# Do not treat the Tunnel upgrade-window end as a completion deadline

> Can a Microsoft Tunnel server upgrade continue after its configured maintenance window ends?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-234-do-not-treat-the-tunnel-upgrade-window-end-as-a-completion-deadline/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:02+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Can a Microsoft Tunnel server upgrade continue after its configured maintenance window ends?

## Potentially affected

Use this interpretation when scheduling Tunnel Gateway server upgrades for a site. Identify the effective site settings and time zone before promising a business restoration time.

## DSE recommendation

Plan staffing and service observation beyond the latest permitted upgrade start.

## Article

## Source facts

A Microsoft Tunnel site’s maintenance window limits when an upgrade cycle may start. A cycle begun before the end can continue and finish afterward. The selected site time zone applies to every server there, regardless of individual server time zones. Automatic upgrade and administrator approval are separate site choices. The configured maintenance window must span at least one hour. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/install).

## Applicability

Use this interpretation when scheduling Tunnel Gateway server upgrades for a site. Identify the effective site settings and time zone before promising a business restoration time.

## DSE recommendation

Plan staffing and service observation beyond the latest permitted upgrade start. Have the Tunnel owner distinguish approval time, allowed start interval, actual start, and observed completion in the maintenance record. Confirm who responds if a late-starting cycle is still active at the window’s end. Do not shorten the operating plan by assuming the configured end time forcibly stops work, and do not assume a window grants manual approval.

## Verification

For an approved upgrade, record the site time zone and actual cycle timestamps alongside server version and health afterward. Validate an intended client connection and internal resource access. If completion extends beyond the window, compare it with the documented start-time rule before declaring a scheduling defect. Preserve the evidence for planning the next maintenance period.

## Official references

[Microsoft Learn: Install the Microsoft Tunnel VPN for Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/install).

## Primary reference

- Name: Install the Microsoft Tunnel VPN for Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-security/microsoft-tunnel/install
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not treat the Tunnel upgrade-window end as a completion deadline,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-234-do-not-treat-the-tunnel-upgrade-window-end-as-a-completion-deadline/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.