topic Windows Update - automatic policy without manual address definition in Next-Generation Firewall Discussions

Windows Update - automatic policy without manual address definition

jakub.kuchniak — Wed, 04 Feb 2026 11:54:50 GMT

Hi,

is there a way on Palo Alto firewalls to allow Windows Update traffic without manually defining a list of addresses?

For example, is it possible to create a policy that automatically determines or updates the list of these addresses, without requiring manual administrator intervention?

I would appreciate any information on whether such solutions exist at all.

Best regards

Re: Windows Update - automatic policy without manual address definition

PavelK — Wed, 04 Feb 2026 23:32:14 GMT

Hello @jakub.kuchniak

thanks for post!

You could try to create a security policy with app-id: "ms-update" to allow windows updates.

For reference, here are KB articles with instructions to allow allow Microsoft updates: How to Block Web Browsing while Allowing Microsoft Updates and to block them: How to block a Windows update (You can get required URLs from article to use them to allow traffic).

Kind Regards

Pavel