Close Menu
Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Facebook X (Twitter) Instagram
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    • Home
    • Intune
    • Windows
      • Modern Workplace
    • macOS
    • Android
    • iOS
    • Automation
      • Logic Apps
      • Intune Monitoring
      • GitHub
    • Security
      • Passwordless
      • Security
    • Speaking
    • About me
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Home»Intune»Configure Windows Update for Business reporting
    Intune

    Configure Windows Update for Business reporting

    Peter KlapwijkBy Peter KlapwijkJune 8, 2023Updated:June 8, 202316 Mins Read

    Since March 31, 2023, Update Compliance is not available anymore to have insights into the Windows update status of our Intune-managed (Windows) devices. Therefore we need to enroll in Windows Update for Business Reports since that date to replace these update reports.

    Although by following the Microsoft docs we can most likely figure out what the requirements are for Windows Update for Business (WUfB) Reports and how to configure this, certainly if you’re managing an existing tenant it can be not completely clear what settings are still needed and which settings are not needed anymore (that we need to deploy with Microsoft Intune). For example, the deployment of the Commercial ID is not needed anymore. So let me sum up what we need to configure to enable everything for Windows Update for Business Reports.

    By enabling Windows Update Reports we get our update-related data available in Log Analytics Workspace, like we had with Update Compliance. Besides that, Microsoft made an Azure Workbook available for visibility in a nice report.

    Prerequisites

    There are some prerequisites for Windows Update for Business Reports:

    • An Azure subscription with Azure Active Directory
    • Devices must be Azure Active Directory-joined and meet the below OS, diagnostic, and endpoint access requirements. Devices can be Azure AD joined or hybrid Azure AD joined.
    • Devices that are Azure AD registered only (Workplace joined) aren’t supported with Windows Update for Business reports.
    • The Log Analytics workspace must be in a supported region
    • Data in the Driver update tab of the workbook is only available for devices that receive driver and firmware updates from the Windows Update for Business deployment service

    Read the latest Microsoft docs on the latest prerequisites and the different permissions to enable the reports and the role(s) to read the Windows Update data.

    Currently, only Windows 10/ 11 Professional, Education, and Enterprise (multi-session) editions are supported.

    Enable Windows Update for Business Reports

    We have two options to enable Windows Update for Business reports, via the Azure Portal (the recommended method by Microsoft) or via the Microsoft 365 admin center. No matter which of the two options we use, we need a Log Analytics Workspace to store our data.

    I you don’t have a Log Analytics (LA) Workspace yet, create one in the Azure portal.

    As long as you make sure your LA Workspace is in one of the supported regions, you’re good to go.

    To enable the reports via the Azure portal open the Monitor service in the Azure portal.
    On the left, you’ll find Workbooks. On the Workbooks tab, you’ll find Windows update for Business report under Insights.

    Click Get started to configure the report.

    Here we need to select the subscription and the Azure LA Workspace we previously created (or you already had available) to store our data.
    As soon as we click Save settings everything on the Azure side will be made ready for our report.

    It can take up to 24 hours before the report is ready!
    But don’t panic when it takes some longer, at my latest implementation it took about 48 hours.

    The second option is to enable the Windows Update for Business report via the Microsoft 365 admin center.
    Browse to Health and Software Updates. On the Windows tab, we can enable the reports. just hit Configure settings.

    Also here we need to select a subscription and LA Workspace.



    Enable Windows Diagnostics data

    One of the other requirements is to turn on Windows Diagnostics data in the Microsoft Intune admin center. This is also a requirement for Windows for Business Reports in Azure although I previously thought this switch is only related to the Feature and Expedite reports in Intune. But luckily we have people from Microsoft to put us in the right direction on Twitter.

    All of Windows Update for Business Reports requires Windows Diagnostic Data level = Required

    See this link for more details on requirements for #WUfB Reports:https://t.co/NQ4N7jLIRl

    — ariaupdated (@ariaupdated) June 5, 2023

    It is described in the Diagnostics data requirements section in this documentation. So it seems by switching this setting on in Intune, we switch on Windows Diagnostics level to the minimum required.

    In Microsoft Intune, this option is found under Tenant administration, Connectors and tokens, Windows data.
    Switch on the toggle and click Save.

    Configure the Windows clients

    The ‘server’ side is configured and ready, but we also need to configure our Windows clients. We have several options to configure our clients, but I take the Microsoft Intune option.

    In Microsoft Intune, we can use a Settings Catalog profile to deploy the required settings.

    Provide a name and (optional) description.

    We need to configure four settings on our devices:

    • Allow device name to be sent in Windows diagnostics data: Allowed
    • Configure Telemetry Opt In Settings Ux: Disable Telemetry opt-in Settings
    • Configure Telemetry Opt In Change Notification: Disable telemetry change notification
    • Allow Telemetry: Basic (or a higher level)

    We can search for the settings, but the four settings are found under the System section.

