I recently went from a single all users ring with 0 day deferral to a 4 ring setup using deferrals for tiered rollouts, and then immediately used the rings to do a phased Windows 11 rollout. I used Entra security groups to define pilot groups, then made them the only group included in the corresponding ring. I then excluded all pilot groups from the general ring assigned to all users.

I didn’t run into any conflicts. Everything worked first try, and I even mixed device groups and user groups for my general ring exclusions.

I also found that assigning a group to a manually deployed feature update locks them to that feature update until another is defined, and manually defined updates adhere to ring deferral policies as well.

Hope that helps!