Microsoft Entra ID · Remaining Built-in Roles
Windows Update Deployment Administrator
Can create and manage all aspects of Windows Update deployments through Windows Update for Business.
Scope: Windows Update for Business management
Permissions
- Deployments - Create and manage Windows Update deployment settings
- Update Rings - Configure update rings and feature updates
- Driver Updates - Manage driver updates and expedited updates
- Reports - View Windows Update reports and compliance
Common use cases
- Windows patching and update management
- Feature update deployment planning
- Driver update administration
Best practices
- Assign to Windows infrastructure team
- Coordinate with Change Management processes
- Test updates in rings before broad deployment
Common questions
When should I assign the Windows Update Deployment Administrator role?
Assign Windows Update Deployment Administrator when you need to: Windows patching and update management; Feature update deployment planning; and Driver update administration. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Windows Update Deployment Administrator role do?
The Windows Update Deployment Administrator role grants permissions including: Deployments - Create and manage Windows Update deployment settings; Update Rings - Configure update rings and feature updates; Driver Updates - Manage driver updates and expedited updates; and Reports - View Windows Update reports and compliance. See the Permissions section above for the full list.