1

Hello Spice Heads.

Need some advice on how you are dealing with these types of issues in your Azrure-Entra-Intune-Windows Updates environment.

I am still new and learning all of this so any guides,video help is greatly appreciated.

How do you all do patching, updates,security or other for your users and there devices using Entra/Intune and streamline them so the are working when rolled out?

How do you deal with the slowness of the process do you have certain policies that you know work rather then the defaults or use a RMM program that works well with Entra/intune/ to keep things going and up to date in a timely fashion.

Also still provide you updates if there is a issue direct you to where it is.

Thanks again in advance

8 Spice ups
2

we don’t patch via Intune.

We use an RMM for patching. It gives better control and reporting. Intune reporting runs to far behind to really be useful for patching.

If you don’t have a RMM you could look at using action1 for patching as its free up to 200 devices

5 Spice ups
3

You setup ‘rings’ in the Microsoft Updates for Business portal (can be found via Intune) then create security groups for your computers, to apply to those rings. If you don’t want to have different rings offering updates to PC’s at a different rate, you can just set it to apply to all computers, but that means you don’t have test groups…

3 Spice ups
4

We use update rings in Intune for workstations and Action1 for servers.

3 Spice ups
5

We don’t use Intune for application patching, only Windows updates (or we did before we bought an RMM which handles those now as well). But you can setup Windows Update rings in Intune to handle updates based on device groups so you can delay install by different lengths of time for different groups of systems.

3 Spice ups
6

Are update rings hard to setup I am googling it now?

Do they speed things up as well?

Is there a way to see if update rings are already setup and just crashing?

@Jay-Updegrove, @computerdave, @Evan7191

2 Spice ups
7

They aren’t hard. Basically you want to decide how many rings you want, and then your last ring is a dynamic group that has all devices and excludes the groups of the other rings.

If you’re under 200 endpoints just go to action1. If you’re over, see if you can get budget approval for the difference. The experience is night and day. This is coming from someone that did updates via Intune and moved to Action1.

4 Spice ups
8

Hi Using RMM is the best method of patching Intune their are many vendors proving RMM tools like solarwinds, ninja one, level, etc.

3 Spice ups
9

Update rings are easy to configure, certainly easier than WSUS. They configure Windows Update on the endpoint, and Windows Update installs the patches according to the settings in the update ring.

Update rings do not make patching faster, because they still use Windows Update.

You can find update rings in Intune by going to Devices > Windows > Manage updates.

2 Spice ups
10

We currently do it from Intune with the “Windows Updates”. However, this proves to be far from ideal and not really reliable. I get devices back sometimes that have not been updated in a year or more despite the policy in Intune demanding differently. Nobody has an explanation for that behavior: we asked two different MSPs and several consultants. Everything in our configuration looks ok according to them. It’s just not always enforced. So if you ask me: for this, Intune works. Kinda, sorta, maybe… But you cannot 100 % rely on it. At least that is my experience. Definitely better than nothing or doing it manually though.

Also: Intune will always ever only let you control OS updates. Not drivers or applications. And if there is a crucial update, you cannot use Intune to force the update NOW, pronto. It will update when it will update and even if it goes well it can take days until all devices are done.

Which is why I am pushing for a 3rd party RMM tool (Heimdal) which offers far better control and overview regarding this. And who DO offer you that 100 % that you can rely on them that they will do what you set them up to do.

Other RMMs like n-Central, Ninja One, Datto etc etc out there should be fine too.

3 Spice ups
11

Intune’s Update Rings can be configured to include drivers in Windows Update. It will not necessarily update 3rd party drivers, but it can update some drivers.

This is misleading. Update rings will not force an urgent update immediately outside of the normal schedule, but updates can be deployed immediately through Intune by packaging them as apps or deploying scripts to install the update(s).

2 Spice ups