Microsoft 365 Endpoint AdministratorManage devices and apps (55-60%)Hard
A company policy requires that all corporate-owned Windows 11 devices automatically install available quality updates within 7 days of their release. Users should be able to pause updates for a maximum of 3 days. Which Intune policy setting should be configured to meet these requirements?
- ADevices > Configuration profiles > Create profile > Windows 10 and later > Templates > Device restrictions > General > Windows Updates.
- BDevices > Windows > Update rings for Windows 10 and later > Quality update deferral period and Pause quality updates.
- CEndpoint security > Attack surface reduction rules > Block automatic updates and Allow user pause.
- DDevices > Windows > Feature update policies for Windows 10 and later > Quality update deferral and User experience settings.
Show answer & explanationAnswer & explanation
Correct answer: B. Devices > Windows > Update rings for Windows 10 and later > Quality update deferral period and Pause quality updates.
Windows Update Rings are the primary and most comprehensive way to manage Windows quality and feature updates in Intune. They allow setting deferral periods for quality updates and configuring user experience options, including the ability to pause updates.
Why the other options are wrong
- A. While 'Device restrictions' can influence some update settings, 'Update rings' offer a far more granular and dedicated set of controls for Windows update management, including deferrals and user pause options.
- C. Attack surface reduction rules are security features, not for managing Windows update deployment schedules or user interaction with updates.
- D. Feature update policies are for managing upgrades to new Windows versions, not the regular monthly quality updates. While 'User experience settings' exist, 'Update rings' are specifically designed for ongoing quality update management.
Intune Quality Update Deferral
A setting within Intune's Windows Update Rings that allows administrators to delay the installation of monthly quality updates for a specified number of days after their release.
- Configured within a Windows Update Ring.
- Applies to cumulative updates, security updates, and non-security updates.
- Can be combined with user experience settings like 'Allow user to pause updates'.
Memory trick: Quality Rings: Defer, Pause, Control.