Intune Devices Missing Windows 10 Feature Updates? Potential Causes & Solutions

Table of Contents

Managing Windows 10 feature updates effectively is crucial for maintaining a secure and modern fleet of devices. Microsoft Intune serves as a powerful tool for this purpose, allowing organizations to streamline update deployments and ensure consistency across their managed endpoints. However, administrators occasionally encounter situations where Intune-managed Windows 10 devices, particularly those running version 1709 or later, fail to receive feature updates, even when configured correctly. This often leads to devices falling out of compliance, potentially exposing them to security vulnerabilities or preventing access to new functionalities.

This article delves into a specific scenario where feature updates are conspicuously absent, despite servicing and definition updates installing without issues. We will explore the common symptoms, pinpoint the underlying cause related to a critical service, and provide a clear, actionable solution to rectify this problem, ensuring your devices receive the necessary feature updates to stay current. Understanding the nuances of update mechanisms within Intune is key to proactive device management.

Symptoms of Missing Feature Updates¶

When feature updates are not being offered to Intune-managed Windows 10 devices, the problem can manifest in several ways. The most direct indication typically involves the devices remaining on older feature versions of Windows 10, even when new versions are available and policies are configured to deploy them. This discrepancy can lead to devices being flagged as non-compliant within the Intune console, alerting administrators to a potential issue in the update pipeline.

Consider the following specific conditions that often precede and accompany this issue:
* The affected computer is running Windows 10, version 1709 or a later version, which are typically managed by Intune for updates.
* The device is indeed managed by Microsoft Intune, implying that it should be receiving policies and configurations from the service.
* The computer is set up to receive updates from Windows Update, frequently leveraging Windows Update for Business (WUfB) functionalities. This includes receiving both quality and feature updates directly from Microsoft’s update service.
* Crucially, servicing (cumulative) and definition (antivirus, etc.) updates are successfully installed, indicating that basic connectivity to Windows Update is functional, but feature updates are stalled.

Beyond these observable behaviors, detailed diagnostic logs often provide the definitive evidence of the problem. Examination of the WindowsUpdate.log file, a critical resource for troubleshooting update issues, will reveal specific error entries. These logs chronicle the update agent’s activities, including search attempts, communication with update servers, and any failures encountered during the process.

Analyzing WindowsUpdate.log Entries¶

The WindowsUpdate.log file is instrumental in diagnosing Windows Update problems. In this specific scenario, you will observe a series of repeating error messages that point to an authentication or service-related failure. These errors typically appear during the “Finding updates” phase, indicating that the device cannot properly authenticate or obtain the necessary tokens to discover feature updates.

Here are the characteristic log entries you might find, often in a repetitive sequence:

Agent         * START * Finding updates CallerId = Update;taskhostw Id = 25
Agent         Online = Yes; Interactive = No; AllowCachedResults = No; Ignore download priority = No
Agent         ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service
Agent         Search Scope = {Current User}
Agent         Caller SID for Applicability: S-1-12-1-2933642503-1247987907-1399130510-4207851353
Misc          Got 855E8A7C-ECB4-4CA3-B045-1DFA50104289 redir Client/Server URL: <https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx>"
Misc          Token Requested with 0 category IDs.
Misc          GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN.
Misc          *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
Misc          *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
Misc          *FAILED* [80070426] GetDeviceTickets
Misc          *FAILED* [80070426] Method failed [AuthTicketHelper::AddTickets:1092]
Misc          *FAILED* [80070426] Method failed [CUpdateEndpointProvider::GenerateSecurityTokenWithAuthTickets:1587]
Misc          *FAILED* [80070426] GetAgentTokenFromServer
Misc          *FAILED* [80070426] GetAgentToken
Misc          *FAILED* [80070426] EP:Call to GetEndpointToken
Misc          *FAILED* [80070426] Failed to obtain service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 plugin Client/Server auth token of type 0x00000001
ProtocolTalker *FAILED* [80070426] Method failed [CAgentProtocolTalkerContext::DetermineServiceEndpoint:377]
ProtocolTalker *FAILED* [80070426] Initialization failed for Protocol Talker Context
Agent         Exit code = 0x80070426
Agent         * END * Finding updates CallerId = Update;taskhostw Id = 25

The pivotal piece of information within these logs is the error code 80070426. This error code consistently appears throughout the failure entries. When translated, 80070426 corresponds to ERROR_SERVICE_NOT_ACTIVE - # The service has not been started. This specific message is a strong indicator that a crucial background service, necessary for the update process, is not running as expected. The log entries clearly show failures in obtaining authentication tokens (GetAgentToken, GetDeviceTickets), which are vital for the device to communicate securely and correctly with the update service endpoints to discover feature updates.

Cause of the Update Failure¶

The root cause of the described issue, where Intune-managed Windows 10 devices fail to receive feature updates and exhibit the 80070426 error, directly stems from the state of the Microsoft Account Sign-in Assistant (MSA) service. This service, internally referred to as wlidsvc, plays a more critical role in the update process than its name might initially suggest, particularly concerning feature updates.

