We value your privacy

We use cookies to analyse site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Intune and endpoint management
  3. Windows update rings
Windows update rings in Intune, UAE

Deleting an update ring does not remove its settings from devices. They keep whatever they had.

Microsoft states it plainly, and devices keep no historical record of previous settings. A ring deleted to undo a configuration leaves that configuration in place on every device it touched, which is the opposite of what most people expect.

Book an update ring reviewSee the controls
Windows update rings in Intune for UAE organisations
  • 35 daysMaximum pause, resettable by extending
  • 2 to 60 daysConfigurable feature update uninstall window
  • ImmediatelyHow fast an uninstall command reaches devices
  • wlidsvcThe service that must run for feature updates
The behaviour that surprises people

Deleting an update ring does not remove its settings from devices.

This is documented, logical once you know it, and responsible for a fair number of estates whose update behaviour nobody can explain.

  • The published behaviour is that deleting a ring from Intune does not modify the settings on devices that were assigned it. The device keeps its current settings, and devices do not maintain a historical record of what settings they held previously.
  • That means an estate that has had rings created, assigned, edited and deleted over several years can be carrying configuration from policies that no longer exist anywhere in the console, with nothing to indicate where the behaviour came from.
  • Devices can also receive settings from other update rings that remain active, so the effective configuration on a given device is the accumulated result rather than a reflection of any single ring you can currently see.
  • The way out is to define the rings you want, assign them deliberately to device groups, and verify the resulting configuration on real devices. The per setting status report is what tells you the true position rather than the intended one.
What update rings control

Eight things that determine whether your update strategy works.

Update rings are the oldest and most widely deployed Windows update mechanism in Intune, and several of their documented behaviours are counterintuitive. Three of them matter most during an incident, which is exactly when nobody has time to read documentation.

Client side behaviour, staged by group

Rings control deferral periods, restart settings, deadlines, active hours and user notifications. They are used to create deployment stages such as test, pilot and production by assigning different settings to different device groups, which is where the ring metaphor comes from.

Deleting a ring leaves the settings behind

Microsoft states that deleting a ring from Intune does not modify the settings on devices that were assigned it. The device keeps its current settings, and devices maintain no historical record of what they held previously. Deletion stops enforcement rather than reversing configuration.

Pause, and how the 35 days actually work

Pause prevents feature or quality updates for up to 35 days from the moment you pause. When the maximum passes, pause expires automatically and the device scans for applicable updates. Resuming and pausing again resets the period to 35 days, as does extending it.

A pause is not instant

Devices receive the pause command at their next check-in, and before that they might install a scheduled update. A device that is switched off when you issue the pause might download and install scheduled updates when it powers on, before it checks in with Intune.

Uninstall, which behaves urgently

Intune passes an uninstall request to devices immediately, removal is not limited to maintenance schedules even where those are configured in the ring, and if the removal requires a restart the device restarts without offering the user an option to delay.

The service that silently blocks feature updates

The Microsoft Account Sign-In Assistant service must be enabled and running. If it is disabled, Windows Update does not offer feature updates at all. In hardened builds where non-essential services were disabled, that is a hard-to-diagnose cause of devices never moving version.

Long term servicing channel limits

LTSC is supported for quality updates but not feature updates, so five ring controls do not apply: pausing feature updates, the feature update deferral period, the feature update uninstall period, enabling pre-release builds, and deadline settings for feature updates.

Three reports, answering different questions

Device and user check-in status as the default view, device assignment status showing every targeted device including those still pending assignment, and per setting status showing how each individual setting has landed across devices and users.

Two behaviours to know before an incident

Uninstall restarts devices without asking, and a bad feature update may not be removable at all.

The uninstall action is the emergency brake, and it behaves urgently in ways worth understanding before you reach for it.

