name and description. 
• Click on Next

On the configuration settings do the following:

• Click on Add settings
• Search for Auto Restart Required Notification Dismissal
• Choose Windows Update for Business
• Enable Auto Restart Required Notification Dismissal
• Set the setting to User Dismissal. 

• Define your Scope if applicable and click on Next
• On the Assignments tab assign the Policy to a Group or to All User/Devices
• Click on Next
• And Review + Create the Policy

Conclusion

In this blog post, we have shown you How to manage Windows Updates with Microsoft Intune. We have created a new Windows update ring and configured the settings. In an optional step we enabled the additional reporting and had a look at the Auto Restart Required Notification Dismissal. We hope you found this blog post helpful and informative. If you have any questions or feedback, please leave a comment below. Thank you for reading!