Blog Post

Windows IT Pro Blog
5 MIN READ

Securing devices faster with hotpatch updates on by default

Chris_Tulip's avatar
Chris_Tulip
Icon for Microsoft rankMicrosoft
Mar 09, 2026
Windows Autopatch is enabling hotpatch security updates by default to help secure devices even faster. This change in default behavior comes to all eligible[i] devices in Microsoft Intune and those a...
A bar chart shows a comparison of the number of days to security compliance for hotpatch updates versus standard updates for four sample companies. Hotpatch updates are faster: three versus 6 days and 7 versus 19 days for the companies with 30,000 devices and 13 or 14 days versus 25 and 27 days for the companies with 50,000 and 70,000 devices.
Updated Oct 22, 2026
Version 2.0
device management
security
servicing and updates
windows 11
windows autopatch
Jan_Gutjahr's avatar
Jan_Gutjahr
Iron Contributor
Aug 10, 2026

I have two questions about how hotpatch behaves during Autopilot provisioning:

  1. Does hotpatch also work during OOBE when using the “Install Windows updates (might restart the device)” option in the Autopilot ESP profile?
    Since ESP can install quality updates during provisioning, I’m wondering whether hotpatch‑eligible updates would be used there as well, or if ESP always relies on traditional cumulative updates. If it can be used, would this allow us to use this feature and avoid a reboot?
  2. How would licensing affect hotpatch during Autopilot? Hotpatch requires a license (e.g. Windows Enterprise), but Autopilot devices typically start as Windows Pro and only upgrade to Enterprise after the user signs in at the end of OOBE. Because hotpatch prerequisites must be met before updates are applied, does this mean hotpatch cannot be used during Autopilot provisioning itself, since the device isn’t Enterprise yet?

Would appreciate clarification on whether hotpatch can play a role during Autopilot, or only after the device completes OOBE and the Enterprise license is active.