How Essential Eight patching on Windows and Intune works in practice
The organization owns its patch deadlines and the evidence that proves them. An implementation partner can configure Windows Update for Business, Configuration Manager, Intune and Defender Vulnerability Management so that patches move through the estate on a predictable schedule, but only an independent assessor judges the resulting maturity level. The answer to "how fast must we patch?" is not one number. It depends on three things: whether the system is internet-facing, how severe the vendor rating or exploitation status is, and which Essential Eight maturity level the organization is targeting.
For internet-facing servers and network devices, ISM-1877 requires operating system patches within 48 hours when a fix is vendor-critical or exploited, and within two weeks otherwise. For workstations, non-internet-facing servers and non-internet-facing network devices, ISM-1695 sets a flat one-month deadline at ML1 and ML2. At ML3, ISM-1696 and ISM-1902 keep the 48-hour deadline for vendor-critical or exploited patches and move other patches to one month. Driver and firmware patches follow comparable deadlines under ISM-1879, ISM-1697, ISM-1903 and ISM-1904, so the same classification logic applies beyond the operating system. Confirm each clause against the current ISM release before you write it into a policy.
Before you commit to a schedule, check four factors: which devices sit behind the internet edge, how your ring structure places pilot and critical devices, whether your Configuration Manager and Intune tenants can report on every device within the deadline window, and whether your Defender for Endpoint onboarding covers the systems you must scan. Each of these changes the answer for your organization, and each needs an owner who can produce the report an assessor will ask for.
How to sequence the patching program from ring design to assessment evidence
This sequence moves an organization from knowing what it runs to proving that operating system, driver and firmware patches land within the Essential Eight deadlines. Each phase produces an artifact that the next phase depends on, so an assessor can trace a deadline from the control to a device and a timestamp.
Build the asset and exposure inventory
Start by listing every workstation, server, network device, driver and firmware component in scope, and flag which systems are internet-facing and which are not. The owner of this step is usually the IT operations or platform team, with security reviewing the exposure flags. The output is a register that records each device, its operating system release, its exposure status and its management channel (Intune, Configuration Manager, or neither). The step is done when the register reconciles against the directory and a sample of devices has been checked by hand.
Map patch deadlines to each maturity level
Convert the supplied ASD deadlines into a table for the target maturity level. Internet-facing servers and network devices need operating system patches within 48 hours when vendor-critical or exploited, and within two weeks otherwise. Workstations and internal assets have a flat one month deadline at ML1 and ML2, and at ML3 they split into 48 hours for critical or exploited patches and one month otherwise. Drivers and firmware follow matching deadlines. The output is a signed-off deadline matrix that names each asset class and its applicable clock, and the step closes when security and the system owner have both confirmed the matrix against the target level.
Design the Windows Update for Business rings
Adopt Microsoft's five-ring sample as the starting structure: dedicated test devices, pilot devices (about 1 percent), fast devices (about 9 percent), broad deployment (about 90 percent) and critical devices such as those of executive staff. Assign real devices to each ring through Intune group membership and document the criteria for moving a device between rings. Quality updates are usually released on the second Tuesday of each month and are cumulative, so the ring schedule should leave room to test each release before it reaches the broad ring. The output is a ring design document and live assignments, and the step is complete when every in-scope device sits in exactly one ring.
Configure expedited deployment for internet-facing patches
The 48-hour clock for vendor-critical or exploited patches on internet-facing systems cannot wait for the normal ring cycle. Configure an expedited deployment path in Windows Update for Business for the internet-facing group, and agree in advance who approves an out-of-cycle release and how quickly. Test the path on the test ring first so the first real use is not also the first test. The output is a documented expedite runbook and a test record showing an expedited update reached the target devices. The step closes when the team has run the runbook once in a non-emergency change.
Extend coverage to Configuration Manager and Intune drivers and firmware
Windows Update for Business does not cover every patch class the ML3 deadlines require, so confirm how drivers and firmware reach each device. Microsoft's guidance uses Configuration Manager deadlines and 14-day scans for workstations and internal servers, and Intune driver and firmware deployment for the ML3 driver and firmware deadlines. Decide which platform owns each asset class and write that decision into the register. The output is a coverage map that shows every device class and its patch channel, and the step is done when a driver or firmware update has been deployed and its installation confirmed on a test device in each channel.
