Manage Insider Preview Builds

Administrators can install and manage Insider Preview builds centrally across multiple PCs within their domain. Here’s how:

Register your domain with the Windows Insider Program

Organizations have the option of registering their Azure Active Directory (Azure AD) domain in the Windows Insider Program. To register a domain, you must be registered in the Windows Insider Program with your work account in Azure Active Directory (AAD) and you must be assigned a Global Administrator role on that Azure AD domain. Also requires Windows 10 Version 1703 or later.

You are not signed in. To see the domain registration link, you must be signed in with your work account in Azure Active Directory (AAD) and you must be assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

SIGN IN WITH YOUR AAD ACCOUNT REGISTERED WITH THE WINDOWS INSIDER PROGRAM

You are signed in with a Microsoft Account.

To see the domain registration link, you must be signed in with your work account in Azure Active Directory (AAD) that is registered with the Windows Insider Program and you must be assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

SIGN IN WITH YOUR AAD ACCOUNT REGISTERED WITH THE WINDOWS INSIDER PROGRAM

You are signed in with an Azure Active Directory (AAD) account that you have not yet registered with the Windows Insider Program.

Also, it has not been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

To see the domain registration link, request that your IT administrator assign your AAD account with a Global Administrator role on that Azure AD domain, register your AAD account with the Windows Insider Program and return to this page to register your Azure AD domain on behalf of your organization.

You are signed in with an Azure Active Directory (AAD) account that you have not yet registered with the Windows Insider Program.

However, your organization’s Azure AD domain is already registered with the Windows Insider Program for Business by your organization’s IT administration.

Discuss the Windows Insider Program for Business with your organization’s IT administration.

You are signed in with an Azure Active Directory (AAD) account that has not been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

However, your organization’s Azure AD domain is already registered with the Windows Insider Program for Business by your organization’s IT administration.

Discuss the Windows Insider Program for Business with your organization’s IT administration.

You are signed in with an Azure Active Directory (AAD) account that has not been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

To see the domain registration link, request that your IT administrator assign your AAD account with a Global Administrator role on that Azure AD domain and return to this page to register your Azure AD domain on behalf of your organization.

You are signed in with an Azure Active Directory (AAD) account that has been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

Your organization’s Azure AD domain is registered with the Windows Insider Program for Business.

You are signed in with an Azure Active Directory (AAD) account that has been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

However, you must first register your AAD account with the Windows Insider Program and then return to this page to register your Azure AD domain.

REGISTER YOUR AAD ACCOUNT FOR THE WINDOWS INSIDER PROGRAM

You are signed in with an Azure Active Directory (AAD) account that you have not yet registered with the Windows Insider Program. It has been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

However, your organization’s Azure AD domain is already registered with the Windows Insider Program for Business by your organization’s IT administration.

Discuss the Windows Insider Program for Business with your organization’s IT administration.

You are signed in with an Azure Active Directory (AAD) account that has been assigned a Global Administrator role on that Azure AD domain by your organization’s IT administration.

REGISTER YOUR DOMAIN WITH THE WINDOWS INSIDER PROGRAM FOR BUSINESS


Note:

At this point, the Windows Insider Program for Business only supports Azure Active Directory (Azure AD) (and not Active Directory on premises) as a corporate authentication method.

If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services — you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business.

If you do not have an AAD account, install Insider Preview builds on individual PCs with a registered Microsoft account.

Join devices to your Azure Active Directory

In order to receive Insider Preview builds, devices must be joined to the same Azure AD domain that was registered with the Windows Insider Program.

To join individual devices, go to Settings>Accounts>Access work or school and enter your Azure AD credentials. You can also integrate your on-premises directory with Azure Active Directory using AD Connect.

Create and manage policies

You can use Group Policy, System Center Configuration Manager or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 Insider Preview Builds are installed on devices.

NOTE:

  • To enable installation of Insider Preview builds, telemetry on a device must be set to level 2 (enhanced) or higher. By default, Windows 10 devices are set to level 3 (full). See Manage your diagnostic data settings.
  • Windows Update for Business policies used to install Insider Preview Builds that are created with one management tool cannot be changed using another. For example, a policy set using Group Policy can only be changed on a client device using Group Policy and cannot be changed using SCCM or Intune.
  • Insider Preview builds cannot currently be installed or managed using Windows Server Update Services (WSUS). For devices managed by WSUS, you will need to disable the Windows Update Agent so a device doesn't scan against WSUS. See Identify clients that use WUfB.

