Windows Update Compliance

The question it answers: Are the Windows Update rings set up so security updates actually land - no pause, a short deferral and an installation deadline?

Are the update rings set up so security updates actually land - no pause, a short deferral, an installation deadline - and which Windows devices are behind the rest of the fleet on their monthly patch?

Note

Covers Windows Update for Business rings. Windows Autopatch, feature-update profiles and per-update (KB) reporting are not read here; Intune’s own Windows Update reports go deeper.

At a glance

Where in the app	Intune › Windows Update Compliance
Workload	Intune
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Intune.
Report id (API and MCP)	intune.devices.windows-update-compliance
Tabs on its page	Windows Patch Level

Columns

Column	Key	Type
Ring	DisplayName	Text
Status	Severity	Status
Findings	FindingsString	Text
Quality deferral	QualityDeferralDays	Text
Feature deferral	FeatureDeferralDays	Text
Deadlines	DeadlineDisplay	Text
Devices	AssignedDevices	Text
Succeeded	SuccessCount	Text
Error / failed	ErrorCount	Text
Conflict	ConflictCount	Text

What it needs

Licence: Microsoft Intune.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
DeviceManagementConfiguration.Read.All	Microsoft Graph	Read Microsoft Intune device configuration and policies

Data sources it reads

• GET /v1.0/deviceManagement/deviceConfigurations
• GET /v1.0/deviceManagement/deviceConfigurations/{id}/deviceStatusOverview

Through the API and MCP

GET /ir-api/v1/reports/intune.devices.windows-update-compliance?size=100

An AI assistant reads it with the MCP tool get_report and the id intune.devices.windows-update-compliance. The client needs the Read grant for Intune. See Using the API.