Keeping Windows current is going to be more important than ever for organizations, but fear not administrators, modern management is here to help. With Microsoft’s mobile device management, Intune, it’s easier than ever keeping Windows 10 devices up-to-date by leveraging their new update model, Windows as a Service. Here are some key terms that need to be outlined before jumping into implementation.
Types of Updates
There are two types of updates that are rolled out by Microsoft: Feature updates and Quality updates
Feature Updates: Microsoft plans to release two feature updates a year, in spring and fall. New features like Bitlocker, Windows Defender ATP, Device Guard and Windows Hello to name a few, were released last year in version 1709. This version was coined the Fall Creator’s Update.
Trivia Time: The version number 1709 isn’t arbitrary, it stands for the general release date of the update which was on September 2017 in this case. The next update, 1803, is a little overdue but rumor has it the release will be in early April.
Quality Updates: Microsoft releases quality updates on Patch Tuesday, the first Tuesday of every month for workstations. As the name entails, quality updates provide either security, critical or driver updates to the system.
Service Channels
Service Channels provide a way for organizations to separate users into deployment groups for feature updates. The Insider Program, Semi-Annual Channel(Targeted) and Semi-Annual Channel are the most common.
Insider Program: The Insider Service Channel is for IT members eager to get their hands on the newest Windows features and provide feedback to Microsoft for improvements. Two flavors are available: Insider Slow and Insider Fast. The slow flavor will provide a more stable environment, whereas the fast flavor will include more features and components.
Semi-Annual Channel(Targeted): The Semi-Annual Channel(Targeted) will make the semi-annual feature updates available as soon as it is released by Microsoft. The channel is intended for a pilot audience within the organization.
Semi-Annual Channel: The Semi-Annual Channel is reserved for broad deployments of semi-annual feature updates.
Deferral Period
Deferral periods can be set on either feature updates or quality updates. This allows the IT department to test accordingly with their patching schedule and can be deferred up to 30 days from their initial release.
Windows Ring (Deployment)
Being a feature for Intune, Global Admin rights will be needed to create a Windows Ring. A Windows Ring is simply a group of settings that configure when and how the Windows 10 device will be updated.
Log in to your Azure Tenant and head over to Intune – hopefully it’s saved to your favorites. Head to Software updates > Windows 10 Update Rings > Create.
Here is an example of being able to preview new features before they’re generally released, while still on a stable Windows 10 environment – the Service channel is set to Insider Slow. The computer will check for Microsoft updates and Windows driver updates, and notify the user a download for an update was issued. Restart checks are enabled by default. By leaving it turned on, you have the ability to make sure your users’ computers are adequately charged. No deferral periods are being set for either feature or quality updates.
Once the Window Ring policy is created, then it’s ready for group assignment. The Ring policy can be edited by clicking on Properties, above assignments.