  • Intune passes the uninstall request to devices immediately. Windows devices start removing the update as soon as they receive the policy change, removal is not limited to maintenance schedules even when those are configured in the ring, and if a restart is required the device restarts without offering the user an option to delay.
  • The window is finite and configurable. For feature updates the uninstall period runs from 2 to 60 days and is set by the feature update uninstall period setting. Devices that installed the update longer ago than that period have already removed the necessary files during maintenance and cannot roll back.
  • There is one case where it will not work regardless of timing: uninstallation will not be successful when the feature update was applied using an enablement package. That is worth knowing before rollback is your plan for a specific version transition.
  • Finally, an uninstall also pauses updates of the same type on that ring, and once the pause elapses devices reinstall the previously uninstalled update if it is still applicable. Rollback buys time rather than making a decision permanent, and the follow-up action has to be planned.
Ask us to build the rollback runbook
How we approach it

Four things that make update rings dependable.

Update ring problems are rarely about the settings themselves. They are about overlapping assignments nobody traced, a prerequisite nobody checked, and behaviour nobody read until an incident forced them to.

We check the service that silently blocks feature updates

The Microsoft Account Sign-In Assistant service must be enabled and running, and when it is disabled Windows Update does not offer feature updates. In estates with hardened builds where non-essential services were switched off, this explains devices that have never moved version despite correct policy.

We trace overlapping ring assignments

Devices can receive settings from more than one active ring, and deleting a ring leaves its settings on devices with no record of what they were before. That combination means an estate with overlapping rings has device configurations nobody can reconstruct from the console.

We assign to device groups rather than user groups

Microsoft recommends it directly, because device group assignment removes the need for a user to sign in before the policy can apply. In estates with shared machines or long-idle devices, that difference decides whether an update policy reaches the machine at all.

We write the rollback runbook before it is needed

Pause takes effect at next check-in and lasts 35 days. Uninstall reaches devices immediately, ignores maintenance schedules, and restarts without a user delay option. Neither of those is something to learn during the week a bad update is spreading through your estate.

How a review runs

Four phases across roughly four weeks.

Most estates have rings that were created once and never revisited, frequently overlapping in ways nobody has traced. Untangling that is where the value is.
  1. 01
    Week 1

    Map the rings and what they actually target

    Every ring, its settings, and the groups it targets, including overlaps. Devices can receive settings from more than one active ring, so overlapping assignments are the first thing to identify. Autopatch-managed devices are separated out, since custom rings should generally not be assigned to them.

    • Ring inventory with settings and assignments
    • Overlapping assignments identified
    • Autopatch-managed devices separated
    • LTSC devices identified with their control limits
  2. 02
    Week 2

    Fix the prerequisites that block updates silently

    The Microsoft Account Sign-In Assistant service checked as enabled and running across the estate, since feature updates are not offered when it is disabled. Endpoint reachability confirmed for Intune, Windows Update and Autopatch endpoints.

    • Sign-In Assistant service state verified across devices
    • Endpoint reachability confirmed
    • Devices not receiving feature updates investigated
    • Edition coverage checked against supported list
  3. 03
    Week 3

    Redesign the ring structure

    A clean set of rings representing test, pilot and production with device group assignment rather than user group assignment, since device groups remove the need for a user to sign in before policy applies. Overlaps removed rather than layered.

    • Ring structure redesigned with clear stages
    • Assignments moved to device groups
    • Overlapping assignments resolved
    • Scope tags applied where administration is delegated
  4. 04
    Week 4

    Write the runbook for a bad update

    The deliverable that matters when something goes wrong. What to pause and how quickly it takes effect, when uninstall is viable given the configured window, that uninstall restarts devices without warning, and that deleting a ring does not undo anything.

    • Pause and resume procedure with timing expectations
    • Uninstall decision criteria and window documented
    • Enablement package limitation recorded
    • Reporting views demonstrated to the operations team
Where this matters

Six situations where update ring design decides the outcome.

The recurring pattern is an estate where updates mostly work, a subset of devices quietly does not, and nobody has the reporting view that would show it.

