Manage Windows 10 Insider Preview Builds

Administrators can manage installation of Windows 10 Insider Preview Builds across multiple devices in their organization using the following steps:

Register your domain

To authenticate multiple devices for Insider Preview builds, register your organization's Azure Active Directory domain with the Windows Insider Program. To register a domain, you must be registered in the Windows Insider Program with your work account in Azure AD (See Register) and you must be assigned a Global Administrator role on that Azure AD domain. Also requires Windows 10 Version 1703 or later on the machine used for registration.

NOTE:

  • The Windows Insider Program only supports registration of domains in Azure Active Directory (and not Active Directory on premises) as a corporate authentication method.
  • Once a domain is registered, administrators do not have to register each individual device or user with the Windows Insider Program in order to apply Insider Preview build installation polices.
  • To get the most benefit out of the Windows Insider Program for Business, organizations should not use a test tenant of Azure AD. There will be no modifications to the Azure AD tenant to support the Windows Insider Program as it will only be used as an authentication method.

Join devices to Azure Active Directory

In order to receive Insider Preview builds through Windows Update, devices must be joined to the same Azure AD domain that was registered with the Windows Insider Program. For devices on a local Active Directory not already joined to Azure AD, follow these steps:

To join individual devices

  1. Open Settings, and then select Accounts.
  2. Select Access work or school, and then select Connect.
  3. On the "Set up a work or school account" screen, select Join this device to Azure Active Directory.
  4. On the "Let's get you signed in" screen, type your Azure AD email address (for example, alain@contoso.com), and then select Next.
  5. On the "Enter password" screen, type your password, and then select Sign in.
  6. On the "Make sure this is your organization" screen, review the information to make sure it's right, and then select Join.

See also Join your work device to your organization's network.

To join multiple devices

To join multiple devices on your local Active Directory to your Azure AD domain, use Azure AD Connect. For more details, see: Integrate your on-premises directories with Azure Active Directory

Create and manage policies

You can use Group Policy, System Center Configuration Manager or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 Insider Preview Builds are installed on devices.

NOTE:

  • To enable installation of Insider Preview builds, telemetry on a device must be set to level 2 (enhanced) or higher. By default, Windows 10 devices are set to level 3 (full). See Manage your diagnostic data settings.
  • Windows Update for Business policies used to install Insider Preview Builds that are created with one management tool cannot be changed using another. For example, a policy set using Group Policy can only be changed on a client device using Group Policy and cannot be changed using SCCM or Intune.
  • Insider Preview builds cannot currently be installed or managed using Windows Server Update Services (WSUS). For devices managed by WSUS, you will need to disable the Windows Update Agent so a device doesn't scan against WSUS. See Identify clients that use WUfB.

Set using Group Policy

  1. In the Group Policy Management Console (GPMC), go to Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business
  2. Open Manage preview builds to enable installation of Insider Preview builds on a device. This setting can also be used to prevent installation on a device and stop Insider Preview build updates once the release is public.
  3. Open Select when Preview Builds and Feature Updates are received and select the Ring from which you want devices to receive Insider Preview builds (Fast, Slow, Release Preview). See Windows readiness levels and flight rings. This setting can also be used to defer installation for a set number of days after release or pause installation of Insider Preview builds.

See also Use Group Policy to configure Windows Update for Business.

Intune Update Ring

Set using System Center Configuration Manager

Beginning with Configuration Manager version 1802, you can set deferral policies for Windows 10 Insider Preview Builds.

  1. In the Configuration Manager console, go to Software Library > Windows 10 Servicing > Windows Update for Business Policies.
  2. On the Home tab, in the Create group, select Create Windows Update for Business Policy to open the Create Windows Update for Business Policy Wizard.
  3. On the General page, provide a name and description for the policy.
  4. On the Deferral Policies page, go to Defer Feature Updates>Branch readiness level, select the ring from which you want devices to receive Insider Preview builds. You can also defer or pause Insider Preview builds using the Deferral period and Pause Feature updates settings.
  5. Complete the wizard to create the new deferral policy.
  6. To deploy your Windows Update for Business deferral policy, on the Home tab, click Deploy Windows Update for Business Policy and assign the policy to a collection of devices or users.

See also Configure Windows Update for Business deferral policies.

Intune Update Ring

Set using Microsoft Intune

  1. Log into the Azure portal and select Intune under Resources.
  2. Navigate to Software Updates>Windows 10 Update Rings. Click “+” to create an Update Ring policy.
  3. Under Servicing Channel, select the Ring from which you want devices to receive Insider Preview builds.
  4. Adjust Feature update deferral period if you want to defer deployment of Insider Preview builds for a certain number of days after release.
  5. Click OK and Create to set policy.
  6. Go to Assignments to assign the policy to users and devices. Note: you can create groups with one or more users or devices in Intune under Groups.

See also Manage software updates in Intune.

Intune Update Ring

Set using other MDM service providers

To set Windows Update for Business policies for Insider Preview builds using non-Microsoft MDM service providers, using the CSP settings below. For guidance on configuring CSPs, see CSPs in MDM.

Update/ManagePreviewBuilds

Update/BranchReadinessLevel

Confirm and track installations

Confirm policy

To confirm that your Windows Update for Business policies have been set correctly, go to Settings>Update & Security>Windows Update on the device and click on "View configured update policies". You can also check the following key in the Registry Editor on the device: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. A device set to receive an Insider Preview build would show the following values:

  • BranchReadinessLevel = 2 (Fast), 4 (Slow) or 8 (Release Preview)
  • ManagePreviewBuilds = 1

Windows Update for Business values in Registry Editor

NOTE:

  • Once a policy has been set, the device must be restarted for the policy to be activated.
  • If a device is not receiving Insider Preview builds, see Troubleshooting.

Track devices

You can use Device Health in Windows Analytics to monitor devices running Insider Preview builds. This can be useful for identifying device, device driver and application issues. See Using Device Health to monitor Insider Preview builds.