Forum Discussion
Is monthly BIOS updates via Intune overkill for enterprise Windows 11
In my opinion, monthly BIOS updates across the entire fleet is usually too aggressive for most production environments.
I would normally treat BIOS/firmware updates differently from regular Windows quality updates. For BIOS, I prefer a risk-based approach:
- Deploy when there is a security vulnerability, stability fix, hardware issue, or vendor recommendation.
- Test first with a small pilot group.
- Expand gradually by device model.
- Avoid pushing BIOS updates broadly without a clear reason.
There is security value in keeping firmware current, but BIOS updates also carry a higher operational risk than normal OS updates, especially at scale.
So my approach would not be “update BIOS every month by default.” It would be more like: review monthly, approve only what is relevant, test carefully, then deploy in rings.
Intune can help manage the process, but I would still be conservative with BIOS/firmware compared to normal Windows updates.
In my opinion, monthly BIOS updates across the entire fleet is usually too aggressive for most production environments.
I would normally treat BIOS/firmware updates differently from regular Windows quality updates. For BIOS, I prefer a risk-based approach:
- Deploy when there is a security vulnerability, stability fix, hardware issue, or vendor recommendation.
- Test first with a small pilot group.
- Expand gradually by device model.
- Avoid pushing BIOS updates broadly without a clear reason.
There is security value in keeping firmware current, but BIOS updates also carry a higher operational risk than normal OS updates, especially at scale.
So my approach would not be “update BIOS every month by default.” It would be more like: review monthly, approve only what is relevant, test carefully, then deploy in rings.
Intune can help manage the process, but I would still be conservative with BIOS/firmware compared to normal Windows updates.