Question

Your organization uses Intune to manage 4,000 Windows 11 devices. The IT team wants quality (monthly security) updates to install automatically but needs a validation window: a 200-device pilot group should receive updates immediately, while all remaining production devices should wait 7 days after release before installing. You must also ensure users cannot indefinitely postpone the update once it becomes available. Which approach meets these requirements with the least administrative effort?

Accepted Answer

Create two Windows Update rings: one assigned to the pilot group with a quality update deferral of 0 days, and one assigned to production with a deferral of 7 days, each configured with a deadline for automatic installation.

Answer

Create a single feature update deployment profile targeting all devices and set a rollout schedule that gradually deploys over 7 days.

Answer

Create one Windows Update ring for all devices with a quality update deferral of 7 days, then use a device configuration profile to force installation on the pilot group.

Answer

Configure a driver update policy for the pilot group and an expedite quality update policy for production devices set to install after 7 days.