Pilot Intune Windows Update Rings and Feature Updates

This walkthrough plans a phased Windows client update rollout with an Intune update ring and a feature update policy. The ring controls Windows Update behavior such as deferrals, deadlines, restart handling, and notifications. The feature update policy selects the Windows release devices can install.

Check update ownership and licensing before creating policies

Windows update rings require Microsoft Intune Plan 1. Feature update policies also require a Windows license that includes the Windows Autopatch entitlement, and devices must meet the feature update policy’s join and enrollment requirements. If Windows Autopatch already manages the devices, follow its rollout model instead of assigning conflicting custom rings.

Use a supported target release and preserve safeguard holds

Choose a feature update version that is currently supported for the devices and approved by your application and hardware owners. A safeguard hold can block a device with a known compatibility issue; do not bypass the hold to force the update. Feature update policies remain in effect until changed or removed, so include an owner and lifecycle review date.

01

Inventory Devices and Define the Rollout

Preflight

Confirm the Windows editions, Intune enrollment state, join type, update service ownership, and existing update policies for the devices. Feature update policies do not support Microsoft Entra registered devices. Identify small, non-overlapping test and pilot device groups, select a supported target version, and agree on success, pause, and rollback criteria before assigning anything.

Ring policy license confirmed:
Feature update Autopatch entitlement confirmed:
Devices: supported edition, Intune managed, Entra joined or hybrid joined
Autopatch / Configuration Manager ownership checked:
Target version and application readiness approved:
Test and pilot device groups identified:

❯ Illustrative Output (Results Vary)

The target population and update owner are known, and the target release is supported.

---

02

Create an Update Ring for the Pilot Devices

Ring Policy

In Intune, go to Devices > By platform > Windows > Manage updates > Windows updates > Update rings and select Create profile. Name the ring for the pilot. Set deferrals, deadlines, active hours, user notifications, and restart behavior according to the approved servicing plan. Assign it only to the pilot device group.

Name: WIN-Update-Ring-Pilot (example)
Settings: match the organization's approved servicing and restart plan
Assignment: pilot device group only
Feature update deferral: preserve current setting until the feature policy is ready

❯ Illustrative Output (Results Vary)

The pilot ring is assigned to the intended devices and does not change unrelated groups.

---

03

Create a Feature Update Policy for a Supported Version

Release Target

Go to Devices > Windows > Windows updates > Feature updates and choose Create profile. Select the supported Windows version approved in Step 01, choose required or optional availability according to the rollout plan, and configure its rollout options. Save the reviewed settings without adding a broad assignment; you will assign the pilot group in Step 04.

Policy name: WIN-Feature-Update-Pilot (example)
Feature update version: the supported, approved target
Availability: required or optional, as approved
Rollout options: approved start and pacing

❯ Illustrative Output (Results Vary)

The feature update policy targets one reviewed version for the pilot rollout.

Coordinate feature update deferrals with the feature policy

Microsoft recommends using feature update policies as the primary way to control Windows versions. If the ring currently has a feature update deferral, first assign the feature policy and wait until the Windows feature updates report shows the target devices as OfferReady. Then set the ring’s feature update deferral to zero. Removing a deferral before policy processing completes can expose devices to an unintended version.

---

04

Assign the Policy and Confirm Offer Readiness

Scoped Rollout

Assign the feature update policy to the same approved pilot devices as the ring. Do not include broad production groups yet. Allow Windows Update to process the policy, then open Reports > Windows Updates and generate the Feature Updates report for this policy. After all targeted devices show OfferReady, update the ring’s feature update deferral to zero if you are moving from deferral-based targeting.

Feature policy assignment: approved pilot device group
Report: Windows feature updates (Organizational)
Readiness state: OfferReady for targeted devices
After readiness: set ring feature update deferral to 0, if applicable

❯ Illustrative Output (Results Vary)

The targeted devices have processed the feature policy before any deferral change.

---

05

Monitor Installation, Compatibility, and Safeguard Holds

Health Review

Review the feature update deployment report for device status, last scan, readiness, and errors. Investigate failed or blocked devices individually. Check Windows release health and application compatibility reports for known issues. If a device is on safeguard hold, keep it on its current version until Microsoft clears the hold and your organization approves the update.

Review: device-level offer and installation state
Investigate: stale scans, errors, and compatibility blocks
Safeguard hold: preserve it and track the known issue
Record: device, current version, target, last scan, and action

❯ Illustrative Output (Results Vary)

Pilot devices are either updated successfully or have an assigned owner and documented blocker.

---

06

Expand in Stages and Maintain the Target Version

Controlled Rollout

When the test and pilot devices meet the agreed success criteria, add the next approved device ring or create a separate policy assignment for that phase. Keep watching quality update health, user impact, and feature update status as scope grows. Record who owns the policy and when to review or change its target version; the feature policy continues to constrain devices until it is modified or removed.

Pilot exit criteria met:
Next ring and change window approved:
Support and rollback owner notified:
Policy target and review date recorded:

❯ Illustrative Output (Results Vary)

The rollout expands only after the prior phase is healthy and the next scope is approved.

Upstream references

See Microsoft’s Windows update management overview, manage update rings, configure feature update policies, and Windows safeguard holds.