Configure Windows Update for Business reporting

Since March 31, 2023, Update Compliance is not available anymore to have insights into the Windows update status of our Intune-managed (Windows) devices. Therefore we need to enroll in Windows Update for Business Reports since that date to replace these update reports.

Although by following the Microsoft docs we can most likely figure out what the requirements are for Windows Update for Business (WUfB) Reports and how to configure this, certainly if you’re managing an existing tenant it can be not completely clear what settings are still needed and which settings are not needed anymore (that we need to deploy with Microsoft Intune). For example, the deployment of the Commercial ID is not needed anymore. So let me sum up what we need to configure to enable everything for Windows Update for Business Reports.

By enabling Windows Update Reports we get our update-related data available in Log Analytics Workspace, like we had with Update Compliance. Besides that, Microsoft made an Azure Workbook available for visibility in a nice report.

Prerequisites

There are some prerequisites for Windows Update for Business Reports:

• An Azure subscription with Azure Active Directory
• Devices must be Azure Active Directory-joined and meet the below OS, diagnostic, and endpoint access requirements. Devices can be Azure AD joined or hybrid Azure AD joined.
• Devices that are Azure AD registered only (Workplace joined) aren’t supported with Windows Update for Business reports.
• The Log Analytics workspace must be in a supported region
• Data in the Driver update tab of the workbook is only available for devices that receive driver and firmware updates from the Windows Update for Business deployment service

Read the latest Microsoft docs on the latest prerequisites and the different permissions to enable the reports and the role(s) to read the Windows Update data.

Currently, only Windows 10/ 11 Professional, Education, and Enterprise (multi-session) editions are supported.

Enable Windows Update for Business Reports

We have two options to enable Windows Update for Business reports, via the Azure Portal (the recommended method by Microsoft) or via the Microsoft 365 admin center. No matter which of the two options we use, we need a Log Analytics Workspace to store our data.

I you don’t have a Log Analytics (LA) Workspace yet, create one in the Azure portal.

As long as you make sure your LA Workspace is in one of the supported regions, you’re good to go.

To enable the reports via the Azure portal open the Monitor service in the Azure portal.
On the left, you’ll find Workbooks. On the Workbooks tab, you’ll find Windows update for Business report under Insights.

Click Get started to configure the report.

Here we need to select the subscription and the Azure LA Workspace we previously created (or you already had available) to store our data.
As soon as we click Save settings everything on the Azure side will be made ready for our report.

It can take up to 24 hours before the report is ready!
But don’t panic when it takes some longer, at my latest implementation it took about 48 hours.

The second option is to enable the Windows Update for Business report via the Microsoft 365 admin center.
Browse to Health and Software Updates. On the Windows tab, we can enable the reports. just hit Configure settings.

Also here we need to select a subscription and LA Workspace.

Enable Windows Diagnostics data

One of the other requirements is to turn on Windows Diagnostics data in the Microsoft Intune admin center. This is also a requirement for Windows for Business Reports in Azure although I previously thought this switch is only related to the Feature and Expedite reports in Intune. But luckily we have people from Microsoft to put us in the right direction on Twitter.

It is described in the Diagnostics data requirements section in this documentation. So it seems by switching this setting on in Intune, we switch on Windows Diagnostics level to the minimum required.

In Microsoft Intune, this option is found under Tenant administration, Connectors and tokens, Windows data.
Switch on the toggle and click Save.

Configure the Windows clients

The ‘server’ side is configured and ready, but we also need to configure our Windows clients. We have several options to configure our clients, but I take the Microsoft Intune option.

In Microsoft Intune, we can use a Settings Catalog profile to deploy the required settings.

Provide a name and (optional) description.

We need to configure four settings on our devices:

• Allow device name to be sent in Windows diagnostics data: Allowed
• Configure Telemetry Opt In Settings Ux: Disable Telemetry opt-in Settings
• Configure Telemetry Opt In Change Notification: Disable telemetry change notification
• Allow Telemetry: Basic (or a higher level)

We can search for the settings, but the four settings are found under the System section.

All other Windows update-related settings which we deployed previously for Update Compliance, like the Commercial ID, can be removed from our existing configuration profiles.

The reports and data available in Azure

With the reports enabled in Azure and the settings deployed to our clients, we can just sit back and wait for the first machines to show up in our Azure Workbook.

And the date is available in Log Analytics.

Windows Update reports in Microsoft Intune

While we’re at it, let’s also briefly have a look at the Windows update related reporting we can have available in the Microsoft Intune portal.

When we make use of a Feature Update or Quality (Expedite) Update profile and deploy it to our Windows devices we get new Windows update reports available.

When only using Windows Update rings in Intune, we don’t get the below reports available (at the moment of writing).
This provides us with reports like the Windows Feature Update Report and Windows Feature Update Device Readiness Report.

An example of the Feature update report.

One big note to this; Some Intune features require specific Windows licensing to use them. Features including the Windows 11 Upgrade Readiness report require Windows license verification.

This is an additional setting on the Windows data tab, under the connectors and tokens in the Intune portal.

A benefit of these reports in Intune is they honor the Intune scope tags, thus they support Intune RBAC.

That’s it for this post. I’ll hope you find it useful to have the Windows Update-related settings that we need to configure for our clients described in one row.