The DCAT Flighting service (identified in the logs by ServiceID: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) is a component responsible for flighting, or delivering, specific types of updates, including feature updates. This service relies heavily on the MSA service to obtain a unique global device ID for the device. This global device ID is an essential identifier that allows Microsoft’s update infrastructure to correctly identify and target devices for feature updates, ensuring that the right updates are offered to the right machines based on their configuration and enrolled programs.

If the Microsoft Account Sign-in Assistant service is disabled, it prevents the generation and transmission of this crucial global device ID by the client. Without this identifier, the DCAT Flighting service cannot properly complete its search for feature updates. Consequently, the update request fails, leading to the repeated 80070426 error in the WindowsUpdate.log, indicating that the necessary service is not active or unable to perform its function. The absence of this unique device identification essentially blocks the feature update discovery mechanism, even if other update types (like servicing updates) manage to proceed using alternative pathways or less stringent identification requirements.

The policy controlling the MSA service, Accounts/AllowMicrosoftAccountSignInAssistant, was introduced in Windows 10, version 1703. This policy was designed to give IT administrators the control to disable the MSA service within enterprise environments. While disabling MSA might be considered for specific security or privacy configurations in some scenarios, its impact on the feature update process via the DCAT Flighting service was an unintended consequence for environments relying on Windows Update for Business for feature updates. This highlights the intricate dependencies within the Windows update ecosystem, where seemingly unrelated services can have profound impacts on core functionalities like system updates.

Solution to Enable Feature Updates¶

Resolving the issue of missing feature updates dueated by a disabled Microsoft Account Sign-in Assistant (MSA) service is straightforward through Microsoft Intune. The solution involves reconfiguring the relevant device restriction policy to ensure the MSA service is allowed to run. By setting the Microsoft Account sign-in assistant policy to “Not configured,” you effectively remove any explicit disabling directive, allowing the service to operate as required for feature update discovery.

Follow these step-by-step instructions to implement the fix:

1. Access Microsoft Intune Admin Center: Begin by signing in to the Microsoft Intune admin center. You can typically do this by navigating to https://endpoint.microsoft.com/. Ensure you have the necessary administrative privileges to modify device configuration profiles.

   

2. Navigate to Device Configuration Profiles: Once logged in, from the left-hand navigation pane, select Devices. Under the Policy section, click on Configuration profiles. This area lists all the device configuration policies that are deployed to your managed Windows 10 devices.

   

3. Identify and Edit the Relevant Profile: Locate the profile that is assigned to the affected Windows 10 devices. This profile is likely responsible for setting various device restrictions, including potentially the one that disabled the MSA service. Click on the name of the profile to open its properties.

   Tip: If you have multiple profiles, you might need to check each one that applies to the affected devices, or search for policies related to “Accounts” or “Cloud and Storage”.

4. Modify Device Restrictions: Within the profile’s properties, look for and select Properties (if you’re on the overview page of the profile). Then, within the configuration settings, navigate to the Device restrictions section. This section contains various settings for controlling different aspects of the device.

   

5. Adjust Cloud and Storage Settings: Under “Device restrictions”, find and select the category related to Cloud and Storage. This is where the Microsoft Account sign-in assistant setting is located.

   

6. Set Microsoft Account Sign-in Assistant to Not Configured: Within the “Cloud and Storage” settings, locate the option for Microsoft Account sign-in assistant. Change its setting to Not configured. This action effectively removes any explicit policy that was disabling the service, allowing it to run normally and perform its necessary functions, including assisting the DCAT Flighting service in obtaining the global device ID.

7. Save Changes and Monitor: After making the change, ensure you save the updated profile. The changes will then be propagated to the assigned devices during their next sync cycle with Intune. It may take some time for devices to receive and apply the updated policy. Once the policy is applied, the Microsoft Account Sign-in Assistant service should start, allowing feature updates to be offered during subsequent update checks.

   Verification Steps:
   * On an affected device, open Services (services.msc) and check the status of the “Microsoft Account Sign-in Assistant” service (wlidsvc). It should now be running or be able to start.
   * Initiate a manual sync from the device to Intune (Settings > Accounts > Access work or school > Select account > Info > Sync).
   * Force a check for updates from the device (Settings > Update & Security > Windows Update > Check for updates).
   * Re-examine the WindowsUpdate.log file to confirm that the 80070426 errors related to token acquisition are no longer appearing.

By following these steps, you should successfully re-enable the necessary service, allowing your Intune-managed Windows 10 devices to correctly identify and receive feature updates.

More Information and Best Practices¶

The Accounts/AllowMicrosoftAccountSignInAssistant account policy was initially introduced in Windows 10, version 1703, providing IT administrators with granular control over the Microsoft Account Sign-in Assistant (MSA) service. While the intent was to offer management flexibility, its interaction with the DCAT Flighting service’s reliance on a global device ID for feature update delivery became a critical dependency. Setting this policy to “Disabled” inadvertently blocks the device’s ability to properly authenticate and communicate with Microsoft’s update servers for feature updates, leading to the issues described. Changing it to “Not configured” ensures that the service operates in its default state, which is necessary for the update process.

