Configure maintenance windows for Windows updates in Microsoft Intune

Use maintenance windows in Microsoft Intune to control when automatic Windows Update actions can begin on managed devices. You can restrict downloads, installations, and update-related restarts to a scheduled period.

Maintenance windows help you plan updates for devices that need to remain available during operating hours, such as kiosks, shared devices, and manufacturing equipment. Configure a one-time window or a recurring daily, weekly, or monthly schedule.

Maintenance windows govern Windows Update content, including quality updates, feature updates, Hotpatch updates, .NET updates, drivers, and firmware. They don't determine which updates are approved or offered to a device.

Before you begin

Before you create a policy:

Confirm that devices are enrolled in Intune and run a supported Windows version. The underlying maintenance window settings require Windows 11, version 24H2 with KB5077181, build 26100.7840, or later.
Confirm that you have Intune permissions to create, configure, and assign device configuration policies.
Identify a device group for your initial deployment. Test the policy on representative devices before assigning it more broadly.
Review the update policies assigned to those devices, including deferrals, deadlines, grace periods, and expedited updates.

For the underlying Windows settings and operating system requirements, see Update Policy CSP.

How maintenance windows work

A maintenance window controls when the automatic update actions you select can begin. Actions that aren't selected continue to follow other applicable Windows Update policies.

Update action	Actions restricted to the maintenance window	Actions that can occur outside the window
Download, install and restart	Download, installation, and update-related restart	None of these automatic actions, except where another policy or event takes priority
Install and restart	Installation and update-related restart	Download
Restart only	Update-related restart	Download and installation

All maintenance window times use the device's local time. For example, a window that starts at 23:00 starts at 11:00 PM in each device's local time zone.

An action that begins during the window can continue after the window ends. A maintenance window doesn't guarantee that all update work finishes before the end of the scheduled period.

Maintenance windows control automatic update actions. Users can still initiate update actions outside the window when the Windows experience and other applicable policies allow them.

Create a maintenance window policy

1. Create the policy

Sign in to the Microsoft Intune admin center.
Select Devices > Manage devices > Maintenance windows.
Select Create policy.
On Basics, enter a descriptive Name and an optional Description.
Select Next.

For example, use the name Weekly kiosk maintenance and describe the devices and approved maintenance period.

2. Choose the update actions

On Configuration settings, expand Maintenance Windows and configure these settings:

For Workload type, select Updates.
Set Enable Maintenance windows to On.
For Update action, select one of the following options:
- Download, install and restart
- Install and restart
- Restart only

Choose the option that matches the activities you need to restrict. For example, select Install and restart if devices can download updates during operating hours but must wait until the maintenance period to install them and restart.

3. Configure the schedule

Configure the schedule settings in the order shown in the admin center:

Repeat schedule
Schedule-specific options, when applicable
Start date
Duration (hours)
Start time

Enter the start date in YYYY-MM-DD format and the start time in HH:MM format. The duration must be from 2 through 24 hours.

The admin center requires a start date. Windows uses that date for a non-repeating window. For recurring windows, Windows starts on the earliest date that matches the configured schedule.

One-time window

To configure a single maintenance period:

Set Repeat schedule to None.
Enter the Start date.
Enter the Duration (hours).
Enter the Start time in device-local time.

Keep one-time schedules current. After the scheduled period passes, update the date or remove the one-time configuration as appropriate.

Daily window

To configure a maintenance period every day:

Set Repeat schedule to Daily.
Complete Start date.
Enter the Duration (hours) and Start time.

No weekday or monthly selections are required.

Weekly window

To configure a maintenance period on selected days:

Set Repeat schedule to Weekly.
Under Weekly – Day selection, select one or more days.
Complete Start date.
Enter the Duration (hours) and Start time.

The window occurs on each selected day.

Monthly window

Set Repeat schedule to Monthly, and then configure Monthly – Schedule type.

For a day-based schedule:

Select Day-based.
Set Day of month to a value from 1 through 28.
Complete Start date, Duration (hours), and Start time.

For a week-based schedule:

Select Week-based.
Choose Week in Month: First, Second, Third, Fourth, or Last.
Choose Day of the week.
Complete Start date, Duration (hours), and Start time.

For example, a week-based schedule can run on the second Tuesday or last Sunday of each month.

After you configure the schedule, select Next.

4. Assign and create the policy

On Scope tags, add the scope tags your organization uses to control administrative access, and then select Next.
On Assignments, select the groups that receive the policy. Add exclusions if needed, and then select Next.
On Review + create, review the update action, schedule, scope tags, and assignments.
Select Create.

Example: Weekly overnight maintenance

An organization allows kiosks to download updates during operating hours but wants installation and update-related restarts to begin during an overnight maintenance period.

Configure the policy as follows:

Setting	Value
Workload type	Updates
Enable Maintenance windows	On
Update action	Install and restart
Repeat schedule	Weekly
Weekly – Day selection	Sunday
Duration (hours)	4
Start time	23:00

Complete the required Start date field. For this recurring schedule, Windows uses the selected weekday and start time rather than the start date to determine the next window.

The window starts every Sunday at 11:00 PM in each device's local time and ends Monday at 3:00 AM. Downloads can occur outside the window. Installation or restart work that begins during the window can continue after it ends.

Monitor the policy and validate update behavior

To review policy deployment:

Select Devices > Manage devices > Maintenance windows.
Select the policy.
Review Device and user check-in status, Device assignment status, and Per setting status.
Investigate errors, conflicts, and devices that haven't received the policy.

Per-setting reports can show the underlying Windows policy settings separately. For example, a weekly schedule can appear as separate settings for individual days of the week.

Policy deployment status shows whether the configuration reached the device. It doesn't, by itself, confirm that an update installed or a restart occurred during the window.

Use your existing Windows Update or Windows Autopatch reporting to validate update behavior. Compare installation and restart timestamps with the configured schedule, accounting for each device's local time zone.

Interactions with other update policies

Maintenance windows work alongside other Windows Update policies. Review these interactions when you plan a deployment.

Policies and events that can take priority

The following policies or events can allow update actions outside the maintenance window:

Policy or event	Effect
Expedited quality updates	An expedited deployment can take priority over the maintenance window.
Expired deadlines and grace periods	Windows can enforce the update and required restart outside the window after the applicable deadline and grace period expire.
Device provisioning	Required update or setup actions during provisioning can take priority over maintenance window restrictions.
Education cart servicing policy	This specialized servicing policy can take priority when configured.
Minor-impact updates	Updates classified by Windows as minor impact can occur outside the window.

Deferrals affect update availability

Deferrals control when an update is offered to a device. They don't create an alternative maintenance window.

If an update is still deferred when a window occurs, it isn't available for that window. After the deferral expires and the update is offered, the selected automatic actions can begin during a subsequent applicable window.

For example, a device with a seven-day quality update deferral and a Saturday maintenance window might not process a Tuesday release during the first Saturday window.

Other scheduling settings

For actions governed by a maintenance window, active hours and other update scheduling settings don't provide an alternative period for those actions to begin.

Review the complete update configuration rather than treating the maintenance window as a replacement for update approval, availability, or deadline policies.

Troubleshoot unexpected behavior

Update activity occurs outside the window

Check whether:

The activity is included in Update action. For example, Restart only doesn't restrict downloads or installations.
The action began during the window and continued after it ended.
A user initiated the action.
An expedited update, expired deadline, or another higher-priority event applied.
You compared the event time with the device's local time.

An update doesn't install or the device doesn't restart