Onboard devices to Defender Vulnerability Management for scanning
Microsoft maps the daily and fortnightly vulnerability scanning requirements for internet-facing operating systems, drivers and firmware to Microsoft Defender Vulnerability Management on devices onboarded to Defender for Endpoint. Confirm that every in-scope device is onboarded, that the scan results reach the team that owns remediation, and that the scan cadence matches the requirement for each asset class. Confirm licensing with Microsoft before rollout, because the features available depend on the licenses held. The output is a verified onboarding report and a scan schedule, and the step is complete when a sample of devices shows recent scan results in the portal.
Run the patch cycle and track exceptions
Each month, move updates through the rings, record installation status by device and compare it against the deadline matrix from the second step. Any device that misses a deadline needs a recorded reason, an owner and a remediation date, and anything that cannot be patched needs a documented risk acceptance approved by someone with authority to accept it. The output is a monthly compliance report with deadline attainment by asset class and a linked exception log. The step closes when the report has been reviewed by the control owner and the exception log has no entries without an owner.
Assemble assessment evidence for each deadline
Gather the artifacts an independent assessor will test: the deadline matrix, the ring design and assignment history, the expedite runbook and its test record, the coverage map, the Defender onboarding and scan reports, and the monthly compliance reports with their exception logs. Keep each artifact dated and retained under the organization's own records policy, and confirm with the assessor which evidence format they accept. The output is an evidence index that links each Essential Eight patching requirement to the artifacts that show it. The step is complete when a reviewer who did not build the program can trace one device from its deadline to its patch record and its scan result. DeployOpen can prepare this evidence in the client's environment, but only the independent assessor determines whether the evidence meets the requirement.
Which deployment tool covers which patch type
Operating system updates for workstations, non-internet-facing servers and non-internet-facing network devices carry a one-month deadline at ML1 and ML2 (ISM-1695). At ML3, the deadline splits into 48 hours for vendor-critical or exploited patches and one month for everything else (ISM-1696, ISM-1902). For Windows endpoints and internal servers, Microsoft's Essential Eight patch operating systems guidance pairs Configuration Manager deadlines with 14-day scans, while Windows Update for Business rings stage releases across the device estate. Configuration Manager suits organizations that need enforced install deadlines and compliance reporting across an on-premises estate.
- Deadline enforcement: Configuration Manager deadlines enforce installation, which gives an assessor a record that the one-month and 48-hour windows were met.
- Scan cadence: The 14-day scan cycle covers the internal population, so devices offline for the whole window need a follow-up scan.
- Ring staging: Windows Update for Business rings move updates through test, pilot, fast, broad and critical groups before the deadline arrives.
- Non-Windows and network gear: Linux servers, hypervisors, switches and firewalls sit outside these Windows tools and need their own patch process and evidence.
- Out-of-band releases: Vendor-critical updates that land outside the monthly cycle need an expedited path that you define and test.
Confirm the share of your estate that is Windows, which devices stay offline for long periods, and where your deadline clock starts for each release.
Internet-facing servers and network devices face the tightest operating system deadline: 48 hours when a patch is vendor-critical or exploited, and two weeks otherwise (ISM-1877, ISM-1694). Windows Update for Business expedited deployment is Microsoft's mechanism for pushing critical updates to internet-facing Windows servers inside that window. Microsoft maps the daily and fortnightly scanning requirements for these systems to Microsoft Defender Vulnerability Management, but only on devices onboarded to Defender for Endpoint (ISM-1701, ISM-1703, ISM-1900).
- Expedited deployment: Windows Update for Business expedited deployment addresses the 48-hour path for internet-facing Windows servers, but how expedited releases are handled depends on your update service configuration, so test it in a ring first.
- Defender scanning: Defender Vulnerability Management provides the daily and fortnightly views only for devices onboarded to Defender for Endpoint.
- Network devices: Firewalls, load balancers and routers are not Windows devices, so Windows Update for Business and Defender for Endpoint onboarding do not reach them. Use each vendor's update channel and record the timestamps.
- Non-Windows servers: Linux and other non-Windows internet-facing hosts need scanning and patching processes outside Microsoft's tooling.
- Timing evidence: Keep release, approval and installation timestamps so an assessor can check the 48-hour and two-week windows.
