Microsoft MD-102: Windows Lifecycle and Update Management — Study Guide

By Laurynas Brazys · 5 August 2026 · #microsoft #md-102 #certification #exam-prep #study-guide

Part of the Microsoft Endpoint Administrator Associate MD-102 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Windows lifecycle and update management in Microsoft Endpoint Manager (Intune) centers on Windows Update for Business (WUfB), the Windows Update for Business deployment service, and optional automation with Windows Autopatch. The goal is predictable, ring-based rollouts of quality and feature updates with minimal disruption, while maintaining real-time visibility and control. In Intune, you configure update rings, feature and driver update policies, and expedited quality updates. Compliance and readiness insights come from Windows Update for Business reports in Azure Monitor and Endpoint analytics. For moving to Windows 11 and recovering devices, use the correct upgrade or reset method based on business intent.

Windows Update for Business rings, feature targeting, and drivers

Update rings define the baseline experience for offering and installing updates. In Intune, create a Windows 10 and later update ring and assign it to Azure AD groups representing your deployment rings (for example: Pilot, Early, Broad). Configure:

Deferral periods: Delay when updates are offered. Typical values are 0–30 days for quality updates and 0–365 days for feature updates. Deferrals allow time to monitor telemetry and early feedback before broader exposure.
Deadlines: Enforce installation within a specified number of days after an update is offered (separately for quality and feature updates). Deadlines override user deferrals and ensure devices complete installation in a predictable window.
Restart grace period: Provide a limited post-deadline window before forced restart. Combine with Auto reboot before deadline to allow Windows to restart outside active hours when necessary to meet compliance. You can also control user experience options such as automatic adjustment of active hours, whether users can pause scans, and whether to receive other Microsoft product updates. Critically, the Allow driver updates setting toggles whether drivers are offered via Windows Update.

Feature update policies target and hold devices on a specific Windows version, independently of ring deferrals. In Intune, use Feature updates for Windows 10 and later to select a product (Windows 10 or 11) and target version (for example, Windows 11, version 23H2). The policy uses the Windows Update for Business deployment service to pin the device to that version until you change policy or the version reaches end of service. Safeguard holds—temporary blocks Microsoft places to protect devices with known compatibility issues—apply by default. Only disable safeguards for feature updates if you have validated the issue does not affect your environment; bypassing safeguards forces the offer on next scan and can introduce risk.

Driver update management is best handled with the Windows driver update management policies in Intune. At scale, set Allow driver updates = No in your update rings for broad rings, and use the driver update management workflow to:

Discover recommended driver/firmware updates per model and vendor from the Windows Update catalog.
Approve and schedule drivers to pilot rings first, then promote to broader rings after validation.
Pause or roll back problematic driver approvals if issues are detected. This approach decouples drivers from the normal quality update cadence and reduces regression risk.

Expedited updates and Windows Autopatch automation

Expedited quality updates let you deploy critical security fixes outside normal deferral windows. In Intune, create an Expedite quality updates policy to deliver the latest security update (or a specific KB when supported) with an aggressive installation deadline and short restart grace period measured in hours or a small number of days. Expedite policies override deferrals and pauses. Requirements include devices managed by Intune, receiving updates directly from Windows Update (not WSUS), and having Windows Update Health Tools present. Expedite applies to quality (security) updates, not feature updates, and is intended for urgent remediation of active threats or zero-day vulnerabilities.

Windows Autopatch provides end-to-end automation for Windows updates, Microsoft 365 Apps for enterprise, Edge, and optionally drivers/firmware, using service-driven rings and policy orchestration. After onboarding eligible devices (Windows Enterprise E3/E5 or Microsoft 365 E3/E5; Intune MDM; Azure AD join or hybrid Azure AD join), Autopatch assigns devices to service rings—Test, First, Fast, Broad—by default proportions and manages:

Windows Update rings, feature update targeting, and pauses based on signal.
Progressive deployment with automated promotion/rollback using health signals and safeguard holds.
Coordinated patching of Microsoft 365 Apps and Edge to minimize app/OS drift. Autopatch is ideal when you want Microsoft to operate the update cadence while you retain visibility and control over assignments and guardrails. You can still use expedited updates from Intune alongside Autopatch for out-of-band security events.

Compliance reporting, Windows 11 readiness, and upgrade/reset paths

Windows Update for Business reports in Azure Monitor replace the legacy Update Compliance solution and provide near-real-time insights using Azure Monitor workbooks and Kusto queries. To enable:

Create a Log Analytics workspace in Azure and the Windows Update for Business reports resource, linking it to the workspace.
In Intune, deploy Windows Health Monitoring profiles to enable Windows updates event data, and set diagnostic data to Required (the minimum) so devices can send the needed telemetry.
Assign the connection profile so Azure AD–joined devices authenticate to the reporting pipeline. You can then monitor update offering/installation states, safeguard hold reasons, feature and quality update compliance, expedite progress, and deployment health by ring or device group, and build alerts using Azure Monitor.

