Public preview of Microsoft Graph APIs to manage Windows updates

This article is contributed. See the original author and article here.

Gain rich control over the approval, scheduling, and protection of content delivered from Windows Update thanks to the new Microsoft Graph APIs, now available in public preview! Powered by the Windows Update for Business deployment service, these APIs enable IT professionals and app developers to:

• Approve and schedule specific feature updates to be delivered from Windows Update – including skipping or not taking feature updates.


• Stage deployments over a period of days or weeks using rich expressions (ex: deploy 20H2 to 500 devices per day, beginning on May 11, 2021)


• Bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization.


• Deliver safer update results by leveraging automatic pilots for any deployment.

Microsoft Graph is the gateway to Microsoft 365, making it easy to build apps that span organizations, users, and devices. By connecting deployment service capabilities with Microsoft Graph, app developers can easily build rich update management tools and extend these experiences with contextual user data (such as leveraging a user’s calendar data when scheduling an update).

And the best part is, if you have one of the following Windows or Microsoft 365 subscriptions, you can start using the deployment service today!

• Windows 10 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)


• Windows 10 Education A3 or A5 (included in Microsoft 365 A3 or A5)


• Windows Virtual Desktop Access E3 or E5


• Microsoft 365 Business Premium

What is the Windows Update for Business deployment service?

The Windows Update for Business deployment service is the bridge between you and Windows Update. It allows you to approve and schedule content approvals directly through a service-to-service architecture.

Here is a common scenario for the deployment service:

1. Using a management tool, you select the target devices and approve content to be deployed. This tool may be PowerShell, a Microsoft Graph app, or a complete endpoint management solution such as Microsoft Endpoint Manager.


2. The tool conveys your approval, scheduling details, and device selection to the deployment service.


3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers the approved content to devices on their next check for updates.

This service-to-service architecture complements existing Windows Update for Business policies while providing unique benefits:

• Update management now goes beyond the individual device – allowing you to easily understand what updates are applicable to your organization and how best to stage deployments.


• Reacting to update challenges is faster than ever before – whether you need to pause or accelerate a deployment.


• New features and capabilities are immediately delivered to all in-support Windows versions – no operating system servicing required.

The Windows Update for Business deployment service is an enterprise-grade solution that provides full control over managed content and is already certified compliant with several industry compliance standards, including: ISO 27001, FedRAMP High, HiTRUST, and SOC II.

Try the service today

With today’s public preview release, you can use the Windows Update for Business deployment service directly through the Microsoft Graph API and associated SDKs, as well as Azure PowerShell. If you’re an IT pro, you can leverage these APIs and SDKs within your in-house solutions. If you’re a management tool vendor, these APIs and SDKs can help you provide deployment service capabilities to your customers through multi-tenant apps.

To begin exploring the deployment service, we encourage you to use Microsoft Graph Explorer or a proven industry solution, such as Postman.

Using Microsoft Graph Explorer to interact with the deployment service

Microsoft Graph Explorer is a tool that makes it simple to make requests and see responses against Microsoft Graph. To begin using Microsoft Graph Explorer with the deployment service, sign in using your tenant.

Next, provide consent for Graph Explorer to access the deployment service on behalf of your organization. Click the settings gear icon next to your account after signing in and choose Permissions. Select WindowsUpdates.ReadWrite.All and then select the Consent action.

You are now ready to begin using the service. In the left pane, you will find several samples for Windows Updates. Start with a basic operation like list catalog entries.

Interacting with the Windows Update for Business deployment service via Microsoft Graph Explorer

While you can immediately query for data provided by the deployment service—such as available content to deploy—querying for other content, such as deployments, will depend on what have been created for your tenant. You can use Microsoft Graph Explorer to explore the capabilities provided by the deployment service and understand how to incorporate these into your apps, including:

• Enroll in update management. Enroll devices in feature update management by setting the enrollmentUpdateCategory to feature. This will stop offering feature updates to enrolled devices until explicitly approved using the deployment service.


• Create deployment (expedited security update). If a new critical security update is released and you want to reach compliance as rapidly as possible, you can deploy the update as expedited and control settings like the number of days until devices are required to restart.


• Create deployment (rate-based gradual rollout). Stage a deployment over time so that devices are offered the feature update at regular intervals and according to a specified number of devices per offer.


• Create deployment (date-based gradual rollout). Stage a deployment over time so that devices are offered the update at regular intervals until all devices receive the update by a targeted end date/time. You may also use a start date/time with any deployment to control when to begin offering the update.


• Update deployment (replace monitoring rules). Apply monitoring rules to any deployment to detect a threshold of issues, such as number of rollbacks, and then pause the deployment or alert you to the problem.

To learn more about these operations and the associated capabilities, please see our Microsoft Graph API documentation.

Using Postman to interact with the deployment service

Like Graph Explorer, Postman is an easy tool for interacting with the deployment service and a great way to familiarize yourself with the supported operations. For detailed instructions, see Use Postman with the Microsoft Graph API.

Note When you reach step 3.9, follow the procedure to add and consent Delegated Permissions for WindowsUpdates.ReadWrite.All. When you reach step 6, expand the Windows Updates (beta) folder of the Postman collection to see operations you can perform with the deployment service.

Select a request such as List catalog entries, ensure any required variables are populated, then click Send to interact with the service.

Interacting with the Windows Update for Business deployment service via Postman

 

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.