Intune Update Rings and Feature Update - how to keep them separate

Question

Hey folks,

Got a couple of wee questions around Update Rings and separating out Windows 10 to 11 upgrades being provided to our user base.

We have four ring profiles configured; three for standard patch Tuesday Updates, one for Windows 10 to 11 Upgrades. We have a Feature Update policy configured to push the latest Windows 11.

Entra Security Groups are used to assign each of the profiles, with one Entra Group assigned to both the Feature update and the Windows Upgrade profile.

How does the "Upgrade Windows 10 devices to Latest Windows 11 release" toggle work, if a Feature Update policy isn't assigned to a resource? Does Windows still get upgraded from 10 to 11 on the oldest supported version? Or do you need the Feature Update policy to be configured so a device can upgrade to a specifically configured version? Or can we just use a Feature Update policy and assign the group(s) to it, and hit the 10 to 11 toggle in the Update Ring profiles to No?

We know our 10 to 11 upgrade works. The Windows Update Ring profiles also work. However we would like to ensure we can make Windows 10 to 11 Upgrades available to a user, without also configuring them to receive Windows Updates from any of our Intune Update Ring profiles.

My apologies if this is a trivial one, just can't seem to find an answer that doesn't assume a lot.

Thanks.

Andy