    All other Windows update-related settings which we deployed previously for Update Compliance, like the Commercial ID, can be removed from our existing configuration profiles.

    The reports and data available in Azure

    With the reports enabled in Azure and the settings deployed to our clients, we can just sit back and wait for the first machines to show up in our Azure Workbook.

    And the date is available in Log Analytics.

    Windows Update reports in Microsoft Intune

    While we’re at it, let’s also briefly have a look at the Windows update related reporting we can have available in the Microsoft Intune portal.

    When we make use of a Feature Update or Quality (Expedite) Update profile and deploy it to our Windows devices we get new Windows update reports available.

    When only using Windows Update rings in Intune, we don’t get the below reports available (at the moment of writing).
    This provides us with reports like the Windows Feature Update Report and Windows Feature Update Device Readiness Report.

    An example of the Feature update report.

    One big note to this; Some Intune features require specific Windows licensing to use them. Features including the Windows 11 Upgrade Readiness report require Windows license verification.

    This is an additional setting on the Windows data tab, under the connectors and tokens in the Intune portal.

    A benefit of these reports in Intune is they honor the Intune scope tags, thus they support Intune RBAC.

    That’s it for this post. I’ll hope you find it useful to have the Windows Update-related settings that we need to configure for our clients described in one row.

    Intune Microsoft Endpoint Manager Windows Windows 10 Windows 11 Windows Update
    Share. Facebook Twitter LinkedIn Email WhatsApp
    Peter Klapwijk
    • Website
    • X (Twitter)
    • LinkedIn

    Peter is a Security (Intune) MVP since 2020 and is working as Modern Workplace Engineer at Wortell in The Netherlands. He has more than 15 years of experience in IT, with a strong focus on Microsoft technologies like Microsoft Intune, Windows, and (low-code) automation.

    Related Posts

    Get notifications of missing devices in Windows Update for Business reports

    June 3, 2024

    Connect to Azure file shares with Microsoft Entra Private Access

    May 24, 2024

    Intune Driver update for Windows – Get applicable devices

    July 11, 2023
    View 1 Comment

    1 Comment

    1. Ashish Arya on October 1, 2024 11:39

      HI Peter,

      I have a question and would appreciate if you can answer this.

      After configuring Windows update for business reports for my Intune devices.
      How can I find the Table name in the log analytics workspace that has the correct update installation date so that I can use that information in my workbook.

      Reply
    Leave A Reply Cancel Reply

    Peter Klapwijk

    Hi! Welcome to my blog post.
    I hope you enjoy reading my articles.

    Hit the About Me button to get in contact with me or leave a comment.

    Awards
    Sponsor
    Latest Posts

    Hide the “Turn on an ad privacy feature” pop-up in Chrome with Microsoft Intune

    April 19, 2025

    How to set Google as default search provider with Microsoft Intune

    April 18, 2025

    Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs

    April 13, 2025

    Using Visual Studio with Microsoft Endpoint Privilege Management, some notes

    April 8, 2025
    follow me
    • Twitter 4.8K
    • LinkedIn 6.1K
    • YouTube
    Tags
    Administrative Templates Android Automation Autopilot Azure Azure AD Browser Conditional Access Edge EMS Exchange Online Feitian FIDO2 Flow Google Chrome Graph Graph API Identity Management Intune Intune Monitoring iOS KIOSK Logic Apps macOS MEM MEMMonitoring Microsoft 365 Microsoft Edge Microsoft Endpoint Manager Modern Workplace Office 365 OneDrive for Business Outlook Passwordless PowerApps Power Automate Security SharePoint Online Teams Windows Windows 10 Windows10 Windows 11 Windows Autopilot Windows Update
    Copy right

    This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors, or In The Cloud 24-7.

     

    Copyright © 2025 by In The Cloud 24-7/ Peter Klapwijk. All rights reserved, No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

    Shorthand; Don’t pass off my work as yours, it’s not nice.

    Recent Comments
    • Peter Klapwijk on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • John M on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • Christoffer Jakobsen on Connect to Azure file shares with Microsoft Entra Private Access
    • Ludo on How to block Bluetooth file transfer with Microsoft Intune
    • RCharles on Automatically configure the time zone (during Autopilot enrollment)
    most popular

    Application installation issues; Download pending

    October 1, 2024

    Restrict which users can logon into a Windows 10 device with Microsoft Intune

    April 11, 2020

    How to change the Windows 11 language with Intune

    November 11, 2022

    Update Microsoft Edge during Windows Autopilot enrollments

    July 9, 2024
    Peter Klapwijk – In The Cloud 24-7
    X (Twitter) LinkedIn YouTube RSS
    © 2025 ThemeSphere. Designed by ThemeSphere.

    Type above and press Enter to search. Press Esc to cancel.

    Manage Cookie Consent
    To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
    Functional Always active
    The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
    Preferences
    The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
    Statistics
    The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
    Marketing
    The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
    Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
    View preferences
    {title} {title} {title}