An organisation with devices stuck on an old version

The single most common finding, and the cause is frequently the Microsoft Account Sign-In Assistant service being disabled, since Windows Update does not offer feature updates without it. That is a build problem rather than a policy problem, and it is invisible in the ring configuration.

An operator running LTSC on fixed function machines

LTSC is supported for quality updates and not feature updates, so pausing feature updates, feature deferral, the uninstall period, pre-release builds and feature deadline settings all do nothing there. Rings targeting mixed estates need those devices separated.

A business that needs to stop an update spreading

Pause is the right first action and it takes effect at next check-in, so devices that are switched off may install the update when they power on before receiving the command. Knowing that shapes how quickly the pause needs to be issued.

A provider that cannot accept a surprise restart

Uninstall removes updates as soon as devices receive the policy, ignores configured maintenance schedules, and restarts without offering the user a delay. On clinical or operational equipment that consequence needs to be weighed before the action rather than discovered after.

A regulated firm evidencing update currency

Per setting status shows how each individual setting has landed across devices and users, and device assignment status shows every targeted device including those still pending. Together they produce an evidenced answer rather than a statement of intent.

A company adopting Windows Autopatch alongside rings

Where Autopatch manages devices, it may create and maintain update rings itself, and Microsoft advises against assigning custom rings to Autopatch-managed devices. Estates running both need that boundary drawn explicitly rather than left to overlap.

Three positions

How UAE organisations manage Windows updates.

The middle column is the most common and its weakness is not the technology, it is that nobody has traced which ring applies to which device since the day they were created.
Staged rollout across groups
Rings designed and documentedYes
Rings created onceNominally
Default behaviourNo
Overlapping assignments resolved
Rings designed and documentedYes
Rings created onceUnknown
Default behaviourNot applicable
Assigned to device groups
Rings designed and documentedYes
Rings created onceMixed
Default behaviourNot applicable
Prerequisite service verified
Rings designed and documentedYes
Rings created onceNo
Default behaviourNo
Devices stuck on old versions found
Rings designed and documentedYes
Rings created onceDiscovered late
Default behaviourUnknown
Pause behaviour understood
Rings designed and documentedYes
Rings created oncePartly
Default behaviourNo
Rollback window known
Rings designed and documentedYes
Rings created onceNo
Default behaviourNo
Runbook exists for a bad update
Rings designed and documentedYes
Rings created onceNo
Default behaviourNo
Per setting status reviewed
Rings designed and documentedYes
Rings created onceRarely
Default behaviourNo
Autopatch devices handled separately
Rings designed and documentedYes
Rings created onceSometimes
Default behaviourNot applicable
Feature
Rings designed and documented
Rings created once
Default behaviour
Staged rollout across groups
YesNominallyNo
Overlapping assignments resolved
YesUnknownNot applicable
Assigned to device groups
YesMixedNot applicable
Prerequisite service verified
YesNoNo
Devices stuck on old versions found
YesDiscovered lateUnknown
Pause behaviour understood
YesPartlyNo
Rollback window known
YesNoNo
Runbook exists for a bad update
YesNoNo
Per setting status reviewed
YesRarelyNo
Autopatch devices handled separately
YesSometimesNot applicable
The five actions

What each policy action actually does.

These are the operational controls you will reach for during a bad update week, and each has behaviour that is not obvious from its name.
ActionWhat it does
DeleteStops enforcement, and leaves current settings on devices unchanged
PauseBlocks feature or quality updates for up to 35 days, then expires automatically
ResumeRestores updates, and a later pause restarts the 35 day period
ExtendResets the pause period for both update types back to 35 days
UninstallRolls back the latest feature or quality update, immediately
Uninstall side effectAlso pauses updates of the same type on that ring
After that pause elapsesDevices reinstall the uninstalled update if still applicable
Uninstall window, feature updates2 to 60 days, set by the uninstall period setting
Uninstall after an enablement packageWill not be successful
Quality update rollback visibilityStill listed in Windows update history afterwards
How an engagement runs

Five steps, and the first finds the devices nobody knew were stuck.