Set using Group Policy

  1. In the Group Policy Management Console (GPMC), go to Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business
  2. Open Manage preview builds to enable installation of Insider Preview builds on a device. This setting can also be used to prevent installation on a device and stop Insider Preview build updates once the release is public.
  3. Open Select when Preview Builds and Feature Updates are received and select the Ring from which you want devices to receive Insider Preview builds (Fast, Slow, Release Preview). This setting can also be used to defer installation for a set number of days after release or pause installation of Insider Preview builds.

See also:

Use Group Policy to configure Windows Update for Business

VIDEO: Installing and managing Preview Builds using Group Policy

Screenshot of 'Select when Preview Builds and Feature Updates are received' screen.

Set using System Center Configuration Manager

Beginning with Configuration Manager version 1802, you can set deferral policies for Windows 10 Insider Preview Builds.

  1. In the Configuration Manager console, go to Software Library > Windows 10 Servicing > Windows Update for Business Policies.
  2. On the Home tab, in the Create group, select Create Windows Update for Business Policy to open the Create Windows Update for Business Policy Wizard.
  3. On the General page, provide a name and description for the policy.
  4. On the Deferral Policies page, go to Defer Feature Updates > Branch readiness level, select the ring from which you want devices to receive Insider Preview builds. You can also defer or pause Insider Preview builds using the Deferral period and Pause Feature updates
  5. Complete the wizard to create the new deferral policy.
  6. To deploy your Windows Update for Business deferral policy, on the Home tab, click Deploy Windows Update for Business Policy and assign the policy to a collection of devices or users.

See also:

Configure Windows Update for Business deferral policies

VIDEO: Installing and managing Preview Builds using SCCM

Screenshot of 'Create Windows Update for Business Policy Wizard'.

Set using Microsoft Intune

  1. Log into the Azure portal and select Intune under Resources.
  2. Navigate to Software Updates > Windows 10 Update Rings. Click “+” to create an Update Ring policy.
  3. Under Servicing Channel, select the Ring from which you want devices to receive Insider Preview builds.
  4. Adjust Feature update deferral period if you want to defer deployment of Insider Preview builds for a certain number of days after release.
  5. Click OK and Create to set policy.
  6. Go to Assignments to assign the policy to users and devices. Note: you can create groups with one or more users or devices in Intune under Groups.

See also:

Manage software updates in Intune

VIDEO: Installing and managing Preview Builds using Intune

'Create Update Ring' screenshot.

Set using other MDM service providers

To set Windows Update for Business policies for Insider Preview builds using non-Microsoft MDM service providers, using the CSP settings below. For guidance on configuring CSPs, see CSPs in MDM.

Update/ManagePreviewBuilds

Update/BranchReadinessLevel

Confirm and track installations

Confirm policy

To confirm that your Windows Update for Business policies have been set correctly, go to Settings > Update & Security > Windows Update on the device and click on "View configured update policies". You can also check the following key in the Registry Editor on the device: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate. A device set to receive an Insider Preview build would show the following values:

  • BranchReadinessLevel = 2 (Fast), 4 (Slow) or 8 (Release Preview)
  • ManagePreviewBuilds = 1

NOTE: Once a policy has been set, the device must be restarted for the policy to be activated.

Track devices

You can use Device Health in Windows Analytics to monitor devices running Insider Preview builds. This can be useful for identifying device, device driver and application issues. See Using Device Health to monitor Insider Preview builds.


How to unregister a domain

If you no longer plan to manage Insider Preview builds for your organization using policies, you will need to unregister your domain with the Windows Insider Program.

NOTE:

  • Unregistering will not allow any other administrators at your organization to continue to set policies to manage Windows Insider Preview builds across your organization.
  • To change update policies on a device after unregistering domain, disable the setting: Select when Preview Builds and Feature updates are received. Your individual registration with the Insider program will not be impacted. If you wish to install Insider Previews on your PC, see the install instructions. If you wish to leave the Insider program, see the leave the program instructions.
  • For guidance on recovering a PC to a current Production build of windows, see the recover your device instructions.