> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed OS for Windows

> Configure the Managed OS Library Item for Windows 11 in Iru Endpoint. Set feature and quality update deferrals, deadlines, grace periods, and version enforcement.

<Callout icon="microsoft" color="#B84A7A" iconType="regular">This Library Item is available for Windows devices</Callout>

Managed OS Library Items let you define which major Windows 11 feature version devices must be on and set deadlines for installation and restart. Iru Endpoint provides one Library Item per supported Windows 11 release (for example, **Windows 11, Version 24H2** or **Windows 11, Version 25H2**). Assigning a Managed OS Library Item pins devices to that version. Devices will not advance beyond it while the Library Item is assigned, and monthly quality updates within that version continue normally.

Managed OS controls version destination and enforcement timing. For settings that affect the Windows Update end-user experience (notifications, active hours, and optional content), use the [Configure the Windows Update Library Item](/en/endpoint/library/library-items-profiles/configure-the-windows-update-library-item).

<Note>
  For detailed technical background on each setting, refer to Microsoft's official [Update Policy CSP documentation](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update).
</Note>

### Create a Managed OS Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library** and select **Add Library Item**.
  </Step>

  <Step title="Select the Windows 11 version">
    Search for and select the Windows 11 version you want to enforce, such as **Windows 11, Version 25H2**.
  </Step>

  <Step title="Name the Library Item">
    Give the Library Item a **Name** that identifies its purpose in your environment.
  </Step>

  <Step title="Assign to Blueprints">
    Assign the Library Item to one or more **Blueprints**. Only Windows devices in those Blueprints receive the Managed OS settings. You can use Assignment Maps within Blueprints for conditional logic if needed.
  </Step>

  <Step title="Configure settings">
    Set your deferral, deadline, grace period, and pause settings for both feature and quality updates. See [Settings](#settings) below.
  </Step>

  <Step title="Save the configuration">
    Click **Save** in the bottom right corner.
  </Step>
</Steps>

<Note>
  Only one Managed OS Library Item can be assigned to a device at a time. If a device already has one assigned, Iru Endpoint prompts you to confirm before replacing it.
</Note>

### Settings

Managed OS settings are organized into two sections on the **Settings** tab: **Feature updates** and **Quality updates**.

<AccordionGroup>
  <Accordion title="Feature updates" icon="arrows-rotate">
    Feature updates are major Windows 11 version upgrades (for example, moving from 24H2 to 25H2). These settings control when that version becomes available to devices, when installation is required, and how restarts are handled.

    **Branch readiness level**

    Controls which Windows Update channel devices receive feature updates from.

    * **Semi-Annual Enterprise Channel (Preview)** (default): an early preview of the next semi-annual release. Recommended for most environments.
    * **Release Preview**: feature-complete builds ahead of public release.
    * **Windows Insider (Slow)** and **Windows Insider (Fast)**: preview builds for testing; not recommended for production fleets.
    * **Canary Channel**: earliest preview builds; not recommended for managed environments.

    **Defer feature updates for**

    Delays how many days after Microsoft releases a feature update before devices are offered the update. Range: 0 to 365 days (for the Semi-Annual Enterprise Channel (Preview)) or 0 to 14 days (for all other channels). Default: 30 days.

    **Deadline for feature update install**

    Number of days after the end of the deferral period before the feature update must be installed and the device can be forced to restart. Range: 0 to 14 days. Default: 7 days.

    **Grace period for restart**

    Minimum number of days after the feature update is installed before an automatic restart is forced. Range: 0 to 3 days. Default: 2 days.

    **Pause start date**

    Sets a specific date to begin pausing feature updates. While a pause is active, the feature update is not offered to devices. Leave empty if you do not need to pause updates.
  </Accordion>

  <Accordion title="Quality updates" icon="shield">
    Quality updates are the monthly cumulative updates released within a feature version. These settings mirror the feature update controls and apply independently based on each device's current feature version.

    **Defer quality updates for**

    Delays how many days after Microsoft releases a quality update before devices are offered it. Range: 0 to 30 days. Default: 7 days.

    **Deadline for quality update install**

    Number of days after the end of the deferral period before the quality update must be installed and the device can be forced to restart. Range: 0 to 30 days. Default: 7 days.

    **Grace period for restart**

    Minimum number of days after the quality update is installed before an automatic restart is forced. Range: 0 to 7 days. Default: 2 days.

