To approve Windows quality updates in Intune, create a policy at Devices > Manage updates > Windows updates > Quality updates, choose automatic or manual approval for each update category, and assign it to eligible devices. Use update rings separately to control deferrals, deadlines, restarts, active hours, and notifications; use an expedite policy only when a particular eligible update needs faster deployment.
What a quality update approval policy controls
A Windows quality update policy is the cloud-based approval and orchestration layer for supported Windows quality updates. It can set approval behavior for monthly security updates, monthly non-security preview updates, and out-of-band updates. Supported .NET Framework updates can follow the same settings, subject to the exceptions below. See Microsoft’s Windows quality updates and .NET Framework updates documentation.
As an Amazon Associate I earn from qualifying purchases.
The policy does not replace an update ring. Rings configure the Windows Update client’s installation and restart experience. The approval policy determines whether supported update content is approved automatically or requires an administrator’s approval.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose an approval mode
| Mode | What happens | When it fits |
|---|---|---|
| Automatic approval | Updates are approved automatically. You can set a delay with Make updates available after. | Microsoft recommends this for security updates where timely servicing is important. |
| Manual approval | An administrator must explicitly approve updates before they are deployed. | Useful for optional releases or cases that require strict change control or additional testing. Delaying critical updates can harm security compliance. |
Microsoft’s documented defaults are automatic approval for monthly security updates and manual approval for other update types. Its guidance states: “Windows Autopatch recommends automatic approvals for security updates and manual approvals for optional updates.” The available settings and categories are described in Microsoft’s approval policy documentation.
#1 Best Overall
- STREAMLIMED AND INTUITIVE UI | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- JOIN YOUR BUSINESS OR SCHOOL DOMAIN for easy access to network files, servers, and printers.
- OEM IS TO BE INSTALLED ON A NEW PC WITH NO PRIOR VERSION of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE PRODUCT SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
Before you create the policy
Check eligibility before assigning the policy. The Windows Autopatch-backed workflow requires devices to be enrolled in Intune, Entra joined or hybrid joined, able to reach Microsoft update endpoints, and covered by a Windows license that includes Autopatch entitlement. Entra-registered devices are not supported for policy types using this backend, including quality update policies. See Microsoft’s Windows Update Management overview for current management prerequisites.
- Confirm the intended device groups and rollout sequence, such as test, pilot, then production.
- Check existing Autopatch management. Autopatch may create and maintain update rings for Autopatch-managed devices; administrators typically should not assign custom rings to those devices.
- Verify the tenant’s displayed admin-center labels, which can change as Intune evolves.
Create and assign a quality update policy
- In the Intune admin center, go to Devices > Manage updates > Windows updates > Quality updates.
- Select Create, then select Windows quality update policy.
- Enter a recognizable policy name.
- Under Settings, choose automatic or manual approval behavior for the available security, non-security, and out-of-band update categories.
- For automatic approval, set Make updates available after to the delay you want, in days. Manual approval instead waits for an administrator to approve an update.
- Continue through scope tags and assignments, then target the device groups intended to receive the policy.
- Review the rollout against your change-control process and monitor its status in Intune.
For the current creation flow and setting details, use Microsoft’s quality update policy instructions.
Rank #2
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
Configure update rings for installation and restart behavior
Create or review update rings separately from the approval policy. Rings manage client-side settings such as quality-update deferrals, deadlines, restart behavior, active hours, and notifications. Microsoft’s Update Rings Policy Settings reference gives the quality-update deferral range as 0–30 days. That ring deferral is distinct from the automatic-approval delay in a quality update policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use Microsoft’s update ring guidance to stage deployment and configure client behavior. Review overlapping assignments and settings so the ring and approval policy implement the same intended servicing plan.
Rank #3
- Instantly productive. Simpler, more intuitive UI and effortless navigation. New features like snap layouts help you manage multiple tasks with ease.
- Smarter collaboration. Have effective online meetings. Share content and mute/unmute right from the taskbar (1) Stay focused with intelligent noise cancelling and background blur.(2)
- Reassuringly consistent. Have confidence that your applications will work. Familiar deployment and update tools. Accelerate adoption with expanded deployment policies.
- Powerful security. Safeguard data and access anywhere with hardware-based isolation, encryption, and malware protection built in.
Use expedite only for a selected urgent update
An expedite policy is for accelerating one selected eligible update—not for setting the normal approval schedule for future updates. It overrides applicable quality-update deferrals for that update. Create the expedite policy for the selected release and assign it to the devices that need it.
Expedite does not mean installation starts immediately or at a guaranteed time. Devices must connect, scan, and communicate with the service; installation start depends on connectivity and service processing. Microsoft also documents additional requirements, including supported Windows editions and in-support builds, direct Windows Update delivery, and Update Health Tools. Preview builds are not supported for expedited updates. Check the current expedite policy requirements and workflow before deployment.
Rank #4
- Video Link to instructions and Free support VIA Amazon
- 24/7 Tech Support!
- key code included
Understand update coverage and exceptions
Quality update approval settings cover OS monthly security updates, monthly non-security preview updates, and out-of-band security and non-security updates. Supported .NET Framework updates follow the same policy settings in documented scenarios. Two exceptions matter: Windows 10 devices enrolled in ESU continue receiving .NET Framework updates through Windows Update based on client-side settings, and .NET Framework 3.5 updates are not managed through this quality policy workflow. Microsoft’s coverage documentation details these cases.
Quick Recap
Common configuration decisions
- Use automatic approval with a delay when routine security servicing should proceed on a predictable schedule but needs a short staged availability window.
- Use manual approval selectively when a non-security release needs explicit review or special validation; include an owner and approval cadence so updates do not remain unapproved indefinitely.
- Use rings for the user experience rather than treating approval delay as a substitute for deferrals, restart controls, or deadlines.
- Use expedite for a particular urgent release and verify its eligibility and connectivity prerequisites before expecting devices to install it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
