Update Your Devices with Microsoft Intune

Why Keeping Business Devices Updated Is So Important

Most businesses rely on computers, laptops and mobile devices every day.

These devices are used to access emails, customer information, business applications, financial records and cloud services. However, when devices are not kept updated, they can quickly become one of the weakest points in your cyber security.

Software updates are sometimes seen as an inconvenience. They can require a restart, interrupt somebody’s work or change the way an application looks.

Unfortunately, delaying updates for too long can leave known security weaknesses open for cyber criminals to exploit.

Microsoft Intune can help businesses centrally manage their devices and control how updates are installed, without relying entirely on individual employees to keep everything updated themselves.

What is Microsoft Intune?

Microsoft Intune is Microsoft’s cloud-based device and application management service.

It allows your IT provider or internal IT team to enroll, monitor, secure and manage company devices from a central online portal.

This can include:

* Windows computers and laptops
* Apple Mac computers
* iPhones and iPads
* Android phones and tablets
* Company-owned devices
* Certain personally owned devices used for work

Intune can be used to apply security policies, deploy applications, check whether devices meet company requirements and control access to business information.

For Windows devices, Intune also provides several tools for controlling how operating system updates are delivered and installed. Microsoft describes Intune as a cloud-based endpoint management solution that manages devices, applications and access to company resources.

Why do business devices need regular updates?

Updates do more than add new features.

They can also:

* Correct known security vulnerabilities
* Fix software faults
* Improve performance
* improve reliability
* Add support for new business applications
* Update hardware drivers
* Replace unsupported versions of Windows

Once a security vulnerability becomes publicly known, cyber criminals may attempt to exploit businesses that have not yet installed the relevant update.

This means that an update which has been postponed for several weeks or months could leave a device exposed to an issue that already has a fix available.

A good update policy reduces the amount of time between Microsoft releasing an important security update and that update being installed across your business.

What happens when updates are not managed?

Without central management, every employee may handle updates differently.

Some people will install updates immediately. Others will repeatedly select options such as **Remind me later**, particularly when a restart is required.

This can result in a mixture of devices running different versions of Windows, with different security updates and different levels of protection.

Your IT team may not know:

* Which devices are fully updated
* Which devices require a restart
* Which computers have failed to install an update
* Which employees are repeatedly postponing updates
* Which devices are running an unsupported Windows version
* Whether an important security update has reached everyone

Microsoft Intune provides central policies and reporting to make the update process more consistent and easier to monitor.

How does Microsoft Intune manage Windows updates?

Intune uses Windows update policies to control when and how updates are installed on managed devices.

Rather than manually connecting to every computer, your IT team can create policies and assign them to groups of devices.

These policies can control settings such as:

* When updates become available
* How long an update can be delayed
* When a restart is required
* How much notice users receive
* The hours during which automatic restarts should be avoided
* Which Windows version a device should use
* How updates are introduced across the business

Microsoft’s current Intune update management service includes update rings, feature update policies, quality update policies and driver update policies.

What are update rings?

Update rings allow updates to be introduced gradually rather than installing them on every computer at exactly the same time.

For example, a business could create three groups:

Test devices

Updates are installed first on a small number of selected computers.

These may belong to the IT team or employees who use standard business applications and can report any unexpected problems.

Early deployment devices

If the initial test is successful, the update can be made available to a larger group of employees.

General business devices

Once the update has been tested, it can be installed across the remaining company computers.

This approach can reduce risk.

Most security updates can still be installed promptly, but the business has an opportunity to identify compatibility problems before an update reaches every employee.

Intune update rings can control deferral periods, installation deadlines, restart behaviour, active hours and the notifications shown to users. Microsoft specifically identifies phased groups such as test, pilot and production as a common use for update rings.

What is the difference between quality and feature updates?

Windows updates are not all the same.

Quality updates

Quality updates generally include security fixes, reliability improvements and corrections for known problems.

These are the regular updates that help keep the current version of Windows secure and stable.

When a particularly important security update is released, Intune can also be used to create an expedited quality update policy for supported devices. This allows an organisation to speed up the installation of an urgent update rather than waiting for its normal schedule.

Feature updates

Feature updates move a computer to a newer release of Windows.

These updates can introduce larger changes, new functionality and different system requirements.

An Intune feature update policy can specify which Windows release devices are allowed to install. It can also keep devices on a selected version until the business is ready to approve a newer release.

This gives a business more control than simply allowing every device to upgrade as soon as Microsoft releases a new version.

Feature updates can be made available immediately, from a selected date or through a gradual rollout.

Can Intune manage driver updates?

Device drivers allow Windows to communicate with hardware such as:

* Graphics cards
* Network adapters
* Printers
* Docking stations
* Cameras
* Audio equipment
* Laptop components

Driver updates can improve stability, resolve hardware problems and address security issues. However, an unsuitable driver can sometimes create unexpected problems.

