How to Configure Windows Update Rings in Intune with Reboot Notifications

What is a Windows Update ring?

A Windows Update ring is an Intune policy that controls when and how Windows quality and feature updates are downloaded and installed on managed devices. It replaces the old Group Policy-based Windows Update for Business settings and is the recommended approach for any Intune-enrolled estate.

The ring model lets you stagger updates across your fleet. A typical setup has three rings:

• Pilot ring - a small group (IT team, testers) who get updates first
• Broad ring - most of the business, 7-14 days after pilot
• Slow ring - critical systems, maximum deferral

This guide focuses on the Broad ring configuration, which covers the majority of devices. The same settings apply to all rings - you just adjust the deferral days.

Create the Update Ring in Intune

1. Go to Devices → Windows updates → Update rings for Windows 10 and later
2. Click + Create profile
3. Give it a name - something like WIN-UPDATE-BROAD works well for a naming convention
4. Add a description so other admins know what it does
5. Click Next to get to the settings

Update deferral settings

These settings control how long after Microsoft releases an update before it gets pushed to your devices. The Broad ring has a short deferral so devices stay current, but with enough buffer to catch any bad patches on the Pilot ring first.

User experience and restart settings

This is the section that controls what the user sees. The goal is to give them fair warning - enough chances to restart at a convenient time - but make the restart unavoidable once the deadline passes.

Deadline and auto-restart enforcement

The deadline is the hard cutoff. Once it passes, the device will restart automatically at the next scheduled maintenance window - even if the user is logged in. This is non-negotiable and is intentional.

What the user actually sees

Here is the sequence of events from the user's perspective after a quality update installs:

Here is what the toast notification looks like to the user:

Assign and deploy

Once your settings are configured, go to the Assignments tab.

1. Under Included groups, add your target device or user group - for example INTUNE-DEVICES-BROAD
2. If you have any devices that should be excluded (kiosks, shared devices, conference room machines), add them under Excluded groups
3. Click Review + create then Create

Monitor compliance

After deploying, check that devices are picking up and applying updates correctly.

Click on your Update Ring policy and select Device status. You will see a breakdown of devices by status:

• Succeeded - update applied, no restart needed or already restarted
• In progress - update downloading or installing
• Pending restart - update installed, waiting for the user to restart
• Error - something went wrong on this device
• Not applicable - device does not match the policy scope

You can also check individual device update status under Devices → Windows devices → [Device name] → Windows update. This shows the currently installed version and any pending updates.

Troubleshooting

Device not picking up the Update Ring policy

Force an Intune sync on the device. Go to Settings → Accounts → Access work or school → [Account] → Info → Sync. Alternatively, run the following in PowerShell as administrator:

Start-ScheduledTask -TaskName "\Microsoft\Windows\WindowsUpdate\Scheduled Start"

User says they keep getting restarted at inconvenient times

Check whether Active Hours are configured. Active Hours tell Windows not to restart during working hours. You can set these in the Update Ring under Active hours start and Active hours end. Set to your business hours - for example 8am to 6pm. The device will then only auto-restart outside those hours.

Update Ring not showing in device policy list

Check that the device is in the assigned group. Go to Intune → Devices → [Device] → Group membership and confirm the target group is listed. If the device is Entra-joined but not Intune-enrolled, the policy will not apply.

Device showing old OS version despite policy being assigned

Check the device's Windows Update for Business status in the Admin Centre. If the update is deferred, it may not have been offered yet. Also confirm that the device has internet access and can reach Windows Update endpoints. Devices behind a strict proxy may need *.windowsupdate.com and *.delivery.mp.microsoft.com whitelisted.