the newest ADMX/ADML template files contain settings to control the Secure Boot cert push/etc. is this actually needed?

When updating Server 2025 running on a VMware environment we are seeing the registry indicating a successful update, but not getting an event of 1808 to indicate it was successful in the update.  We are also not seeing any errors in the event viewer.  Are we safe to assume a successful deployment or that we will get a successful deployment at some point?  Is there something else we need to do to verify deployments are successful?

How will I know when Microsoft have released certificates to all of my enterprise estate, and anything not updated will require some form of remediation?  I feel a little lost not knowing if I'm in the current deployment ring or not

When will Windows 365 gallery images contain the new secure boot certificates?

For manually installing the Secure Boot certificate update, is updating the BIOS the only way to do it? If I’m remembering correctly, the Microsoft-provided steps mainly prepare the device to receive the update from Microsoft, but don’t actually provide a way to manually install it. Can you confirm?

Deploy certificates with registry keys

Deploy certificates via WinCS

Deploy certificates using Group Policy

Will there be native Intune reporting capabilities for monitoring the Secure Boot update?

If a device has the new certs installed and booting on the new certs, will the UEFI2023Status in the registry be set to Updated? 

Just wanted to double check, you said if you're enrolled into any kind of management solution for updates i.e. WSUS,  you won't get the CFR. 

Does this include Windows Update for Business and Autopatch via Intune?

Are the cert updates available through SCCM for endpoints that don't have access to Windows Update?

We see the Secure Boot report in Intune for all of our devices even though they are not all enrolled in Autopatch. Is this expected and would this be accurate? 

Also, the report shows a certificate status as one value, but when you export the report to a CSV, all the values are different (all changed to 'Not applicable'. Has anyone else reported this?