- Windows 10
- Windows 11
Update Compliance is deprecated and is no longer accepting new onboarding requests. Update Compliance has been replaced by Windows Update for Business reports. If you're currently using Update Compliance, you can continue to use it, but you can't change your
CommercialID. Support for Update Compliance will end on March 31, 2023 when the service will be retired.
The Safeguard Holds report provides information about devices in your population that are affected by a safeguard hold.
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a safeguard hold is generated to delay the device's upgrade and protect the end-user experience. Safeguard holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
As part of the Safeguard Holds report, Update Compliance provides aggregated and device-specific views into the safeguard holds that apply to devices in your population. These views will show data for all devices that are configured to send diagnostic data at the Optional level (previously Full). For Windows 10 devices, devices configured to send diagnostic data at Enhanced level are also included. If your devices are not sending the required diagnostic data, they will be excluded from these views.
The safeguard hold report can be found in a different location from the other Update Compliance reports. To access the safeguard hold report, follow the instructions below.
- Navigate to your Log Analytics workspace to which Update Compliance is deployed.
- In the left-hand menu, select Solutions.
- Select the solution named WaaSUpdateInsights(<your workspace name>). (This summary page is also where the Update Compliance tile is located.)
- In the left-hand menu, select Workbooks.
- Under the subsection WaaSUpdateInsights, select the workbook named Safeguard Holds.
This report shows information for devices that are managed using the Windows Update for Business deployment service. To view information about safeguard holds for other devices, you can use the workbook named WaaSUpdateInsights or the queries for safeguard holds in the Feature Update Status report.
Safeguard hold view
The safeguard hold view shows which safeguard holds apply to devices in your population, and how many devices are affected by each safeguard hold. You can use the Safeguard hold ID(s) dropdown at the top of the report to filter the chart and corresponding table to show only the selected safeguard hold IDs. Note that a device can be affected by more than one safeguard hold.
The device view shows which devices are affected by safeguard holds. In the Safeguard Hold IDs column of the table, you can find a list of the safeguard holds that apply to each device. You can also use the Safeguard hold ID(s) dropdown at the top of the report to filter the table to show only devices affected by the selected safeguard hold IDs.
Getting additional information about a safeguard hold
For safeguard holds protecting devices against publicly discussed known issues, you can find their 8-digit identifier on the Windows release health page under Known issues corresponding to the relevant release.
Devices managed by the Windows Update for Business deployment service that are affected by a safeguard hold for a likely issue are listed in the report with the safeguard hold ID value 00000001.
Opt out of safeguard holds
To opt out of safeguard holds protecting against known issues, see Opt out of safeguard holds.
To opt out of safeguard holds protecting against likely issues (applicable to devices managed by the deployment service), see Manage safeguards for a feature update deployment using the Windows Update for Business deployment service.