Given that :

• All Windows devices are one of the following manufacturers, Dell, Lenovo and HP
• All Windows devices are updated via WUfB (Intune update rings, Windows drivers = Allow, i.e. all BIOS are updated via WUfB)
• Full https://learn.microsoft.com/sv-se/windows/client-management/mdm/policy-csp-System?WT.mc_id=Portal-fx#allowtelemetry is configured (Allow Telemetry = Full) for all Windows devices
• Assuming that WUfB and AllowTelemetry are working as intended

Can we just sit back and wait for WUfB to update all Windows devices secure boot certificates?