Reporting first, because the ring configuration usually looks fine and the device reality frequently does not match it.
  1. 1

    Read the reports before the configuration

    Device and user check-in status, device assignment status including devices pending assignment, and per setting status showing how each setting landed. That combination identifies the devices not behaving as the policy intends, which is the actual starting point.

  2. 2

    Check the prerequisites that block updates silently

    The Microsoft Account Sign-In Assistant service enabled and running, since feature updates are not offered without it, and reachability of the Intune, Windows Update and Autopatch endpoints. Both are easy to verify and both explain devices that never move.

  3. 3

    Untangle overlapping ring assignments

    Devices can receive settings from more than one active ring, and deleting a ring does not remove its settings from devices. Overlaps therefore accumulate into configurations nobody can reconstruct, and resolving them is more valuable than adjusting individual settings.

  4. 4

    Redesign around device groups and clear stages

    Test, pilot and production rings assigned to device groups rather than user groups, since device group assignment removes the need for a user to sign in before policy applies. Autopatch-managed devices excluded, and LTSC devices separated given their control limits.

  5. 5

    Write the runbook for the bad week

    Pause timing and its 35 day expiry, the extend and resume behaviour, the uninstall window between 2 and 60 days, the fact that uninstall restarts devices immediately without a user delay option, and that a feature update applied by enablement package cannot be uninstalled.

Straight answers

What organisations ask about Windows update rings.

No. Microsoft states that deleting a ring from Intune does not modify the settings on devices that were assigned it. The device keeps its current settings, and devices maintain no historical record of what they held before. Deleting stops enforcement rather than reversing configuration.

Up to 35 days from the moment you pause. After the maximum passes, pause expires automatically and the device scans Windows Update for applicable updates. Resuming and pausing again resets the period to 35 days, and extending a paused ring also resets it to 35.

No. Devices receive the pause command at their next check-in, and before that they might install a scheduled update. A device that is switched off when you issue the pause might download and install scheduled updates when it powers on, before it checks in with Intune.

Yes, using uninstall, with conditions. Intune passes the request to devices immediately, removal is not limited to maintenance schedules even where those are configured in the ring, and if a restart is required the device restarts without offering the user an option to delay.

Between 2 and 60 days, set by the feature update uninstall period setting on the ring. Devices that installed the update longer ago than the configured period have removed the necessary files during maintenance and can no longer uninstall it.

Yes. Uninstallation will not be successful when the feature update was applied using an enablement package. That is worth establishing before rollback becomes your contingency plan for a particular version transition, because it removes the option entirely.

No. Initiating an uninstall also pauses updates of the same type on that ring, and once that pause elapses devices reinstall the previously uninstalled update if it is still applicable. Rollback buys time to fix the underlying problem rather than closing the question.

Check the Microsoft Account Sign-In Assistant service. Microsoft states it must be enabled and running, and that if it is disabled Windows Update does not offer feature updates. In estates with hardened builds where non-essential services were disabled, this is a frequent and well-hidden cause.

For quality updates, yes. Not for feature updates, and consequently five ring controls do not apply: pausing feature updates, the feature update deferral period, the feature update uninstall period, enabling pre-release builds, and deadline settings for feature updates.

Device groups, and Microsoft recommends it directly. Using device groups removes the need for a user to sign in to a device before the policy can apply, which matters for shared machines, kiosks and any device that sits idle for periods.

It can receive settings from more than one active ring, which is why overlapping assignments are worth tracing rather than tolerating. Combined with the fact that deleting a ring leaves settings behind, overlaps produce device configurations that are difficult to reconstruct later.

Per setting status, which shows the configuration status of each individual setting across all devices and users. Device assignment status shows every device targeted by the policy including those in a pending assignment state, which is a different and equally useful question.

