mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
redid onboarding docs, added subsections for script and manual device config, removed unused images from old docs
This commit is contained in:
Charles
@ -1,127 +1,83 @@
|
||||
---
|
||||
title: Get started with Update Compliance (Windows 10)
|
||||
title: Get started with Update Compliance
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Configure Update Compliance in Azure Portal to see the status of updates and antimalware protection on devices in your network.
|
||||
description: Prerequisites, Azure onboarding, and configuring devices for Update Compliance
|
||||
keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.author: jaimeo
|
||||
author: jaimeo, cinglis-msft
|
||||
ms.author: jaimeo, cinglis-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.collection: M365-analytics
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get started with Update Compliance
|
||||
This topic explains the steps necessary to configure your environment for Update Compliance.
|
||||
|
||||
Steps are provided in sections that follow the recommended setup process:
|
||||
This topic introduces the high-level steps required to enroll to the Update Compliance solution and configure devices to send data to it. The following steps cover the enrollment and device configuration workflow.
|
||||
|
||||
1. Ensure you meet the [Update Compliance prerequisites](#update-compliance-prerequisites).
|
||||
2. [Add Update Compliance to your Azure subscription](#add-update-compliance-to-your-azure-subscription).
|
||||
3. [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance).
|
||||
4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and get Delivery Optimization insights.
|
||||
1. Ensure you can [meet the requirements](#update-compliance-prerequisites) to use Update Compliance.
|
||||
2. [Add Update Compliance](#update-compliance-get-started-configure-azure.md) to your Azure subscription.
|
||||
3. [Configure devices](#update-compliance-get-started-configure-devices.md) to send data to Update Compliance.
|
||||
|
||||
After adding the solution to Azure and configuring devices, there will be a waiting period of up to 72 hours before you can begin to see devices in the solution. Before or as devices appear, you can learn how to [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and Delivery Optimization.
|
||||
|
||||
## Update Compliance prerequisites
|
||||
|
||||
Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites:
|
||||
1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 Enterprise edition, as well as [Windows 10 Enterprise multi-session](https://docs.microsoft.com/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc.
|
||||
2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them.
|
||||
3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device.
|
||||
4. For Windows 10 1803+, device names will not appear in Update Compliance unless you opt in. The steps to accomplish this is outlined in the [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance) section.
|
||||
|
||||
1. **Compatible Operating Systems and Editions**: Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance supports both the typical Windows 10 Enterprise edition, as well as [Windows 10 Enterprise multi-session](https://docs.microsoft.com/azure/virtual-desktop/windows-10-multisession-faq). Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc.
|
||||
2. **Compatible Windows 10 Servicing Channels**: Update Compliance supports Windows 10 devices on the Semi-Annual Channel (SAC) and the Long-term Servicing Channel (LTSC). Update Compliance *counts* Windows Insider Preview (WIP) devices, but does not currently provide detailed deployment insights for them.
|
||||
3. **Diagnostic data requirements**: Update Compliance requires devices be configured to send diagnostic data at *Required* level (previously *Basic*). To learn more about what's included in different diagnostic levels, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy).
|
||||
4. **Data transmission requirements**: Devices must be able to contact specific endpoints required to authenticate and send diagnostic data. These are enumerated in detail at [Configuring Devices for Update Compliance manually](update-compliance-configuration-manual.md).
|
||||
5. **Showing Device Names in Update Compliance**: For Windows 10 1803+, device names will not appear in Update Compliance unless you individually opt-in devices via policy. The steps to accomplish this is outlined in [Configuring Devices for Update Compliance](update-compliance-get-started-configured-devices.md).
|
||||
|
||||
## Add Update Compliance to your Azure subscription
|
||||
Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps:
|
||||
|
||||
1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
|
||||
Update Compliance is offered as an Azure Marketplace application which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps:
|
||||
|
||||
1. Go to the [Update Compliance page in the Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/Microsoft.WaaSUpdateInsights?tab=Overview). You may need to login to your Azure subscription to access this.
|
||||
2. Select **Get it now**.
|
||||
3. Choose an existing or configure a new Log Analytics Workspace. While an Azure subscription is required, you will not be charged for ingestion of Update Compliance data.
|
||||
- [Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance.
|
||||
- [Azure Update Management](https://docs.microsoft.com/azure/automation/automation-update-management) customers are advised to use the same workspace for Update Compliance.
|
||||
4. After your workspace is configured and selected, select **Create**. You will receive a notification when the solution has been successfully created.
|
||||
|
||||
> [!NOTE]
|
||||
> Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance.
|
||||
> It is not currently supported to programmatically enroll to Update Compliance via the [Azure CLI](https://docs.microsoft.com/cli/azure) or otherwise. You must manually add Update Compliance to your Azure subscription.
|
||||
|
||||
2. In the Azure portal select **+ Create a resource**, and search for "Update Compliance". You should see it in the results below.
|
||||
### Get your CommercialID
|
||||
|
||||
|
||||
A CommercialID is a globally-unique identifier assigned to a specific Log Analytics workspace. The CommercialID is copied to an MDM or Group Policy and is used to identify devices in your environment.
|
||||
|
||||
3. Select **Update Compliance** and a blade will appear summarizing the solution's offerings. At the bottom, select **Create** to begin adding the solution to Azure.
|
||||
To find your CommercialID within Azure:
|
||||
|
||||
|
||||
|
||||
4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution.
|
||||
- [Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance.
|
||||
- If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
|
||||
- Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
|
||||
- For the resource group setting select **Create new** and use the same name you chose for your new workspace.
|
||||
- For the location setting, choose the Azure region where you would prefer the data to be stored.
