Windows update reports in Intune show no data: diagnostic data, enrollment and delays

You've deployed update rings and feature update policies, but the Windows update reports in Intune show devices with no scan time, no progress, or nothing at all, and the Windows Update for Business reports workbook in Azure is just as empty. These reports depend on Windows diagnostic data, a tenant setting that is off by default, and a few services and endpoints on every device. In this post I'll go through each dependency, how to check it, and what a healthy report looks like.

Symptoms#

• Reports › Windows updates lists devices without a Last Scan Time or update state, or doesn't list them at all.
• Feature update failures and expedite reports are empty, even though you know some devices failed.
• The feature update report shows devices stuck in states such as Update state Pending, substate Validation, Update state On hold, substate ServicePaused or Update state Canceled, substate Service Cancelled.
• The Windows Update for Business reports workbook shows no devices, or devices without names.
• An Intune Administrator gets a 403 error when accessing WUfB reports.

Why it happens#

• The tenant toggle is off. Intune features that use Windows diagnostic data need Enable features that require Windows diagnostic data in processor configuration under Tenant administration › Connectors and tokens › Windows data. It's off by default. Without it, compatibility reports, expedite reports and the alerts for feature, quality and driver update failures don't work.
• Devices send too little diagnostic data. The reports need Windows diagnostic data at the Required level or higher. A hardening baseline that turns diagnostic data off leaves those devices without client data in the reports.
• Unsupported devices. Windows Update for Business reports needs Microsoft Entra joined or hybrid joined devices running Pro, Education, Enterprise or Enterprise multi-session, with the February 2023 cumulative update or later. Entra registered devices, Windows Server, Surface Hub and IoT aren't supported. Microsoft currently lists a known issue where multi-session devices don't show data.
• Blocked services or endpoints. Devices must reach the diagnostic endpoints and DeviceCensus.exe must run regularly. login.live.com and the Microsoft Account Sign-in Assistant service (wlidsvc) are needed to create the identifier the reports use for each device; without them, devices aren't visible. Disabling OneSettings (DisableOneSettingsDownloads) can also make client data wrong or missing.
• Latency. In Intune's feature update reports, service-side data from Windows Update (offers, holds, registration alerts) arrives in under an hour and needs no data collection. Client data, such as installation progress or low disk space, is processed in batches that refresh every eight hours, and only after data collection is configured.

How to fix it#

1. Turn on the tenant settings#

In the Microsoft Intune admin center, go to Tenant administration › Connectors and tokens › Windows data:

• Set Enable features that require Windows diagnostic data in processor configuration to On.
• If you own Windows Enterprise E3/E5, Microsoft 365 F3/E3/E5, Windows or Microsoft 365 Education A3/A5, or Windows VDA E3/E5, set I confirm that my tenant owns one of these licenses to On. Compatibility reports and Remediations depend on this attestation.

2. Set diagnostic data to Required or higher#

In a settings catalog profile, configure System › Allow Telemetry (System/AllowTelemetry) to Required, or Optional on Windows 11 if your privacy policy allows it. Add System/AllowDeviceNameInDiagnosticData if you want device names in Windows Update for Business reports. Then make sure no baseline, Group Policy or custom profile sets a lower value. Check on a device:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System' |
    Select-Object AllowTelemetry, AllowDeviceNameInDiagnosticData
Get-Service DiagTrack, wlidsvc | Select-Object Name, Status, StartType

AllowTelemetry should be 1 (Required) or 3 (Optional), DiagTrack (Connected User Experiences and Telemetry) should be running, and wlidsvc must not be disabled.

3. Open the endpoints#

Allow the documented endpoints through your proxy and firewall, including v10c.events.data.microsoft.com (or eu-v10c.events.data.microsoft.com for tenants in the EU Data Boundary), umwatsonc.events.data.microsoft.com, settings-win.data.microsoft.com, adl.windows.com, oca.telemetry.microsoft.com and login.live.com. A quick test from the device:

'v10c.events.data.microsoft.com','settings-win.data.microsoft.com','login.live.com' |
    ForEach-Object { Test-NetConnection -ComputerName $_ -Port 443 |
        Select-Object ComputerName, TcpTestSucceeded }

4. Enroll in Windows Update for Business reports correctly#

Windows Update for Business reports runs in Azure and stores data in a Log Analytics workspace you own, in a supported region. Enroll from the Azure portal or the Microsoft 365 admin center with an Intune Administrator or Windows Update deployment administrator account (or the Intune Policy and Profile Manager role from the workbook); enrolling through the Azure CLI isn't supported. Readers need Log Analytics Reader on the workspace. If an administrator gets a 403, open Enterprise applications in Microsoft Entra, find Windows Update Deployment Schedule Service (app ID 61ae9cd9-7bca-458c-affc-861e2f24ba3b) and set Assignment required to No.

5. Read the stuck states correctly#

Pending with Validation means Windows Update can't offer the update because of a validation issue with the device, so check its join type, edition and license. On hold with ServicePaused is an automatic hold by Windows Update, not your configuration, and Admin paused means someone paused the deployment. Canceled with Service Cancelled means Windows Update canceled the offer, for example because the content reached end of service. For devices that are reporting but not getting the update, use feature update not offered.

Verify the fix#

• The device shows a Last Scan Time in the feature update report after its next Windows Update scan. Service-side states such as offers and holds appear within about an hour, and client-side installation steps follow within the eight-hour refresh.
• The Update Aggregated Status column moves to values such as In progress, and failures show an Alert Type instead of a blank.
• In the Windows Update for Business reports workbook, the device appears with its name once data has been processed. Give a newly enrolled tenant at least a day before troubleshooting further.
• On the device, the registry and service checks above return the expected values, and every endpoint test returns TcpTestSucceeded : True.

Prevent it next time#

• Include the Windows data toggle, the diagnostic data policy and the endpoint list in your tenant build checklist, alongside the update rings in Windows Update for Business in Intune.
• When you deploy a security or privacy baseline, check that it doesn't lower diagnostic data below Required or disable wlidsvc.
• For driver data in the workbook, devices must get drivers through Windows Autopatch; see driver and firmware updates in Intune.
• When the reports show error codes, look them up in the Windows Update error codes quick reference.

References#

• Enable Windows diagnostic data and license verification
• Reports for feature update policies
• Windows Update for Business reports prerequisites