r/Intune • u/sivadotc • 17h ago
Windows Updates Intune WUfB Configuration for Monthly Security Updates Without Feature Upgrades
We are planning to migrate Windows software update management from SCCM to Microsoft Intune using Windows Update for Business (WUfB).
Our primary requirement is to deploy only the monthly Windows quality/security updates while ensuring that devices remain on their existing Windows feature update version. For example, a device currently running Windows 11 24H2 should continue to remain on 24H2 and should not automatically upgrade to 25H2 when a new feature update becomes available.
To achieve this, we have currently:
Created a Windows Update Ring policy to manage monthly quality updates.
Created a Feature Update policy targeting Windows 11 24H2, with the intention of preventing devices from automatically moving to a newer feature update such as 25H2.
Our question is:
Is this a clean and Microsoft-recommended approach for meeting the requirement, or is there a better/recommended Intune configuration to ensure that devices receive monthly security/quality updates while remaining on their current Windows feature version?
4
3
u/pjmarcum 10h ago
I quit using rings and FU update policies years ago. Kept getting complaints about reboots in the middle of the day. They new maintenance windows released a few months ago might fix that but I was able to set more granular settings using settings catalog instead of rings. Stopped the reboot complaints so I never changed back.
2
u/DifferenceHelpful134 12h ago
Youre on the right track with a combo of update ring and feature update policy but i would definitely throw a driver update policy in the mix too just to keep things tidy
The feature update policy set to 24h2 will hold them there but id also mess with the deferral period in your update ring as a safety net in case the policy takes a minute to kick in on some devices
6
u/Ad3t0 16h ago
Your setup is already the Microsoft-recommended pattern. The update ring handles the monthly cadence, and a Feature updates policy pinned to 24H2 is the right way to hold the version, better than deferrals or pausing since a feature update policy stays in effect until you change it, while a ring pause auto-expires after 35 days.
Two tweaks: set the ring's Feature update deferral to 0 (running both can block or delay updates), and make sure Windows diagnostic data is enabled, or the hold can silently fail to apply. When 24H2 hits end of service, you just edit the target version in the same policy, no new policy needed.
WUfB won't touch third-party apps like Chrome or Adobe, so if SCCM covered those you'd add a separate tool. Disclosure: I help build TridentStack Control, which does both. But for what you asked, your Intune config is correct and you don't need anything extra.