Microsoft explains Windows 10 Safeguard holds and how IT admins can opt out of them

Whenever Microsoft releases a major Windows 10 feature update, some issues will cause the update to fail or rollback on certain PCs. Thanks to programs like Windows Insider, even before the release of the update to the public, Microsoft will have data on issues that might cause the update to fail. In such cases, Microsoft will hold the update for these devices. This is called Safeguard hold. Safeguard holds prevent a device with a known issue from being offered a new operating system version. Once Microsoft fixes the known issues, Microsoft will lift the Safeguard hold for the device and the device will be offered with the latest feature update.

The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices.

Safeguard holds only affect devices that use the Window Update service for updates. Microsoft also allows IT admins to lift Safeguard holds when required. IT admins can out of safeguard protections by using the disable safeguards policy.

In a Mobile Device Management (MDM) tool, use the Update/DisableWUfBSafeguards CSP. In Group Policy, use the Disable safeguards for Feature Updates Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.

It is important to note that disabling safeguards do not guarantee a successfully update process. The feature update installation might still fail.

Source: Microsoft