Check which internet-facing assets are not onboarded to Defender for Endpoint, and confirm the vendor notification path for each network device before you rely on the 48-hour clock.
Driver and firmware patching is an ML3 requirement. Driver patches must be applied within 48 hours when vendor-critical or exploited, and within one month otherwise (ISM-1879, ISM-1697). Firmware patches follow the same deadlines (ISM-1903, ISM-1904). Microsoft's guidance uses Intune driver and firmware deployment to meet these deadlines for managed Windows devices. Defender Vulnerability Management scanning applies to drivers and firmware on internet-facing systems (ISM-1900), so the scanning coverage follows the same onboarding limits as the operating system tab.
- Two deadlines: Each driver or firmware release falls into either the 48-hour path or the one-month path, so the classification of each release drives the clock.
- Intune deployment: Intune deploys driver and firmware updates to managed Windows devices, but only where the hardware vendor publishes packages that the service can consume.
- Scanning coverage: Defender Vulnerability Management reports on drivers and firmware only for onboarded devices, so internal drivers and firmware need a mapped scanning process of their own.
- Unmanaged hardware: Appliances, baseboard management controllers, storage arrays, printers and peripherals often carry firmware outside Intune, so they need vendor advisories and a separate deployment process.
- Severity mapping: Your team must decide how vendor severity labels map to the 48-hour category, because the ISM sets the category by vendor-critical or exploited status.
Inventory every device class that carries firmware, then confirm which ones Intune can update and which need a separate process before you claim ML3 coverage.
What makes Essential Eight patching cost more or take longer
Patch deadlines are fixed by the maturity level, so the cost of meeting them comes from how many systems must be patched, how quickly, and how much change control sits between release and deployment. The drivers below set the size of the work and the points where it slows down.
Estate size and device diversity
Every additional device model, Windows build and hardware generation adds test cases and update paths for Windows Update for Business rings. A small set of standard builds is cheaper to keep inside the one-month and 48-hour windows than a long tail of exceptions. Ask a partner to inventory device counts by model, build and ownership, and to state how many distinct builds they expect to support at the target maturity level.
Internet-facing servers and network devices
Internet-facing servers and network devices carry the shortest deadline in the model: 48 hours when a patch is vendor-critical or exploited. Each one needs an out-of-band change path, a rollback plan and someone on call to approve the change. Ask the partner to list every internet-facing host and network appliance, the owner of each, and whether the change can be applied without a maintenance window.
Legacy and unsupported operating systems
A system that vendor support no longer covers cannot be patched in the normal way, so it must be replaced, isolated or otherwise handled outside the patch process. Migration work is often the largest item in a patching budget and it is rarely visible until an inventory is taken. Ask for a list of operating system versions in use, their support end dates from the vendor, and a replacement or isolation plan for each.
Ring governance and change approval
Windows Update for Business rings only save time if the approval steps behind them are defined. Pilot and fast rings need named testers, sign-off rules for moving a patch to the broad ring, and a documented exception route for applications that fail. Without these, each patch cycle becomes a meeting. Ask the partner to draft the ring membership, the promotion criteria, the approver for each ring and the emergency change path.
Intune and Defender for Endpoint licensing
Intune deployment and Defender Vulnerability Management depend on which Microsoft 365 or Windows licenses the organization already holds, and the mapping changes with the license tier and the device ownership model. Scope creep appears when scanning or reporting is needed on devices that are not onboarded. Ask the partner to confirm in writing which licenses each device class needs, how many devices are onboarded to Defender for Endpoint today, and who pays for any gap.
Third-party drivers and firmware vendors
Driver and firmware patches at ML3 carry the same 48-hour and one-month deadlines as operating system patches, but they come from many hardware vendors with different release channels. Each vendor adds an intake process, a test pass and a deployment method through Intune or Configuration Manager. Ask the partner to list every hardware vendor in scope, the update channel each uses, and whether firmware can be deployed remotely on each device model.
Who owns the patch deadlines and who produces the evidence
The organization owns its patch deadlines. The Essential Eight deadlines for operating systems, drivers and firmware are set by ASD, but the organization decides how they apply to its own estate, which devices sit in each Windows Update for Business ring, who signs off on deferral periods, and who approves any exception when a vendor patch breaks a line-of-business application. Those decisions belong in a written patch policy with named owners and a record of accepted risk. An implementation partner such as DeployOpen can configure rings, expedited deployment rules, Configuration Manager deadlines and Defender Vulnerability Management scanning, but it does not decide what risk the business accepts or when a missed deadline is tolerated.
