Windows Patch Level

The question it answers: Which Windows devices are behind the newest monthly patch revision seen for their build in this fleet?

Note

Covers Windows Update for Business rings. Windows Autopatch, feature-update profiles and per-update (KB) reporting are not read here; Intune’s own Windows Update reports go deeper.

At a glance

Where in the app	Intune › Windows Update Compliance
Shown as	a tab of Windows Update Compliance
Workload	Intune
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune.
Report id (API and MCP)	intune.devices.windows-patch-level

Columns

Column	Key	Type
Device	DeviceName	Link
User	UserPrincipalName	Text
State	PatchState	Status
Version	VersionLabel	Text
Build.revision	OsVersion	Text
Newest in fleet	NewestRevisionInFleet	Text
Last sync	LastSyncDateTime	Date

Filters

Filter	Key (API)	On when the page opens
Only devices behind the newest patch	behind	Yes

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementManagedDevices.Read.All	Microsoft Graph	Read Microsoft Intune devices

Data sources it reads

• GET /beta/deviceManagement/managedDevices

Through the API and MCP

GET /ir-api/v1/reports/intune.devices.windows-patch-level?size=100
GET /ir-api/v1/reports/intune.devices.windows-patch-level?filter=behind

An AI assistant reads it with the MCP tool get_report and the id intune.devices.windows-patch-level. The client needs the Read grant for Intune. See Using the API.