Windows Update Rings, Feature and Quality Updates

What it is

Windows updates in Intune use Windows Update for Business policies. Update rings control how and when updates install (deferrals, deadlines, restarts). Feature update policies pin devices to a Windows version. Expedite policies push an urgent quality update. You combine these with deployment rings (pilot, broad) to roll updates out in stages.

How it works

Planning for updates

Define deployment rings: a small test group, a pilot of representative users, then broad groups. Give each ring its own update ring policy with a longer deferral as the ring gets larger. Use device groups and assign a ring to each. Keep a clear rollback or pause option. Confirm that devices meet hardware and storage needs, and that the network can handle the downloads (see Delivery Optimization).

Update rings

Create an update ring under Devices, Windows updates, Update rings.

Deadlines count from the time the device first detects the update. The grace period applies to automatic restarts. A manual restart does not wait.

Feature update policies

A feature update policy sets the target Windows version (for example Windows 11 25H2). Devices in scope move to that version and then stay on it, with no further feature updates, until you change the policy. You can choose rollout options: make available as soon as possible, or start on a date and spread out with a gradual rollout (groups of devices over days). Microsoft recommends feature update policies instead of feature deferrals in rings. If you use a policy, set the ring's feature update deferral to 0, so the ring does not hold it back. Restart behaviour and deadlines still come from the ring.

A feature update policy requires devices to be Windows 10 or 11 Pro, Enterprise or Education, and a Windows 10 and later feature updates policy can also upgrade Windows 10 to Windows 11.

Quality updates and expedite policies

Quality updates are the monthly security releases. Deferral and deadlines in the update ring control them. For an urgent fix that cannot wait, use an expedite policy (Windows updates, Quality updates):

• It targets one specific update and installs it as soon as possible, bypassing deferrals.
• You choose how long after install a forced restart happens, from 0 to 2 days.
• It does not change how future quality updates deploy.
• Some ring settings block expedites: leave Enable pre-release builds as Not configured, set Automatic update behavior to Reset to default, and do not choose Turn off all notifications for change notifications.

Microsoft says expedite is not for routine monthly servicing. Use deadlines in an update ring for that.

Driver and other updates

Intune also has driver update policies, where you approve driver updates by category, and Windows Update for Business reports for status. Office and Microsoft Store updates follow their own settings.

Monitoring

Reports, Windows updates show update ring status and the feature update and quality update reports (by device and by update). For Windows Update for Business reports in a Log Analytics workspace, use the workbook. Check Per setting status for conflicts.

A worked scenario

A company defines three rings: Test (10 devices, quality deferral 0), Pilot (200 devices, 3 days) and Broad (everyone else, 7 days). Each ring has a deadline of 3 days for quality updates and a 2 day grace period. A feature update policy moves everyone to Windows 11 25H2 with a gradual rollout, and the ring feature deferral is set to 0. When a zero day vulnerability appears, the admin creates an expedite policy for that update with a one day restart.