Power BI Report Walkthrough

Here I've documented each of the pages in the Power BI report to explain the kind of data available to you.

Filters

The report pages contain several filters. Some common ones are:

• Last Sync Time can be used to filter out devices that haven't synced with Intune in X days. You may want to use this to filter out any potentially stale or aged data.

• You can also filter by OS version and support status, for example, to only include OS versions that are currently in support.

• The Update name filter lets you focus on a specific update or updates.

Summarization time in the report pages usually means the time the data was last summarized or updated for compliance calculations by the Azure automation runbooks.

Compliance - Latest CUs

The biggest donut chart displays the installation status of the latest monthly security quality updates, aka the 'B' release, aka the patch Tuesday updates. You have a table with the various installation states and device counts, and there are also compliance charts for the latest monthly security updates, the latest non-security preview updates and the latest out-of-band updates. Note that since these are cumulative, if a device has installed any more recent CU, it will be considered compliant to any earlier CU whether it actually installed it or not.

Compliance - Previous CUs

This page provides an overview of compliance against previous and previous less one updates, for the monthly security, non-security preview and any out-of-band updates. Again, since updates are cumulative, if a device has installed any more recent CU, it will be considered compliant to any earlier CU, including for out-of-band updates. Use the filters to focus on specific updates for specific OS releases.

Trend - Latest Security CU

This chart show the trend of installation states over time for the latest security monthly quality updates. Again use the filters to focus on something in particular, for example in the view below I am filtering on the latest update for Windows 10 21H2 and devices that are pending a restart for the update.

Trend - Recent CUs

This trend chart is similar but it displays compliance states rather than installation states, and allows you to select other update types, such as an out-of-band update, or a previous update.

Compliance Table - Recent CUs

Here you can view device compliance counts per update. Use the filters to focus on specific update types, or a particular release date for example.

Devices - Recent CUs

Here you can view data for individual devices, using the filters to focus on what devices you want to see. For each device, you can see the current OS and build number, its patch age, whether its in support, the installation state for the latest monthly security update, compliance states for all recent CUs etc. The table can be easily exported to Excel if required.

Trends - Feature Updates

Here you can view the trend over time for feature update adoption, as well as Windows 11 adoption. Hover over any time point to see the device counts per release.

Windows Upgrade Readiness

Here you can see how many and which devices are capable of upgrading to a Windows 11 release, or are blocked by a compatibility blocker or a safeguard hold.

This particular page will need updating periodically to accommodate new Windows 11 releases when they are generally available.

Feature Update Successes

Here you can track successful feature update installations, including which OS release they were coming from, which OS release they were going to, and when they upgraded.

Feature Update Failures

This page focuses on any devices that have failed to install a feature update. It provides the error code and extended error code (where applicable), a friendly description of the error code (where they are documented) as well as details reported by the SetupDiag utility - for OS versions since Windows 10 2004 that automatically run this if there is an issue.

OS Version Charts

Here you can view charts for the OS support status of your devices, W10 vs W11, OS editions and OS release counts. In the matrix, you can view the device counts by supported/unsupported, version, release and edition.

OS Support Status

Here you can view each Windows release and edition together with its current support status, start and end dates and how many days of support are remaining.

CU Release History

This page shows each cumulative update released for each Windows release over time including the build number, KB number and release date. Use the filters to narrow down particular updates.

MDM WUfB Policy

This page shows you which WUfB policies have been set for each device using Microsoft Intune. For example, you can see what a feature or quality update deadline has been set to, what the grace period is, how long updates are deferred for, whether updates are scheduled or paused, etc.

Because of the large number of policy settings, it is best to export the data table to Excel for detailed filtering and analysis.

WU Policy State

This shows the current policy state for Windows update per device. This can be useful for identifying devices that have paused quality or feature updates, the start and end times of the pause, if the TargetReleaseVersion or TargetProductVersion policies are being used to upgrade or lock a device to a particular release, whether Windows update is including or excluding driver updates etc.

Updates Installation Summary

Here you can view installation states for all kinds of Windows updates, including drivers. You can view counts per update for the different installation states, such as Installation Success, Installation Started, Download Started etc. You can also view common error codes and the updates that are affected.

Use the filters to find what you are looking for.

This information comes from the Windows event log and will only be accurate as long as Windows update is used to install the update. Where updates have been installed in other ways that may not log to the event log, the data here may be inaccurate in those cases.

Failed Update Installations

This page focuses on updates that failed to install, for various kinds of updates. You can see the top 10 failing updates and their failure counts, as well as which type of update has the most failures. In the example here, that is clearly driver updates! Use the filters to find which devices are affected, by update, update type, installation status, error code etc.

Where available, error code descriptions are provided.

As for the previous page, this information comes from the Windows event log and will only be accurate as long as Windows update is used to install the update. Where updates have been installed in other ways that may not log to the event log, the data here may be inaccurate in those cases.

Lates CU Out-of-date Summary

This page and the next page are intended to help with troubleshooting of devices that have not (or not yet) installed the latest monthly security update. The filters on both pages are synced with each other, so if you filter one page, you will filter the other.

For example, is the OS now out of support? There might not be any recent patches for it. Is the patch level older than 62 days? In that case, updates might be regularly failing due to an underlying issue with Windows Update or with the component store. Does the device simply need to be restarted to complete the update? Has the device synced with Intune recently? Are updates paused? Does it have WUfB policy applied? Use the filters to narrow down based on these questions.

Latest CU Out-of-date Devices

Linked with the previous page, this one shows the affected devices. Where error codes have been reported, you can filter on those. Use the CurrentPatchLevelAgeInDays column to identify 'persistent offenders' - ie devices missing multiple security updates due to an underlying issue or the lack of an update policy.