Windows Update for Business WUfB using Intune

In this post, we will learn how to configure Intune Windows Update for Business WUfB to patch Windows 10 & Windows 11 devices managed by Intune

Pre-requisites

The following subscriptions are required:

• Microsoft Intune Plan 1 subscription.
• Azure AD Free (or greater) subscription.

Apart from Intune & Azure licenses device level license is also required:

• Windows 10/11 Enterprise E3 or E5
• Windows 10/11 Education A3 or A5
• Windows Virtual Desktop Access E3 or E5
• Microsoft 365 Business Premium

Following Windows Editions is mandatory

• Pro
• Enterprise
• Education
• Pro for Workstations

Windows Device Requirements correlation with licenses:

• It will work only on Windows 10 and Windows 11 running a version in which Microsoft support is available.
• Your device should be enrolled in Azure AD. Learn how to enroll Windows 11 devices in Intune.

General recommendation

What we usually recommend:

Minimum of 3 Update rings, which are:

• Test machine deployment ring, with a few IT people only
• All user’s deployment ring, deploy an update to all business users
• VIP & Mission critical systems deployment ring

As per three rings, deployment should be released as below:

• Test machine deployment ring, release on the same date (2^nd Tuesday of the Month)
• All user’s deployment rings, release on the 3^rd Tuesday of the month.
• VIP & Mission critical systems deployment ring, release on the 4^th Tuesday of the month

Create Windows Update rings

• Go to Microsoft Endpoint Manager admin center
• Click on Devices, select Windows 10 Update rings

• Click on Create profile for new ring creation, provide Name and Description

• In Update Ring settings, make the following changes
  • Serving channel – Semi-annual
  • Microsoft product update: Yes
  • Windows Drivers: Yes (if you want to update the drivers at the same time).

• Click on Next and set scope tags

• Set the Assignments as per your deployment plan
• Review and save

This is how we can create other rings, different will be deferral days which you can set. The second ring deferral day will be 7 days and the third ring deferral day will be 14 days.

When you click on each ring you will get the status of update deployment.

Check out more about Intune & I have a specific section for Windows troubleshooting  I hope you will like to explore.

Always check the Microsoft Learn website for new study programmes.