Understanding Windows Update for Business and Intune¶

Windows Update for Business (WUfB) allows organizations to manage Windows 10 and Windows 11 updates without the need for on-premise infrastructure like WSUS or SCCM. Intune seamlessly integrates with WUfB, enabling administrators to configure deployment rings, deferrals, and other update settings through device configuration profiles or Update Rings. This direct integration with Microsoft’s cloud services simplifies update management, but it also means that underlying service dependencies, like the MSA service for feature update authentication, become paramount.

Common Reasons for Update Failures (Beyond MSA Service)¶

While the disabled MSA service is a specific cause for missing feature updates, it’s important to recognize that various other factors can impede the update process. A holistic approach to troubleshooting is often necessary. Here are some common culprits:

• Network Connectivity Issues: Devices must have consistent internet access to connect to Windows Update servers. Proxy servers, firewalls, or network access control (NAC) solutions can sometimes block necessary URLs or ports.
• Conflicting Policies: Other Group Policies or MDM policies might conflict with Intune’s update settings. It’s crucial to ensure there are no overlapping or contradictory configurations that prevent update detection or installation.
• Device Health and Readiness:
  • Low Disk Space: Insufficient free disk space is a common reason for feature update failures, as they require significant storage for download and installation.
  • Corrupt Update Components: The Windows Update client, its service, or related components can become corrupted. Resetting these components or running the Windows Update Troubleshooter can often resolve these issues.
  • Driver Compatibility: Outdated or incompatible drivers can sometimes prevent feature updates from installing or even being offered.
  • Hardware Compatibility: Very old hardware might not be supported by newer Windows 10 feature versions.
• Update Ring Configuration Errors: Incorrectly configured update rings in Intune (e.g., extremely long deferral periods, paused deployments, or misconfigured assignment groups) can lead to devices not receiving updates as expected.
• Branch Readiness Level: Ensure that the “Feature update deferral period” and “Select when Preview builds and Feature Updates are received” settings in your update rings are appropriate for your deployment goals.
• User Activity: Feature updates often require reboots and can take a significant amount of time. If devices are frequently turned off or users consistently defer restarts, updates can be delayed.

Troubleshooting Flow for Intune Update Issues¶

To effectively troubleshoot Windows Update issues on Intune-managed devices, consider adopting a systematic approach. The following diagram illustrates a simplified troubleshooting flow:

mermaid graph TD A[Device not receiving Feature Updates?] --> B{Check Intune Compliance Status}; B -- Non-Compliant --> C[Examine Device Status in Intune]; B -- Compliant --> D[Verify Update Ring Assignments]; C --> E[Check Device Sync Status]; E -- Syncs Regularly --> F[Inspect WindowsUpdate.log on Device]; E -- Not Syncing --> G[Troubleshoot Intune Enrollment/Connectivity]; F -- 80070426 Error present? --> H[Is MSA Service Disabled?]; H -- Yes --> I[Set "Microsoft Account Sign-in Assistant" to Not Configured in Intune]; H -- No --> J[Check for other common update errors in log]; J --> K{Are network/proxy issues present?}; K -- Yes --> L[Review Firewall/Proxy Configuration]; K -- No --> M{Are Windows Update components healthy?}; M -- No --> N[Reset Windows Update Components]; M -- Yes --> O[Check for conflicting GPOs/MDM Policies]; O --> P[Review Device Disk Space and Hardware Compatibility]; I --> Q[Force Device Sync & Check for Updates]; Q --> R[Monitor Update Status]; G --> R; L --> R; N --> R; P --> R;

Video Resource: Troubleshooting Windows 10 Feature Update Issues with Intune¶

For those who prefer a visual guide or wish to delve deeper into practical troubleshooting techniques for Intune-managed Windows 10 update issues, consider watching the following conceptual video. While this specific video is a placeholder, a real-world equivalent would walk you through common scenarios, log analysis, and step-by-step resolution processes within the Intune portal.

(Note: This is a conceptual video thumbnail. In a live article, a relevant YouTube video would be embedded here.)

This video would cover aspects such as:
* Navigating the Intune admin center for update management.
* Interpreting WindowsUpdate.log entries and identifying common error codes.
* Best practices for configuring Windows Update for Business policies via Intune.
* Steps to manually force a device sync and update check.
* Additional troubleshooting tips for network, service, and component-related update failures.

By leveraging these resources and understanding the intricacies of Windows Update within an Intune environment, administrators can effectively manage and resolve common issues related to missing feature updates, ensuring their device fleet remains secure, compliant, and up-to-date. Consistent monitoring and proactive policy management are key to a healthy update ecosystem.

Have you encountered similar issues with feature updates in your Intune environment? What troubleshooting steps proved most effective for you? Share your experiences and insights in the comments below!