Questions about Intune Update assignments

[ashearera]

Hi everyone, I realise some of these questions or similar may have been asked before, but I haven't found exactly the answers I'm looking for.

We're planning to use Patch My PC in our Intune environment, all devices are Azure AD Joined and in Autopilot.

Like many, we are planning to make most of our Intune Apps "Available" to users via Company Portal (either All Users if suitable, or if a restricted licence app to an AAD group of known users).

Then we will make the correspdoning Intune Updates Required, as I understand this ensures the update script runs regularly to detect the app and update it if necessary. My questions are:

1. When an app is set to Required for Users, how frequently does it run? I couldn't find this in any of the MS documentation. Is it triggered by a certain event (login, reboot) or is there some regular time interval? I've read somewhere that policy check ins happen roughly every 8 hours by default - is this valid here?

2. How are people setting up their Required Assignments for the Intune Updates? I have read about people having AAD groups setup almost like Update Rings, so if an update goes wrong the impact is limited if caught early.

Do you have a generic AAD User early adopter group for apps scoped to All Users (could probably even re-use our Windows Update Ring group...). How would you ensure your Early adopter group had a decent spread of the Available app actually installed? It's possible all of your early adopters may not have installed an Available app...

In the case of apps restricted to a smaller group of users, I guess you would then have individual early adopter groups for each app you setup?

3. If you have an app limited to a set group of users, do you also set the Intune Update to be Required only to that group of users? Or do you just Require all updates to All Users? Is there a significant performance issue doing this?

Thanks for any input.

[Scott (Patch My PC)]

Hey @Ashearera

Intune Policy runs every hour and evaluates win32apps.
when initially deployed, the updates should be installed by Intune within an hour of deployment. If the installation fails, Intune will retry the installation every 24 hours, unless the exit code is Retry.

We have a KB article on retries here - https://patchtuesday.com/blog/tech-blog/win32app-retry-interval/