Windows driver and firmware updates in Intune: approvals and why drivers don't show up

Intune can approve and schedule Windows driver and firmware updates from Windows Update, but the feature has more moving parts than an update ring: a cloud service decides which drivers apply, approvals live inside the policy, and one blocking setting elsewhere quietly stops everything. Here's how driver update policies work, how to set one up, and the checks that explain an empty driver list or drivers that never install.

How driver update policies work#

Intune provides the device identity, the assignment and your approvals, and sends them to the Windows Autopatch cloud service, which configures Windows Update for those devices. Windows Update works out which drivers fit each device's hardware and installs only approved ones during its normal scans. (Older documentation calls this back end the Windows Update for Business deployment service.) Restarts and notifications still follow your update ring settings.

Three details explain most confusion:

• The driver list isn't an inventory. Intune doesn't collect installed drivers. The list shows updates newer than the version on at least one assigned device, and a version drops off once every applicable device has it.
• Two tabs. Recommended drivers are the newest updates the OEM marked as required. Other drivers hold superseded versions, firmware and optional drivers, which only a driver update policy can deploy.
• No CHID targeting. Policies don't enforce an OEM's Computer Hardware ID targeting, so a device can be offered a newer recommended version instead of a model-specific build.

Prerequisites#

Step-by-step: set up a driver update policy#

1. Remove anything that blocks drivers#

In your update ring, Windows drivers must be Allow. In settings catalog policies, Exclude WU Drivers in Quality Update (Windows Update client policies) must be Allow Windows Update drivers. On hybrid devices, make sure the Group Policy Do not include drivers with Windows Updates isn't enabled.

2. Create the policy#

Go to Devices › Windows updates, open the Driver updates tab and select Create profile. Choose the approval method:

• Manually approve and deploy driver updates: every new driver arrives as Needs review. When you approve one, you can set Make available in Windows Update to a date; leave it blank to start immediately.
• Automatically approve all recommended driver updates: new recommended drivers arrive as Approved, held back by Make updates available after (days) (0 to 30), counted from the day the driver is added to the policy, not the OEM's release date. Other drivers still arrive as Needs review.

The approval type can't be changed later; only the deferral stays editable. Assign device groups, and keep each device in a single driver update policy so a driver declined in one policy isn't approved in another.

3. Review and approve drivers#

The Drivers to review column in the policy list shows a yellow warning and a count such as "3 to review". Open the policy, select a driver and use Actions in the Manage driver pane. Needs review can become Approved or Declined; Approved can be Paused; Paused can be approved again; an approved driver can never be declined. Bulk actions handle up to 100 drivers per run, one action type at a time.

4. Pause a bad driver#

Paused stops a driver reaching more devices and can stop an install underway, but completed installs aren't rolled back; driver policies have no rollback option. If an older approved version exists in the policy, Windows Update offers that one instead.

Why drivers don't show up or don't install#

For co-managed devices, move the Windows Update policies workload to Intune (or Pilot Intune) as described in enabling co-management. Where WSUS remains for other content, the Group Policy Specify source service for specific classes of Windows Updates (CSP SetPolicyDrivenUpdateSourceForDriverUpdates) must send the driver class to Windows Update. On the device:

# Must not be Disabled
Get-Service wlidsvc | Select-Object Status, StartType

# Join state: AzureAdJoined should be YES
dsregcmd /status | Select-String 'AzureAdJoined|DomainJoined'

# Group Policy values: ExcludeWUDriversInQualityUpdate should be absent or 0
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -ErrorAction SilentlyContinue |
  Select-Object ExcludeWUDriversInQualityUpdate, WUServer, SetPolicyDrivenUpdateSourceForDriverUpdates

# MDM-delivered values for the same settings
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update' -ErrorAction SilentlyContinue

An MDM diagnostic report shows which policy set each value.

Verify#

• In the policy: the Applicable devices column per driver, and in the Manage driver pane the count of devices that installed that version.
• In reports: the Windows driver update reports under Reports › Windows updates show per-policy and per-device progress.
• On the device: Settings › Windows Update › Update history lists installed drivers under Driver updates, and the System log records successes and failures:

# Event 19 = installation successful, 20 = installation failure
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WindowsUpdateClient'; Id=19,20} -MaxEvents 20 |
  Select-Object TimeCreated, Id, Message

# Confirm the version that is actually loaded
Get-CimInstance Win32_PnPSignedDriver |
  Where-Object DeviceName -like '*Bluetooth*' |
  Select-Object DeviceName, DriverVersion, DriverDate

Good looks like this: the driver is Approved, update history lists it, and DriverVersion matches the policy.

Tips and gotchas#

• Use rings. A pilot policy with automatic approval and a short deferral, plus a broad policy with a longer deferral, gives you time to pause. Pausing in one policy doesn't affect another.
• Firmware often lands in Other drivers, so expect to approve it by hand, after testing per model.
• No downgrades. Windows Update installs a driver only if it's newer than the installed one.
• Windows Autopatch: if Autopatch already manages a device's drivers, don't add a second policy; see Windows Autopatch approvals and pausing.

References#

• Manage Windows driver updates (Microsoft Learn)
• Configure Windows driver update policies (Microsoft Learn)