> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/application-management/packages/update-group.md).

# Update Group

Managed apps deployed via Intune as **Available** are installed on demand by users from the Company Portal. Intune does not push newer versions to devices that already have such an app installed — an **Available** assignment only ever offers the *current* version to devices that do not have the app yet. As a result, Available‑deployed apps are **not kept up to date natively**.

The optional **Update Group** closes this gap. When enabled per package, RealmJoin detects existing installations and temporarily brings them up to date by assigning the affected devices as **Required (Mandatory)** — without changing the package's normal **Available** assignment.

{% hint style="info" %}
The Update Group can be enabled for both Intune‑managed and RealmJoin Agent‑managed packages. It is most relevant for **Intune Available** apps, since the RealmJoin Agent already keeps Available packages up to date on its own (see [Auto upgrade](/application-management/packages/package-settings.md#expert-settings)).
{% endhint %}

## How it works

{% stepper %}
{% step %}

### Enable the Update Group per package

On the package's detail page, choose **More → Enable update group** (see [Enable additional and restore default groups](/application-management/packages/package-deployment.md#enable-additional-and-restore-default-groups)). RealmJoin creates a dedicated Entra ID group with the `(update)` suffix and assigns it to the app with the **Required** install intent. The group is managed entirely by the RealmJoin Portal and must not be edited manually.
{% endstep %}

{% step %}

### RealmJoin detects outdated installations

Using Intune reporting ("detected apps") data across the tenant, RealmJoin identifies every device that has the software installed at a version *older* than the latest subscribed and assigned version in the package.
{% endstep %}

{% step %}

### Outdated devices are temporarily assigned as Required

Detected outdated devices are added to the Update Group. Because the group carries the **Required** intent, Intune installs the new version on those devices as a mandatory deployment — overriding the "Available, on demand" behavior just for the update.
{% endstep %}

{% step %}

### Devices are removed once up to date

On a later run, devices that report the current version (or are no longer detected as outdated) are removed from the Update Group. They revert to the package's normal **Available** assignment. Membership is reconciled automatically.
{% endstep %}
{% endstepper %}

<figure><img src="/files/g4eeHc9S82LgLinMqhSn" alt=""><figcaption><p>Update Group Enabled</p></figcaption></figure>

## Requirements and scope

* The package must have a **newer version subscribed and assigned**. If no newer version exists, no device is considered outdated and nothing is assigned.
* Detection relies on Intune reporting data, so a device must have reported its installed apps to Intune to become eligible.
* By default the Update Group targets **all** reported devices in the tenant. To restrict this, assign the **"Eligible for Update Group"** permission to specific device groups in the portal settings. Once this permission is assigned to at least one group, the feature only processes devices within those groups.

{% hint style="warning" %}
The Update Group is a temporary, automated **Required** assignment used purely to carry updates. Devices move in and out of it automatically — do not add or remove members manually, and do not reuse the `(update)` group for other assignments.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.realmjoin.com/application-management/packages/update-group.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.