Monthly security updates
Cumulative monthly updates include earlier security fixes and non-security changes previewed the month before.
Managed IT services
Patch management for your business computers
Windows updates and application updates are rolled out on a schedule, a pilot group first, and you see which computers are current.
Managed patching for Lowcountry operations
Monthly Windows and application updates are rolled out on a schedule. Reports show which machines have current patches, which are missing them and which are waiting for a restart.
Kept current list
Systematic patch rollout
Monthly updates handled on a schedule
Microsoft Intune update rings, groups of computers that receive an update in turn, test a small pilot group first. Updates are rolled out on a schedule, and you see exactly which machines are current.
- 1
Pilot group goes first
Small groups of computers receive updates first. Early testing ensures patches function correctly before reaching the rest of your organization.
- 2
Pending restarts reported separately
Computers that downloaded an update but have not restarted are still unprotected. We report these machines separately so you know exactly what requires a restart.
- 3
Patch status in monthly report
Patch status is part of the monthly customer report. You get a plain list showing which computers are current and which missed an update.
Following Patch Tuesday and Microsoft releases
Microsoft sets the schedule for standard operating system updates. Intune update rings group machines so a small pilot group receives patches first. Rings can defer monthly updates by zero to thirty days and feature updates by zero to 365 days.
Select a release event
SunMonTueWedThuFriSat
12345678910111213141516171819202122232425262728293031
Any dayOut-of-band updates and actively exploited flaws
Once a yearFeature update
Microsoft sets the release dates and the calendar is an example month.
Release
What it is
In the rollout
Real views from Microsoft Intune
Microsoft Intune manages your devices and their update policies. Screens here demonstrate how rings are configured and how status is tracked across an organization.
Screens shown here are Microsoft's own documentation screenshots with sample data, not a customer's computers.
Managing Windows updates and applications
Keeping systems current requires handling multiple types of patches. System updates and third-party software are tracked to ensure your business remains protected.
Optional preview updates
Non-security preview updates can be tested in advance to ensure compatibility before the next monthly security update.
Out-of-band updates
Fixes for recently identified issues or vulnerabilities are published outside the regular monthly schedule.
Feature updates
Major Windows upgrades arrive once a year and receive support for 24 to 36 months, depending on your edition.
Pilot group
Microsoft Intune update rings group machines so a small pilot group receives updates before everyone else.
Deferral until proven
Quality updates can be deferred up to 30 days and feature updates up to 365 days until they prove stable.
Browsers and PDF readers
Third-party applications have their own update cycles and vulnerabilities that must be addressed alongside operating system patches.
Business applications
Line-of-business software requires systematic patching rolled out on a schedule to ensure complete coverage.
Pending restarts
Machines that downloaded an update but have not restarted are still unprotected, which is why pending restarts are reported separately.
Windows 10 computers
Windows 10 reached end of support on October 14, 2025 and no longer receives monthly security updates.
Preparing your deployment rings
Establishing a systematic rollout requires grouping your machines into deployment rings and defining schedules. Small pilot groups receive updates first before reaching the remaining computers.
- 1
List every computer
Identifying every machine is the first step. Each device has its own page in Intune showing its name, primary user, operating system and compliance state.
- 2
Sort computers into rings
Grouping machines creates the structure for staged deployments. Microsoft Intune update rings organize computers so a small pilot group receives patches before everyone else.
- 3
Set the deferral limits
Policies restrict updates for up to 30 days for quality patches. Feature updates can wait up to 365 days to ensure stability.
- 4
Roll out pilot group first
Early deployment hits a small set of computers initially. Validating the patch on a few machines protects the rest of your organization.
- 5
Report current, missing and waiting
Ongoing reporting lists exactly which machines have current updates. Separate columns highlight computers missing a patch or waiting for a restart.
Common questions about patch management
- When does Microsoft release updates?
Microsoft publishes the Windows monthly security update on the second Tuesday of each month, typically at 10:00 AM Pacific time. It is called Patch Tuesday. Optional preview updates arrive in the fourth week.
- What happens to a computer that has not restarted?
A machine that has downloaded an update but not restarted is still unprotected. Pending restarts are reported separately so managers know exactly which devices require a reboot to finish the installation.
- What is a pilot group?
Microsoft Intune update rings group machines so that a small pilot group receives updates before everyone else. Testing on a small scale ensures stability before the entire office receives the patch.
- Can a feature update wait?
Feature updates can be deferred until they have been proven stable. An Intune update ring can defer feature updates by zero to 365 days, keeping major changes off your computers.
- What happens to Windows 10 computers?
Windows 10 reached end of support on October 14, 2025 and no longer receives monthly security updates. Call (844) 422-7000 to discuss your business computers.
- What happens when a flaw is being actively exploited?
Patches for flaws on CISA's list of actively exploited vulnerabilities are handled by the rapid patching service, without waiting for the monthly schedule. Rapid patching has its own dedicated page.
- What does patch management cost?
Prices are not stated here. Give us a call at (844) 422-7000 to discuss your computers, locations and needs, and we can provide an exact quote for your business.
Keep your computers current and functioning
Call (844) 422-7000 or book a walkthrough to see how scheduled patch management works.
CharlestonMount PleasantNorth CharlestonIsle of PalmsFolly BeachKiawahBeaufortBlufftonHilton HeadSavannah