Assess Windows 11 readiness by validating hardware and compatibility. Minimum requirements include a compatible 64-bit CPU (for example, Intel 8th Gen/AMD Zen 2 or newer on supported lists), 4 GB RAM, 64 GB storage, UEFI with Secure Boot, TPM 2.0, DirectX 12–capable graphics with WDDM 2.0, and appropriate display/resolution. Use:

Endpoint analytics Windows 11 readiness report in Intune to inventory TPM/Secure Boot status, CPU family/model, RAM, storage, and readiness blockers at scale.
Windows Update for Business reports workbooks to see feature update readiness and safeguard holds.
Test Base for Microsoft 365 to validate critical line-of-business apps against Windows 11 and upcoming feature updates.

Choose the correct OS transition method based on the outcome you need:

In-place upgrade: Use Intune Feature updates for Windows 10 and later to move managed devices to a specific Windows 10/11 release while preserving apps, data, and settings. This is the primary method for feature servicing and migrating from Windows 10 to Windows 11 when hardware is compliant. It respects safeguard holds (unless you explicitly disable them).
Fresh Start: A remediation action that reinstalls Windows and removes OEM preinstalled software and Win32 apps. It attempts to retain user data but resets many settings. Use it to de-bloat or recover a degraded device without a full wipe. Device remains Azure AD joined and MDM managed.
Autopilot Reset: Resets a Windows Autopilot-registered device to a business-ready state while preserving Azure AD join, device name, and Intune enrollment. It removes user profiles and apps and reapplies device-targeted policies and apps. Use it to quickly re-provision a device for a new user or recover after corruption, with the Enrollment Status Page ensuring required apps and policies apply before use. Complement these with ring strategy hygiene: small pilot rings with minimal or no deferrals, progressively larger rings with measured deferrals and deadlines, and strict deadlines with short grace periods for high-risk environments. Use driver management and expedited updates to handle outliers without destabilizing the core cadence.

Practical Problem Scenario

Adobe must move 45,000 Windows endpoints worldwide to a predictable monthly patch rhythm, pilot Windows 11 adoption, and reduce driver-related regressions that previously caused helpdesk spikes after Patch Tuesday.

Define Azure AD device groups for rings: Pilot (2%), Early (8%), Broad (90%). Why: Clear scoping enables progressive exposure and targeted pauses without reshaping assignments each cycle.
Create Intune Windows Update rings: Pilot with 0-day deferrals, 3-day quality deadlines, 1-day grace; Early with 7-day quality deferral, 7-day deadline, 2-day grace; Broad with 14-day quality deferral, 7-day deadline, 2-day grace. Set Allow driver updates = No for Early/Broad. Why: Tight Pilot accelerates signal; staged deferrals reduce blast radius; disabling drivers in larger rings minimizes hardware regressions.
Implement Feature updates for Windows 10 and later to target Windows 11, version 23H2 for Pilot only; keep Early/Broad on their current versions. Respect safeguards. Why: Locks devices to a tested feature release, aligns with ring validation, and avoids accidental upgrades via rings alone.
Enable Windows driver update management. Approve vendor-recommended drivers to Pilot monthly; promote to Early/Broad after one week of clean telemetry. Why: Central approval control decouples drivers from quality updates and provides rollback leverage.
Configure Windows Update for Business reports with a dedicated Log Analytics workspace and Windows Health Monitoring profiles. Build workbooks and alerts by ring for install success, safeguard holds, and rollback triggers. Why: Azure Monitor offers live compliance views and alerting for issues like install failures crossing a threshold.
Use Endpoint analytics Windows 11 readiness to identify CPU/TPM/Secure Boot blockers and remediate via firmware updates or replacement plans. Why: At-scale readiness inventory prevents failed upgrades and informs hardware refresh.
Onboard eligible devices to Windows Autopatch for ongoing automation of Windows quality updates and Microsoft 365 Apps releases, keeping Pilot devices out of Autopatch initially to retain tighter experimental control. Why: Autopatch reduces operational overhead while preserving a curated pilot lane for change control.
Prepare an Expedite quality updates policy with a 2-day deadline and 8-hour restart grace for zero-day scenarios; test on Pilot now. Why: Prevalidated expedite settings enable rapid, safe response to urgent security threats without reconfiguring rings during an incident.
Establish recovery playbooks: use Autopilot Reset for re-provisioning failed devices with ESP enforcement; reserve Fresh Start for OEM de-bloat and remediation on select models. Why: Correct reset paths speed recovery and ensure required apps/policies reapply before user access.

This design blends service-driven automation (Autopatch) with Intune policy control and Azure Monitor insights to deliver safe, observable, and rapid Windows servicing at enterprise scale.

← Co-management and Hybrid Environments · All domains · Remote Management and Monitoring →

Practice these questions → · Timed practice on ExamRoll.io →