A partner can also document the evidence the organization will need. In practice this means exporting update compliance reports from Intune or Configuration Manager, keeping the ring assignments and deployment rule settings under change control, retaining Defender vulnerability scan results with dates, and recording each exception with its approver and expiry. Confirm with your assessor which evidence formats they accept and how long they expect history to cover, because these vary between assessments and should not be assumed from this page.
Only the independent assessor reviews the evidence and concludes on the maturity level achieved. Microsoft's guidance on patching operating systems describes how its tools can be used to meet the requirements, but using a Microsoft tool does not make a system compliant on its own. A configured ring or a green compliance dashboard is an input to the assessment, not a finding. Ask any implementation partner to state in writing which artifacts it will hand over and which judgments remain with your organization and the assessor.
What must be in place before an assessor reviews patching
An assessor reviewing Essential Eight patching will test whether the patch timeline is provable, not just configured. The six checks below connect the device inventory, the update rings, the scanning coverage and the reporting, so each deadline can be shown with a date, a device and a result.
Accurate inventory of operating systems, drivers and firmware
Every deadline depends on knowing which devices exist and what they run. Build an inventory that lists operating system build, driver versions and firmware for workstations, servers and network devices, and separate internet-facing systems from internal ones, because the 48-hour deadline applies only to internet-facing servers and network devices. To check it, compare the Intune device list and the Configuration Manager collection counts with your asset register and reconcile any gaps before the assessment starts.
Defender for Endpoint onboarding coverage
Vulnerability scanning evidence for internet-facing operating systems, drivers and firmware is produced by Microsoft Defender Vulnerability Management on devices onboarded to Defender for Endpoint. A device that is not onboarded produces no scan record, which an assessor will read as a missed scan. Check onboarding status in the Defender portal against your device inventory and document the devices that are excluded and why.
Ring membership and deadlines per maturity level
Windows Update for Business rings, such as test, pilot, fast, broad and critical, need named membership and a written deadline for each maturity level. Show which group receives which update, how long each ring waits before broad deployment, and which deadline applies to each device class at ML1, ML2 and ML3. Confirm the ring assignments in Intune and export them as evidence.
Documented exception handling
Some devices will miss a deadline because of application compatibility, vendor dependencies or outages. An assessor expects each exception to have a named owner, a reason, a compensating control and an approval date, along with a closure target. Keep the exception register separate from the ring configuration, and confirm that every overdue device appears on it.
Reporting that shows patch age against deadlines
The central question is whether each patch was applied within its deadline. Build a report that lists each device, the update installed, the release date, the date the patch was applied and the deadline that applied to that device. Use Intune and Defender reporting to generate it, then test one device by hand to confirm the report matches the device state.
Second Tuesday cadence and out-of-band updates
Microsoft typically releases Windows quality updates, which include security updates, on the second Tuesday of each month, and these updates are cumulative. Keep a dated record of each monthly release, the ring schedule applied to it and any out-of-band update issued between cycles, because out-of-band releases can trigger the 48-hour clock for critical patches. Confirm the record against Microsoft's release history before the assessor asks for it.
Choosing between Intune-only, Configuration Manager and a mixed estate
This table compares three ways to deliver Essential Eight operating system patches: Windows Update for Business through Intune, Configuration Manager, and a mixed model. Read each row against your device mix, network position and the evidence your assessor will ask for, then confirm current tool capabilities with Microsoft before you commit.
| Decision point | Intune-only (WUfB through Intune) | Configuration Manager | Mixed model |
|---|---|---|---|
| When it fits | Cloud-managed workstations and devices that are mostly off-network | On-premises or hybrid estates with internal servers and workstations already managed by Configuration Manager | Estates with cloud-managed endpoints and on-premises servers or legacy workstations that need different tooling |
| Deadline coverage | Expedited updates can support the 48-hour deadline for vendor-critical or exploited patches on internet-facing systems (ISM-1877) | Configuration Manager deadlines and 14-day scans are the mechanism Microsoft's guidance describes for workstations and internal servers | Each population is measured against its own deadline, so the reporting must be reconciled across both consoles |
| Driver and firmware (ML3) | Intune driver and firmware deployment is the mechanism Microsoft's guidance describes for the ML3 deadlines | Confirm with Microsoft whether your Configuration Manager version covers the driver and firmware deadlines you need | Expect two deployment paths to document, test and report separately |
| Evidence produced | Update compliance and deployment reports from the Intune and Windows Update for Business tenant | Deployment status, compliance and scan results from the Configuration Manager site | Two evidence sets that must be combined into one view for the assessor |
| Vulnerability scanning | Defender Vulnerability Management covers devices onboarded to Defender for Endpoint, per Microsoft's mapping for ISM-1701, ISM-1703 and ISM-1900 | Confirm with Microsoft which scanning source covers servers and devices not onboarded to Defender for Endpoint | Confirm coverage gaps for each population before relying on a single scanning view |
| What you still run | Ring design, pilot sign-off, rollback decisions, and the register of devices outside the tenant | Site servers, distribution points, update source configuration, and maintenance of the Configuration Manager infrastructure | Ownership of the boundary between the two models, exception handling, and the combined monthly report |
| Cost and effort | Mostly licensing and administration; confirm licensing with Microsoft and your reseller | Infrastructure to host and keep current, plus administrator time; quote depends on your environment | Both sets of costs plus the integration work to produce one evidence trail |
Questions buyers ask about Essential Eight patching on Windows
Does ASD issue an Essential Eight certificate for patching?
No. The Essential Eight is a set of mitigation strategies, not a certification scheme, so there is no ASD certificate for patching or for any other strategy. Maturity is established through an assessment of how each strategy is implemented and how well it works against the maturity model. The organization owns that result. An independent assessor reviews the evidence and forms the conclusion, and an implementation partner can help prepare the systems, configuration and records that the assessor will examine. The Essential Eight maturity model on cyber.gov.au sets out what each level expects.
What do the 48-hour and one-month patch deadlines mean at each maturity level?
The deadlines depend on the asset and on whether the vendor rates the patch as critical or the flaw is known to be exploited. For internet-facing servers and network devices, patches must go in within 48 hours when critical or exploited, and within two weeks otherwise. For workstations, non-internet-facing servers and non-internet-facing network devices:
- ML1 and ML2: apply OS patches within one month of release.
- ML3: apply within 48 hours when critical or exploited, and within one month otherwise.
Driver and firmware patches follow the same pattern at ML3. Your assessor will check the timestamps that show when each patch was released, detected and applied, so your records must capture all three.
Is Windows Update for Business enough to meet Essential Eight patching?
It is a strong starting point for workstations and some servers, but it rarely meets the requirements on its own. Windows Update for Business handles deferral rings and expedited deployment for critical updates. It does not cover every asset type, verify that every device has actually installed a patch, or produce the complete evidence trail an assessor expects. Most Windows estates also need Configuration Manager for servers, Intune for driver and firmware deployment at ML3, and Defender Vulnerability Management for scanning. Confirm with your Microsoft account team and your own environment which licences and features cover your device types before you plan the design.
What does the organization need to provide to an implementation partner?
The organization must supply the information that defines the environment and the decisions only it can make. Typical inputs include:
- An asset inventory covering workstations, servers, network devices, drivers and firmware, with internet-facing systems identified.
- Current Microsoft licensing, tenant and Intune or Configuration Manager details.
- Existing patch and change processes, maintenance windows and approval owners.
- The target maturity level and the business risks that set it.
- Named access for administrators who can test changes and retrieve logs.
The partner prepares the configuration and evidence, but the organization approves changes, owns the risk decisions and keeps the controls running after the engagement ends.
How long does a patching readiness review take?
The duration depends on how many device types, tenants and sites are in scope, how complete the asset inventory is, and how many change approvals the review needs. DeployOpen does not publish fixed timelines. Most engagements are fixed-scope, so the timeline is agreed in writing before work starts, based on the scope you describe. Ask any partner, including DeployOpen, for a written scope, deliverables and a fixed timeline that lists the dependencies on your side, such as inventory data, access and approval windows.
Can an implementation partner issue the Essential Eight assessment result?
No. An implementation partner prepares systems, configurations and evidence, but it cannot issue an assessment result, report or attestation. DeployOpen operates the same way: it configures, documents and supports the controls, and an independent assessor reaches the maturity conclusion. Because the partner that built the controls should not also judge them, separate the roles in your contract and procurement. Confirm with your assessor which evidence they will accept before you finalize the design.
Where Essential Eight patching projects usually stall
Most Essential Eight patching shortfalls are not technical gaps in Windows Update itself. They come from ring design, scope decisions and evidence habits that were never written down. The cards below cover the failure points we see most often and the checks that catch them before an assessor does.
Rings that treat every device alike
A single deployment ring pushes the same update to a kiosk, a finance laptop and a domain controller at the same time. Microsoft's sample configuration separates dedicated test devices, pilot devices, fast devices, broad deployment and critical devices such as executive laptops. Check that each ring has a named owner, that the pilot group contains real line-of-business applications, and that the critical ring is deferred only by a documented exception.
Missing expedited deployment for internet-facing systems
Internet-facing servers and network devices have a 48-hour deadline when a patch is vendor-critical or exploited, which is much shorter than the monthly cycle used for workstations. Standard rings cannot meet that window without an expedited path. Confirm that your change process can approve an out-of-band update quickly, that expedited deployment is configured for the internet-facing server group, and that the timer starts from the release date rather than the date your team noticed.
Drivers and firmware left out of scope
Operating system patches are often tracked, while drivers and firmware sit in hardware teams' inventories and are never assessed against the same deadlines. At ML3, driver and firmware patches carry their own 48-hour and one-month deadlines. Intune can deploy driver and firmware updates, but only if the devices are enrolled and the update types are in scope. Ask who owns firmware for servers and network devices, and whether those assets appear in the same patch report as Windows.
Scanning gaps on devices outside Defender
Vulnerability scanning only counts for devices onboarded to Defender for Endpoint, because Defender Vulnerability Management relies on that sensor. Servers that were never onboarded, devices in isolated segments and devices that were retired but still appear in directories create silent gaps. Reconcile your device inventory against Defender onboarding each month, and record any device that cannot be onboarded as a documented exception with a compensating scan method.
Exceptions with no owner or expiry
A deferred patch is often approved in a chat thread and then forgotten, so the deadline quietly passes. Each exception should name the device or group, the patch, the business reason, the compensating control and an expiry date. Review open exceptions at a set cadence and close any that have passed their deadline. An exception register that lists owners and dates is far easier to defend than a series of informal approvals.
Evidence gathered only at audit time
Teams that rebuild patch history for an assessor usually find gaps in release dates, ring membership and scan results that were overwritten. Export compliance reports, ring assignments and exception records on a regular schedule and store them in a location the assessor can read. Test this before the assessment by asking whether you can show, for any single critical patch, the release date, the deployment date, the device count and the scan result that confirmed closure.
How DeployOpen works on this
DeployOpen plans and implements Essential Eight patching inside your own Microsoft tenant and devices, working from a written scope that sets the patch deadlines, rings and evidence you need. We prepare the systems and records that an independent assessor will review, but your organization owns the controls and the assessor issues any conclusion about maturity.
How we scope
- The written scope lists which devices, servers, drivers and firmware fall under the patch deadlines for your target maturity level.
- We confirm your Windows Update for Business ring design, expedited update rules and internet-facing server inventory before any build work starts.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing. Ongoing support can follow as a retainer.
How we build
- We configure Windows Update for Business rings, deferral settings and expedited deployments for internet-facing systems in your tenant.
- We set up Intune driver and firmware deployment and Defender Vulnerability Management scanning on onboarded Defender for Endpoint devices.
- We test each ring with dedicated test and pilot devices before applying the configuration to broad and critical device groups.
How we hand over
- You receive documented ring membership, deadline settings, scan schedules and the exception process for devices that cannot be patched in time.
- Patch compliance reports and scan outputs are exported in a form your assessor can sample against each deadline in the scope.
- We walk your operations and security teams through the runbook for monthly cycles and out-of-band critical updates.
How we support
- Ongoing support covers monthly patch cycles, ring tuning, new driver and firmware categories and changes to Microsoft guidance, if you retain us.
- Continuous testing and upgrades are available as retainers, scoped separately from the original implementation.
- Confirm with your Microsoft licensing advisor which Intune, Defender and Windows Update features your tenant includes before the scope is signed.
