Which Windows Build Is That Estate Actually On? ​

September 4, 2026 · InfraScout Team

Windows Update deployment was the one Intune surface InfraScout could not see at all. Eight new tools close it.

The gap was easy to miss because something adjacent looked like it answered the question. An Update Ring is a device configuration, so it showed up in the configuration tools, and reading one gives you a confident-sounding answer about servicing. It is the wrong answer. A ring tells you how long a device defers a release and how long it may pause one. It never tells you which release the device actually lands on.

Everything that does answer that lives in collections the configuration tools never looked at.

What the eight tools cover ​

Feature update profiles are the deployments that pin devices to a specific Windows release. Quality update profiles carry expedited settings — the mechanism for pushing a security release ahead of the normal cadence. Driver update profiles carry the driver approval workflow. All three can be listed, and feature and quality profiles can also be read by ID with their assignments inlined, so you get the profile and the groups it targets in one call.

Quality update policies are a separate, newer surface carrying hotpatch configuration and per-cadence approval settings. The similar name is Microsoft's, not ours, and it is a genuine trap: the expedited settings you are probably looking for are on the profiles, not the policies. Each tool's description points at the other one.

Then two tools that exist so the first six are interpretable end to end.

The driver inventory lists every driver behind a profile with its approval state, and its needs review rows are the real review backlog — a profile's own new-updates counter can read zero while hundreds of drivers wait. And the update catalog turns a version string into a dated release with a real end-of-support date, which is what makes "is this estate parked on a build Microsoft no longer supports?" an answerable question rather than a version string you have to go and look up by hand.

Two of them refuse to take a page size ​

The catalog and the driver inventory expose no page size and no continuation token, unlike every other list tool. That is deliberate.

Both collections page in a way that cannot be trusted. Ask the catalog for two rows and you get exactly two rows and no indication that 133 more exist — no continuation link, nothing to signal the set was cut. Through the normal paging path, whatever page size the AI happened to pick would have posed as the complete catalog, and a question about end-of-support would have been answered confidently against a fraction of the releases.

So these two walk the whole collection themselves and hand back the entire set. Narrow them with a filter instead of a page size. If the walk cannot finish inside its time budget, the result carries the rows collected so far plus an explicit warning that the set is incomplete — the one thing worse than a slow answer being a truncated one that looks whole.

All eight need DeviceManagementConfiguration.Read.All, which your app registration already holds. No re-run, no new consent screen — they work on every tenant already onboarded.

Full parameter reference: Microsoft Cloud — Intune Tools.

Questions or feedback? Reach us at info@infrascout.cloud.