I have a golden image that I update from time to time. Today I tried to use Windows Update on the image and got the 2021-06 Cumulative Update, but not the 2021-07 Cumulative Update. I now see that there is a local GPO that defers quality updates for 30 days and pauses quality updates starting 2020-06-08. (Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received)
I'm sure I didn't configure and enable that GPO myself. Is it baked into the original Azure gallery image? Or perhaps put in as part of the Virtual Desktop Optimization Tool? Is it considered a best practice to defer updates that long, even on images that are solely within the IT department's control?