Easily configuring Windows Update for Business via Windows 10 MDM

This week a blog post about easily configuring Windows Update for Business (WUfB). I call it easily, as I did a post about something similar about a year ago. That time It was required to configure everything with custom OMA-URI settings. Starting with Configuration Manager 1706, an easier configuration option is available for the most important settings, by using the Configuration Manager administration console. For Microsoft Intune standalone this was already available for a while. In this post I’ll walk through the easy configuration options for Microsoft Intune hybrid and standalone and I’ll end this post with the end-user experience.

Configuration

Now let’s start by walking through the configuration steps for Microsoft Intune hybrid and standalone. However, before doing that it’s good to mention that at this moment Microsoft Intune hybrid and standalone still use the “old” branch names and are not yet updated to the “new” channel name(s). Also, keep in mind that currently not all the WUfB-settings are easily configurable. There are even differences between Microsoft Intune hybrid and standalone. Having mentioned that, every WUfB-setting, available in the Policy CSP, can also still be configured via custom OMA-URI settings.

Microsoft Intune hybrid

The configuration for Microsoft Intune hybrid must be done by using the Configuration Manager console. Simply walking through the wizard as shown below, will create the required policy. The policy can be deployed like a configuration baseline. The nice thing about the created policy is that it can be applied to devices managed via MDM and devices managed with the Configuration Manager client. The focus of this post is the devices managed via MDM.

1	Open the Configuration Manager administration console and navigate to Software Library > Overview > Windows 10 Servicing > Windows Update for Business Policies;
2	On the Home tab, click Create Windows Update to Business Policy to open the Create Windows Update to Business Policy Wizard;
3	On the General page, provide unique name (max 200 characters) and click Next;
4	On the Deferral Policies page, configure the following settings and click Next. Defer Feature Updates Branch readiness level: Select Current Branch or Current Branch for Business; Deferral period (days): Select a value between 0 and 180; Select Pause Feature Updates starting to prevent feature updates from being received on their schedule; Defer Quality Updates Deferral period (days): Select a value between 0 and 30; Select Pause Quality Updates starting to prevent quality updates from being received on their schedule; Select Install updates from other products to make the deferral settings applicable to Microsoft Update as well as Windows Updates; Select Include drivers from Windows updates to also update drivers from Windows Updates.
5	On the Summary page, click Next;
6	On the Completion page, click Close;

Note: At this moment the policy can only be deployed to devices.

Microsoft Intune standalone

The configuration for Microsoft Intune standalone must be done by using the Azure portal. Simply walking through the blades, as shown below, will create the required update ring. The update ring can be assigned, after the creation, like anything else created in the Azure portal.

1	Open the Azure portal and navigate to Intune > Software Updates > Windows 10 Update Rings;
2	On the Windows 10 Update Rings blade, select Create to open the Create Update Ring blade;
3	On the Create Update Ring blade, provide unique name and select Settings to open the Settings blade;
4	On the Deferral Policies page, configure the following settings and select OK to return to the Create Update Ring blade. Servicing branch: Select CB or CBB; Microsoft product updates: Select Allow or Block; Windows drivers: Select Allow or Block; Automatic update behavior: Select Notify download, Auto install at maintenance time, Auto install and restart at maintenance time, Auto install and restart at a scheduled time or Auto install and reboot without end-user control; Active hours start: Choose a time between 12 AM and 11 PM; Active hours end: Choose a time between 12 AM and 11 PM; Quality update deferral period (days); Provide a value between 0 and 30; Feature update deferral period (days): Provide a value between 0 and 180; Delivery optimization: Select HTTP only, no peering, HTTP blended with peering behind same NAT, HTTP blended with peering across private group, HTTP blended with internet peering, Simple download mode with no peering or Bypass mode. Note: Depending on the choice made with Automatic update behavior, Active hours start and Active hours end can change to Scheduled install day and Scheduled install time.
5	Back on the Create Update Ring blade, select Create;

Note: It’s good to mention that it’s also possible to use the pause functionality for quality and feature updates without using custom URI settings. That can be achieved by selecting the created update ring and choosing Pause Quality or Pause Feature.

End-user experience

Important: The end-user experience is based on the current experience on Windows 10, version 1709 (RS3), which is currently available as Insider Preview build (build 16251).

I used Windows 10, version 1709 (RS3), for the end-user experience as it provides a clear view on the applied update policies. The examples below are based on the available settings in the different consoles. Below on the left is of a Microsoft Intune hybrid environment and below on the right is of a Microsoft Intune standalone environment. The show overview is available by navigating to Settings > Update & security > Windows Update > View configured update policy.

Another interesting place to look, is the registry. This is on the end-user device, but is more of interest for administrators. Starting with Windows 10, version 1607, the WUfB-configuration, configured via MDM, is available in the registry via HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\device\Update. The examples below are based on the available settings in the different consoles. Below on the left is of a Microsoft Intune hybrid environment and below on the right is of a Microsoft Intune standalone environment.

More information

For more information about Windows Update for Business  and how it can be configured via Microsoft Intune hybrid and standalone, please refer to the following articles:

• Integration with Windows Update for Business in Windows 10: https://docs.microsoft.com/en-us/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10
• How to configure Windows Update for Business settings with Microsoft Intune: https://docs.microsoft.com/en-us/intune/windows-update-for-business-configure
• Policy CSP: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#policies
• Configure Windows Update for Business: https://docs.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb