Is it accurate to say that CFR is generally enabled for devices managed by Windows Update for Business, but not for devices managed by WSUS?

I don’t think I fully grasp the distinction between LCU vs. CFR in the context of delivering the Secure Boot update. Is there a Microsoft blog post or documentation that explains how these mechanisms differ and how the Secure Boot update is actually rolled out?

Why was the Secure Boot certificate validity set to about 15 years? Why not 30 years? Why not 10 years? Will Secure Boot certificate updates happen every 15 years in the future?

1. When we set the CSP as

(a) HighConfidenceOptOut = Disable

(b) MicrosoftUpdateManagedOptin = Enable

(c) AvailableUpdates = Enable, When the

certificate deployment starts? provided device has latest firmware and patch (meeting requirement for secure boot)?

Am I correct in assuming that the default db will only be updated by an OEM's BIOS update? In other words, Microsoft updates would only update the Active db, and never the default. Follow up question: What is the risk of not updating the default db when the active db is up to date?

Aside from creating the intune configuration, is there a way to report success or readiness

so if you are saying that you are looking after the consumer updates so they dont need to worry about the cert? why as organization with 6k machines I need to do anything ? thanks  

So the cert is already on OS this is a plan to make sure that it will be deployed properly to the bios? 

have we got event id' to validate if all the default certs have been updated and not just current.

What is Microsoft's recommendation for managing firmware on Surface devices for customers using WUfB?

Assuming from an effort perspective that Enabling Driver Update policies is better than custom SCCM deployments.

Can you clarify what needs to be done to a MECM environment to prepare for this?

can you give instruction on the boot medium, that boot with 2011 keys and can upgrade the new boot manager in the case that windows does not start anymore, because the new keys in db are reset to 2011?