IT pros: join us every month for Windows Office Hours!

Hello,

During a previous Secure Boot Office Hours session, I was told that the Secure Boot DBX update rollout was targeting only devices with a High Confidence readiness state.

However, what we're observing in our environment doesn't seem to align with that guidance. We have more than 14,000 devices that have already received the update, and approximately 49% of those devices were not in a High Confidence state at the time. Many were categorized as:

• Under Observation - More Data Needed
• No Data Observed - Action Required
• Temporarily Paused

Given the volume of devices involved, this does not appear to be a small anomaly.

Could you help explain:

1. Is the DBX/Secure Boot update currently being offered to readiness states other than High Confidence?
2. Does Windows Update use additional confidence or telemetry signals that are not exposed in the public readiness reporting?
3. Is there documentation that explains how devices in states such as "Under Observation," "No Data Observed," or "Temporarily Paused" can still receive the update?

The only extra steps we took where making sure a correct BIOS Version is being deployed to the best of our ability and we set the RegKey “AvailableUpdates” to 0x5944 on all devices that did not have updated certs.