Windows Update dashboard

The Windows Update Dashboard, under Settings > Devices, reports collected Windows patch state for managed devices within the current access and filter scope.

Not the MSPControl Update Dashboard

This is Windows patching on managed devices. The Update Dashboard under System Settings reports updates to MSPControl itself. Different screens, different subject.

What it reports

The agent tracks more than whether updates are outstanding. Per device it records current health, when it last checked, the last error, which updates failed, and whether a reboot is pending after installing.

That distinction is the value of the screen: it separates three populations that look alike in a simple count.

Population	Meaning
Up to date	No issue in the reported status band; still verify scope and freshness
Behind	Updates outstanding, update mechanism working
Unhealthy	The update stack itself is broken — will stay behind until repaired

The third group is the one that matters

A device that is behind may be waiting for its configured schedule, or it may require intervention. A broken update stack is a different cause that a simple “devices needing updates” count does not explain.

Use the health status to find them, and the remediate Windows update command to attempt repair. Chasing the count without separating these two means repeatedly re-pushing updates to machines that cannot install them.

The current quality-status calculation uses the reported last-update age: Current up to 7 days, Exposed above 7 through 15 days, Critical above 15 days, and Unknown without a date. These are reporting bands, not a per-vulnerability verdict or proof that a configured Intune deferral has been evaluated.

Reboot pending

When an update requires a restart, installation alone does not establish that the update is fully applied. The dashboard shows this separately, because it is a different action — someone has to restart the machine, and users defer that indefinitely.

Acting on it

Updates can be installed from the panel, and users can be prompted directly — see monitoring and update management for what the user sees when they are.

Devices that stopped reporting are invisible here

The dashboard shows what devices have told it. A machine that is off, offline, or whose agent has stopped does not appear as at-risk — it simply stops updating its row.

Cross-check against devices that have not reported recently, or an unpatched machine sitting in a drawer will look compliant.

Related

• Monitoring, telemetry and update management
• Device settings and commands
• Update Dashboard — MSPControl’s own updates

Related patch-management review

See Windows patch management for the customer workflow that connects reported status, failed installations, update policy and post-change verification. Keep agent commands, Intune rings, application updates and restart outcomes distinct.