It’s been a few weeks since 22H2 has been released for both Windows 10 and Window 11, and after validation by both my Windows Insiders and my early adopters, I am ready to deploy this Feature Update to all of my managed Windows devices at work.
I thought it could be useful to blog about how I do Feature Updates using Intune and Windows Update for Business Deployment Services taking advantage of the Intelligent Rollout feature.
I can cover how I set up my Windows Insider for Business rings in a later blog post if that also interests anyone.
For context and clarity, the information in this post will be for Intune managed devices that are natively Azure AD joined – so no Config Manager and no Active Directory/Group Policy, but you should be able to replicate in those environments as these configurations should be available via group policy (but don’t quote me on that)
Windows Update for Business (WUfB) – Allow Cloud Processing
Because I want to use the intelligent rollout feature of Windows Update for Business Deployment Services, I must enable the Allow Cloud Processing setting on all my Windows devices.
To do this, I need to create a Configuration Profile in Intune.
In Intune, navigate to Devices – Windows – Configuration Profiles and click Create Profile
Select Windows 10 and later for the Platform, and Settings catalog for the Profile Type
Give an appropriate name and description
|Name||Win 10/11 – Settings Catalog – System – Allow WUfB Cloud Processing|
|Description||Allow WUfB Cloud Processing = Enabled|
On the Configuration settings page, click + Add settings
Search for Allow WUfB and select System
Click on the Check box next to Allow WUfB Cloud Processing
Set the configuration to enable on the Allow WUfB Cloud Processing setting and click Next
Configure Scope Tags as required and click Next
Select the most appropriate group for your environment, in this example, I am using the All users built in group. Click Next
Review the settings page and click Create
For more information on the Windows Update for Business Deployment Services, check out Microsoft Learn documentation here
Make sure you are aware of the prerequisites (as of 13 November 2022)
As well as the following best practices (as of 13 November 2022)
Feature Update Profiles
To start off, I will explain how I have configured my Feature Update policies
With both Windows 10 and Windows 11 in my environment, there are four Feature update profiles, two for Windows 10 and two for Windows 11 (once my environment is fully Windows 11, the Windows 10 ones will be removed). Again, let me know if you want me to detail how I have set this up and I’ll write it up in a separate blog post.
Note – This is also a really convenient place to see the end of support date for Windows, and for the purpose of this note, I have temporarily changed one of the profiles to Windows 10 v21H1 so you can see a profile that is configured with a version that has support ending soon.
For the purposes of this section, I will only focus on the Windows 11 profiles (but the exact same configurations are set on the Windows 10 profiles).
I have two Feature Update Profiles
One is for “vNext” which is assigned to a group of people who test the new feature update as soon as it comes out, and the other is the production one that is deployed to all Windows 11 users (Unfortunately Intune filters are not available here so I have used a combination of Include and Exclude groups to control which user gets what update).
The vNext group has been configured to use the ImmediateStart rollout option as this is a small group of testers and I want them to get the update as soon as possible
My production profile is currently set to Windows 11 v21H2, I want to change this to Windows 11 v22H2 and enable gradual rollouts.
On the production profile, I will change the Feature update to deploy setting to Windows 11, version 22H2
On the Rollout options, select Make update available gradually
Configure a date for the first update group (This must be a minimum of two days from the current date), a date for the final update group and the days between groups
NOTE – These settings are for example only and you should configure this to what works best for your environment
I can now see that my production profiles are now configured for version 22H2 for both Windows 10 and Windows 11
Once my whole environment has upgraded to 22H2, I will reset my production profiles back to Rollout Option = Make update available as soon as possible, ready to do this all again in 2023 and beyond.
Make sure you gave a Windows health monitoring Configuration profile configured and deployed to your managed Windows devices
More info Windows health monitoring here
Enabling Windows diagnostic data in Intune to get App and driver compatibility is also recommended too
More info on Widows diagnostic data here
In addition to the Intune reporting, I would also highly recommend configuring Update Compliance to monitor Windows Updates
One last tip I would also recommend – If you have configured Deadline for feature updates and Deadline for quality updates, I’d recommend keeping the quality update setting short, but allow a few extra days for feature updates as I’ve found over the years an aggressive setting for Deadline for feature updates can be disruptive for people – especially if they are in customer facing roles.