|
||||
- For the pricing tier select **per GB**.
|
||||
|
||||
|
||||
|
||||
5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**.
|
||||
|
||||
|
||||
|
||||
6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**.
|
||||
|
||||
|
||||
|
||||
## Enroll devices in Update Compliance
|
||||
Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are three key steps to ensure successful enrollment:
|
||||
|
||||
### Deploy your Commercial ID to devices
|
||||
A Commercial ID is a globally-unique identifier assigned to a specific Log Analytics workspace. This is used to identify devices as part of your environment.
|
||||
|
||||
To find your Commercial ID within Azure:
|
||||
1. Navigate to the **Solutions** tab for your workspace, and then select the **WaaSUpdateInsights** solution.
|
||||
2. From there, select the Update Compliance Settings page on the navbar.
|
||||
3. Your Commercial ID is available in the settings page.
|
||||
|
||||
|
||||
1. Navigate to the **Solutions** tab for your workspace, and then select the **WaaSUpdateInsights** solution.
|
||||
2. From there, select the Update Compliance Settings page on the navbar.
|
||||
3. Your CommercialID is available in the settings page.
|
||||
|
||||
> [!IMPORTANT]
|
||||
>Regenerate your Commercial ID only if your original ID can no longer be used or if you want to completely reset your workspace. Regenerating your Commercial ID cannot be undone and will result in you losing data for all devices that have the current Commercial ID until the new Commercial ID is deployed to devices.
|
||||
> Regenerate your CommercialID only if your original ID can no longer be used or if you want to completely reset your workspace. Regenerating your CommercialID cannot be undone and will result in you losing data for all devices that have the current CommercialID until the new CommercialID is deployed to devices.
|
||||
|
||||
#### Deploying Commercial ID using Group Policy
|
||||
Commercial ID can be deployed using Group Policy. The Group Policy for Commercial ID is under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure the Commercial ID**.
|
||||
## Enroll devices in Update Compliance
|
||||
|
||||
|
||||
|
||||
#### Deploying Commercial ID using MDM
|
||||
Commercial ID can be deployed through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy beginning with Windows 10, version 1607. Commercial ID is under the [DMClient configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
|
||||
|
||||
### Ensure endpoints are whitelisted
|
||||
To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to whitelist the following endpoints. You may need security group approval to do this.
|
||||
|
||||
| **Endpoint** | **Function** |
|
||||
|---------------------------------------------------------|-----------|
|
||||
| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. |
|
||||
| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. |
|
||||
| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft. |
|
||||
| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
|
||||
| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting in the event of certain Feature Update deployment failures. |
|
||||
| `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors in the event of certain crashes. |
|
||||
| `https://login.live.com` | This endpoint is optional but allows for the Update Compliance service to more reliably identify and process devices. If you want to disable end-user managed service account (MSA) access, you should apply the appropriate [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) instead of blocking this endpoint. |
|
||||
|
||||
### Set diagnostic data levels
|
||||
Update Compliance requires that devices are configured to send Microsoft at least the Basic level of diagnostic data in order to function. For more information on Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
|
||||
|
||||
#### Configuring Telemetry level using Group Policy
|
||||
You can set Allow Telemetry through Group Policy, this setting is in the same place as the Commercial ID policy, under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Allow Telemetry**. Update Compliance requires at least Basic (level 1) to function.
|
||||
|
||||
|
||||
|
||||
#### Configuring Telemetry level using MDM
|
||||
Telemetry level can additionally be configured through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy. Allow Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry).
|
||||
|
||||
### Enabling Device Name in telemetry
|
||||
Beginning with Windows 10, version 1803, Device Name is no longer collected as part of normal Windows Diagnostic Data and must explicitly be allowed to be sent to Microsoft. If devices do not have this policy enabled, their device name will appear as '#' instead.
|
||||
|
||||
#### Allow Device Name in Telemetry with Group Policy
|
||||
Allow Device Name in Telemetry is under the same node as Commercial ID and Allow Telemetry policies in Group Policy, listed as **Allow device name to be sent in Windows diagnostic data**.
|
||||
|
||||
#### Allow Device Name in Telemetry with MDM
|
||||
Allow Device Name in Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry).
|
||||
Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are two ways to configure devices to use Update Compliance.
|
||||
|
||||
> [!NOTE]
|
||||
> After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices.
|
||||
> After configuring devices via one of the two methods below, it can take up to 72 hours before devices are visible in the solution. Until then, Update Compliance will indicate it is still assessing devices.
|
||||
|
||||
### Configure devices using the Update Compliance Configuration Script
|
||||
|
||||
The recommended way to configure devices to send data to Update Compliance is using the [Update Compliance Configuration Script](update-compliance-configuration-script.md). The script configures required policies via Group Policy. The script comes with two versions:
|
||||
|
||||
- Pilot is more verbose and is intended to be use on an initial set of devices and for troubleshooting.
|
||||
- Deployment is intended to be deployed across the entire device population you want to monitor with Update Compliance.
|
||||
|
||||
To download the script and learn what you need to configure and how to troubleshoot errors, see [Configuring Devices using the Update Compliance Configuration Script](update-compliance-configuration-script.md).
|
||||
|
||||
### Configure devices manually
|
||||
|
||||
It is possible to manually configure devices to send data to Update Compliance, but the recommended method of configuration is to use the [Update Compliance Configuration Script](update-compliance-configuration-script.md). To learn more about configuring devices manually, see [Manually Configuring Devices for Update Compliance](update-compliance-configuration-manual.md).
|
||||
|
||||
Reference in New Issue
Block a user