Back up Intune update rings

Which backup selections include rings, feature updates and hotpatch?

An update maintenance change can affect several objects with different names and different targets. TenuVault saves update rings as device configuration profiles, so selecting only the Windows updates area misses the ring itself.

The Windows updates area documents feature update profiles, expedited quality update profiles, hotpatch quality update policies and driver update profiles, each with assignments. Check which of these exist in your tenant. Do not treat the category as a backup of update binaries, device patch history or a completed deployment.

Can I save Windows Update policy settings in Intune?

Microsoft separates update ring settings from feature, quality and driver update policy management. Rings control client behavior such as deferrals, restart settings and notifications, while feature update policies control the Windows version offered.

You can inspect each policy in Intune and record its settings before a change. Keep that record by policy type. A screenshot of the ring does not document a separate feature or quality policy assigned to the same devices. Follow the export guide if you need to choose a reusable file format.

• Microsoft: manage this configuration
• Compare Intune policy export formats

How do I back up Intune update rings?

Map the update rollout by object type before changing its schedule. The ring, target Windows release and driver approvals can belong to separate policies, with different assignments that must be checked together.

1. Select Device configuration profiles in Custom to capture the Windows update rings themselves.
2. Within Windows updates, include the applicable feature, expedited quality, hotpatch quality and driver update profiles.
3. Run the backup before adjusting rollout timing, and investigate any missing update profile before proceeding with the change.
4. Check the saved ring under Device configuration in Backup Details, then inspect the separate Windows updates area. Match the policies to the pilot and production stages in your rollout plan.

• Prepare and verify your first Intune backup
• Review Intune backup scope and storage

Does restoring an update policy roll back installed updates?

Use Create copies with assignments off to inspect saved configuration. For production recovery, Pro and MSP offer Replace in place and Restore assignments. Existing supported policies are returned to the backed-up version; deleted policies are recreated with new IDs.

Assignment restoration replaces the current groups and filters with those recorded in the backup. Review the complete set before enabling it, especially when a ring represents a pilot stage. A restored feature update policy does not downgrade a device that already runs a newer Windows version. Policy recovery is separate from operating-system recovery.

• Review restore modes and plan requirements

How do I check a recovered pilot update ring?

Compare the saved ring settings with the policy in Intune, then review the separate update policies that target the same pilot devices. Check restart behavior and the intended rollout scope before restoring assignments. Preserve the pre-change snapshot until the production rollout is verified.

After applying a reviewed recovery, use Microsoft update reporting to assess the devices. A successful restore result establishes the policy operation, not that a machine installed or removed an update. Record both the policy result and the follow-up device checks in your change ticket.

Try an update-ring backup on your tenant before the next maintenance change. Download TenuVault, capture the pilot ring and its related update profiles, and compare an unassigned recovery copy. Keep the recorded policy result separate from the device reporting that shows whether Windows actually received an update.

• Download TenuVault for Windows or macOS
• Plan an Intune restore drill
• Back up Conditional Access separately