    **Pause start date**

    Sets a specific date to begin pausing quality updates. While a pause is active, quality updates are not offered to devices for up to 35 days from the pause start date. Leave empty if you do not need to pause updates.
  </Accordion>
</AccordionGroup>

### Status

The **Status** tab shows the standard Library Item statuses for each assigned device.

| **Status** | **Meaning**                                                                                     |
| ---------- | ----------------------------------------------------------------------------------------------- |
| Pass       | The Managed OS settings were successfully applied to the device.                                |
| Pending    | The Managed OS settings have been assigned but the device has not yet received or applied them. |
| Error      | An error occurred while applying the Managed OS settings to the device.                         |

<Warning>
  These statuses reflect whether the Managed OS settings were successfully delivered to the device, not whether the device has finished installing the required update. A device can show **Pass** on the **Status** tab while still in the process of downloading or installing an update.
</Warning>

### Considerations

<AccordionGroup>
  <Accordion title="One Managed OS Library Item per Blueprint" icon="layer-group">
    Only one Managed OS Library Item can be assigned to a Blueprint at a time. If you assign a new version to a Blueprint that already has a Managed OS Library Item assigned, Iru Endpoint prompts you to confirm the replacement. The previous Library Item is removed from the Blueprint when you confirm.
  </Accordion>

  <Accordion title="Version ceiling behavior" icon="lock">
    A Managed OS Library Item acts as a ceiling on the feature version. Devices will not advance beyond the targeted version while the Library Item is assigned. Monthly quality updates within that version continue unaffected.
  </Accordion>

  <Accordion title="Defer, pause, and deadline interaction" icon="calendar">
    Deferral and pause control when an update becomes available to devices. Deadline and grace period control how soon installation and restart are enforced once the update is available. Pausing an update stops it from being offered, but does not reset the deferral timeline once the pause ends.
  </Accordion>

  <Accordion title="Grace period and auto-restart" icon="clock">
    If you set the grace period to a value greater than 0, the device will not force a restart at the deadline until the grace period ends. Setting the grace period to 0 allows the device to restart at the deadline without waiting.
  </Accordion>
</AccordionGroup>

### Best Practices

<CardGroup cols={2}>
  <Card title="Use multiple Library Items to create rings" icon="diagram-project">
    Create multiple Library Items with different deferral periods to allow the update to roll out over time, reducing risk and enabling patching issues to be caught before rolling out to additional devices. Set a deferral to 0 days for the initial ring so those devices get updates immediately when released.
  </Card>

  <Card title="Start with a deferral period" icon="calendar">
    A deferral of 7 to 30 days gives you time to validate updates on a small group of devices before they roll out to the full fleet.
  </Card>

  <Card title="Set a deadline for compliance" icon="clock">
    Configuring a deadline ensures devices install required updates within a predictable window, reducing exposure to unpatched vulnerabilities.
  </Card>

  <Card title="Use pause for planned freezes" icon="pause">
    Use the pause start date during major business events or when a release has known issues. Pausing stops the update from being offered without changing your deferral configuration.
  </Card>

  <Card title="Pair with the Windows Update Library Item" icon="microsoft" iconType="brands" href="/en/endpoint/library/library-items-profiles/configure-the-windows-update-library-item">
    Managed OS controls version enforcement. Assign a **Windows Update** Library Item to the same Blueprint to also manage active hours, notifications, and end-user update experience settings.
  </Card>
</CardGroup>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Error status on one or more devices" icon="circle-exclamation">
    **Possible causes:**

    * The device encountered an issue receiving the Managed OS settings via MDM.
    * A conflicting policy from another source is preventing the settings from applying.

    **Solutions:**

    * Check the device record for recent activity and error details.
    * Confirm no other MDM profiles or policies are setting conflicting Windows Update CSP values on the device.
  </Accordion>

  <Accordion title="Feature updates are still being offered after a pause is set" icon="pause">
    **Possible causes:**

    * The pause start date is set in the future and has not taken effect yet.
    * The device has not checked in since the pause was configured.

    **Solutions:**

    * Confirm the pause start date is set to today's date or earlier.
    * Trigger a device check-in or wait for the next scheduled check-in.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Library Overview" icon="books" href="/en/endpoint/library/library-items-profiles/library-overview">
    Learn how Library Items work and how to assign them to Blueprints
  </Card>

  <Card title="Configure the Windows Update Library Item" icon="microsoft" iconType="brands" href="/en/endpoint/library/library-items-profiles/configure-the-windows-update-library-item">
    Configure end-user update experience settings, active hours, and optional content for Windows devices
  </Card>

  <Card title="Configure Managed OS for macOS" icon="apple" iconType="brands" href="/en/endpoint/library/managed-os/configure-managed-os-for-macos">
    Configure managed OS updates for Mac computers
  </Card>

  <Card title="Using Conditional Logic in Blueprints" icon="route" href="/en/endpoint/blueprints/assignment-maps/using-conditional-logic-in-blueprints">
    Use Assignment Maps to target Library Items to specific groups of devices within a Blueprint
  </Card>
</CardGroup>