Intune driver update policies allow IT administrators to review, approve, deploy, pause and monitor applicable Windows driver updates.

Windows checks the device and hardware information before determining which approved drivers are applicable.

This can provide greater control than allowing every available driver to install automatically without review.

Will updates interrupt employees?

Updates will occasionally require applications to close or computers to restart.

However, Intune can help make the process less disruptive.

Your IT team can configure:

* Active hours when restarts should be avoided
* Restart warnings
* User notifications
* Installation deadlines
* Grace periods
* Automatic restart behaviour
* Times when employees can choose to restart

The aim is to give employees reasonable flexibility while preventing important updates from being postponed indefinitely.

For example, a user may be allowed to delay a restart during an important meeting, but a final deadline can ensure the device is eventually updated.

The right balance will depend on the business. A computer used by a receptionist may need a different restart policy from a laptop used by a remote employee or a device operating specialist equipment.

Can Intune tell us which devices are missing updates?

Intune includes reporting tools that help administrators monitor update deployments.

These reports can provide information about:

* Devices that successfully installed an update
* Devices that are still in progress
* Devices with installation errors
* Devices running different Windows versions
* Feature update readiness
* Driver update status
* Quality update distribution

Microsoft’s feature, quality and driver update reports provide device-level deployment information that can be used for monitoring and troubleshooting.

This is important because creating an update policy is only part of the process.

A business should also check whether the policy is reaching devices and investigate computers that are repeatedly failing to update.

Does Intune update devices outside the office?

Because Intune is cloud based, managed devices do not normally need to be connected to the company’s office network for policies to reach them.

This can be useful for:

* Employees working from home
* Remote workers
* Employees travelling between locations
* Businesses with multiple offices
* Laptops that rarely connect to the main network

Providing the device can communicate with the required Microsoft cloud services and Windows Update, it can receive policies and download applicable updates over its internet connection.

This gives businesses more control over devices regardless of where their employees are working.

Does Intune update every application?

Windows update policies primarily manage updates delivered through Microsoft’s Windows Update services.

They should not be treated as a guarantee that every third-party application on a computer is automatically updated.

Applications such as web browsers, PDF tools, accounting packages, remote access software and specialist business systems may use their own update processes.

Some applications can be packaged, deployed or replaced through Intune. Others may need a separate application-management or patch-management process.

A complete update strategy should therefore consider:

* Windows updates
* Microsoft application updates
* Third-party applications
* Hardware drivers
* Mobile operating systems
* Unsupported or obsolete software

Managing Windows updates is an important starting point, but it should form part of a wider device-management and cyber-security strategy.

Is Microsoft Intune included with Microsoft 365?

Intune is available as a standalone service and is also included with several Microsoft 365 subscriptions.

Microsoft 365 Business Premium includes Microsoft Intune Plan 1, which allows eligible users and devices to be enrolled, monitored and managed through Intune.

Intune is not included with every Microsoft 365 plan.

For example, a business using Microsoft 365 Business Basic or Business Standard may need to upgrade its licensing or purchase Intune separately.

Licensing should always be reviewed before deploying the service, particularly where a business uses a mixture of Microsoft 365 plans.

How should a business introduce managed updates?

Updates should not simply be enabled without considering how the business operates.

A sensible rollout could include:

1. Reviewing existing Microsoft 365 licensing
2. Enrolling business devices into Intune
3. Checking which Windows versions are currently in use
4. Identifying old or unsupported devices
5. Creating a small test group
6. Configuring update rings
7. Setting appropriate restart notifications and deadlines
8. Introducing feature updates in stages
9. Reviewing failed or non-compliant devices
10. Continually monitoring update reports

It is also important to speak to employees.

Users should understand that updates are being managed to protect the business, and that repeatedly switching off devices before updates complete may prevent them from installing successfully.

How can Hamilton Group help?

Microsoft Intune can make device updates more consistent, secure and manageable, but the policies must be configured correctly.

At Hamilton Group, we can help your business:

* Review your Microsoft 365 licensing
* Configure Microsoft Intune
* Enrol computers and mobile devices
* Create Windows update rings
* Manage feature and quality updates
* Review Windows 11 compatibility
* Control driver updates
* Configure restart deadlines and notifications
* Monitor failed updates
* Identify unsupported devices
* Improve your wider device security policies

The goal is not simply to force updates onto computers.

It is to create a controlled process that keeps devices protected while reducing unnecessary disruption for employees.

If you are unsure whether your business devices are fully updated, Hamilton Group can review your current setup and recommend the right Microsoft Intune policies for your organisation.

Call us on 0330 043 0069 or book an appointment with one of our experts.