Updating Devices with Windows Update for Business

Windows Update for Business (WUfB) is a service that lets IT administrators manage how Windows devices receive feature updates and quality updates directly from Microsoft's update servers. Before WUfB, managing updates was a heavy, manual process using a tool called Windows Server Update Services (WSUS). Administrators had to download updates to a local server, approve them, and then push them out. This took a lot of server space and manual oversight. WUfB replaces this by letting devices connect directly to the internet to get updates, but with policies set by the IT admin to control things like when the update installs, which devices get it first, and how long a feature update can be delayed.

The core components of WUfB are: - Deployment rings: These are groups of devices that receive updates on a specific schedule. For example, you might have a 'Ring 1' for test devices (gets updates immediately), a 'Ring 2' for IT staff (gets updates after a brief validation period), and a 'Ring 3' for the rest of the company (gets updates only after they are proven stable). - Feature updates: These are major, once-a-year upgrades to Windows, like moving from Windows 10 to Windows 11, or from one version of Windows 11 to the next. They include new features and significant changes. WUfB lets you delay these updates for a set number of days (up to 365 days) to allow for testing. - Quality updates: These are smaller, monthly security patches and fixes. They are critical for security. You can delay these as well, but typically for a much shorter period (e.g., 30 days) so that security holes are patched quickly. - Deferral periods: This is the number of days you can wait after Microsoft releases an update before it is automatically installed on a device in a specific ring. This gives IT time to test updates for compatibility with their apps. - Deadlines: An administrator can set a deadline for an update. If a user hasn't installed the update by the deadline, the device will automatically force the installation and reboot, regardless of the user's active hours. - Active hours: The time range during which the user is typically working. WUfB will avoid rebooting the device for updates during these hours to prevent disruption.

WUfB is managed through policy, primarily through Intune (Microsoft's cloud-based mobile device management service) or through Group Policy (for on-premises devices, though MD-102 focuses more on Intune). When you configure a WUfB policy in Intune, you are creating a set of instructions that the Windows Update service on each enrolled device follows. The device itself downloads the update from the Microsoft Content Delivery Network (CDN) — a network of servers that efficiently delivers files to users worldwide. This is called 'peer-to-peer delivery' and can be used to share updates between devices on the same local network, reducing internet bandwidth usage.

WUfB does not give you the ability to pick and choose individual updates. You either get all the updates in a given 'quality update bundle' or none. This is a fundamental shift from WSUS where an admin could approve individual updates. For passing MD-102, you must understand that WUfB is a policy-based update management solution, not a patch management tool that lets you cherry-pick patches.

Finally, there is the concept of 'update compliance'. This is a service (part of Microsoft Intune) that gives you a dashboard to see which devices are up to date, which are behind, and which have update errors. It helps an IT professional see the health of their update roll-out at a glance.

Consider a mid-sized company called 'SouthCoast Logistics' with 500 Windows 10/11 devices. The IT team, led by a single administrator named Priya, needs to keep these devices secure. Before WUfB, Priya would have to manually approve patches on a WSUS server, which required constant attention and server maintenance. Now, using Intune, she sets up the following:

First, she creates three deployment rings in Intune: - Ring 1 (Test): 10 devices used by the IT team for testing. - Ring 2 (Pilot): 50 devices used by the engineering and management teams (who are more tech-savvy). - Ring 3 (Production): 440 devices for the warehouse staff, sales team, and admin staff.

Next, she configures the policies for each ring. For the Test ring, she sets the feature update deferral to 0 days (they get them immediately) and quality update deferral to 0 days. For the Pilot ring, she sets a feature update deferral of 30 days and a quality update deferral to 7 days. For Production, she sets a feature update deferral of 120 days and a quality update deferral to 14 days. She also configures active hours for each group, ensuring warehouse devices do not restart during the 6am-5pm operating window.

A new feature update is released by Microsoft. The Test ring receives it the same day. Priya monitors the 'Update Compliance' dashboard for any app compatibility issues or driver failures. After a week, she sees no problems, so she manually 'promotes' the update by adjusting the deferral period for the Pilot ring. After another month of successful pilot validation, she allows the Production ring to get it. Meanwhile, a critical monthly security patch arrives. Because the quality update deferral for Production is 14 days, the devices will wait two weeks before installing, giving Priya time to confirm the test ring is stable. If there was a zero-day vulnerability (a vulnerability that is being actively exploited before a patch is released), she would override the deferral setting and push the quality update immediately to all rings by setting the deadline as 'as soon as possible'.

Finally, Priya uses the 'Update Compliance' dashboard to generate a report for her manager showing that 98% of devices are on the latest security update, proving the company's security posture is strong. The entire process is managed from a single pane of glass in the Microsoft Endpoint Manager admin centre.