Where Autopatch manages devices, update rings may be created and maintained by the service itself to implement rollout cadence and restart behaviour. Microsoft advises that administrators typically should not assign custom update rings to Autopatch-managed devices in those scenarios.

Microsoft Intune Plan 1. Supported Windows editions are Pro, Pro Education, Enterprise, Education, Windows IoT Enterprise, Windows Team for Surface Hub devices, and Windows Holographic for Business which supports a subset of the settings.

We scope by device count and how many rings exist. The free first step: open per setting status on your main ring and look for settings that have not applied everywhere. That list is usually the fastest route to the devices nobody realised were behind.

Up to 35 days from the time you pause the ring. After the maximum has passed, pause functionality automatically expires and the device scans Windows Update for applicable updates. Resuming and pausing again resets the period to 35 days.

Devices. The documented tip is to assign update rings to device groups, because using device groups removes the need for a user to sign on to a device before the policy can apply, which matters for shared and infrequently used hardware.

Intune passes the request to devices immediately and removal starts as soon as they receive the policy change. Removal is not limited to maintenance schedules, and if a restart is required the device restarts without offering the user an option to delay.
Configuration review

Fifteen questions about your own update rings.

The second group is where estates find the devices that have quietly not moved version in two years, and the reason is usually the same one.

Structure

  • How many rings do we have?
    And what each is for.
  • Do any assignments overlap?
    Devices can get settings from several.
  • Are rings assigned to device groups?
    Recommended over user groups.
  • Are Autopatch devices excluded?
    Custom rings should not target them.
  • Any LTSC devices in scope?
    Five feature update controls do not apply.

Blocked updates

  • Is the Sign-In Assistant service running?
    Feature updates need it.
  • Any devices stuck on an old version?
    Check that service first.
  • Can devices reach Windows Update endpoints?
    A stated prerequisite.
  • Are all editions supported?
    Pro, Enterprise, Education and others.
  • Do we check per setting status?
    It shows what actually landed.

Emergency actions

  • Does anybody know pause is 35 days?
    And that it expires automatically.
  • Do we know pause is not instant?
    It applies at next check-in.
  • What is our uninstall period set to?
    Between 2 and 60 days.
  • Does the team know uninstall forces a restart?
    With no user delay option.
  • Is there a written runbook?
    For the week it matters.
Related reading

The pages around this one.

Windows Autopatch

The managed alternative, where the service maintains the rings.

Learn more

Intune endpoint analytics

Device performance and reliability alongside update state.

Learn more

Intune configuration profiles

The wider settings delivery mechanism.

Learn more
Next step

Open per setting status on your main update ring and look for settings that did not apply everywhere.

That report shows how each individual setting landed across devices. It is the fastest route to the machines that are quietly behind, and the reason is frequently a service nobody thought to check.

Book an update ring reviewCall +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Windows Autopatch

Security updates without a restart, and Business Premium has it

Learn more

Endpoint Analytics

Measured device experience, and the refresh evidence

Learn more

Intune Configuration Profiles

Settings catalog, templates and conflict management

Learn more

Intune Compliance Policies

The default that lets unassessed devices through Conditional Access

Learn more

Co-Management

ConfigMgr and Intune, deliberately together

Learn more

MDM Solutions Dubai

Device management across Windows, Apple and Android

Learn more

Microsoft Intune

Device management and endpoint security

Learn more

Endpoint Security

Defender for Endpoint and Intune managed

Learn more
GR IT SERVICES

Leading IT services provider in Dubai,
delivering enterprise-grade solutions
for businesses across the UAE.

Microsoft CSP PartnerCISGuard

Get the Helpdesk app

Raise and track IT tickets from your phone.

Download on the App StoreGet it on Google Play
Learn more about the app

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support Dubai
  • IT AMC Dubai
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • Iris Bay Tower, Office 903,
    Business Bay, Dubai, UAE
  • +971 56 613 2743
  • hello@gritservices.ae
  • gritservices.ae

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie Policy