Windows IT Pro Blog articles

Strengthening Key Management Service - (KMS) with Hardware-Based Trust

Monika_Kumar — Wed, 22 Jul 2026 16:00:00 GMT

For years, organizations have relied on Microsoft’s Key Management Service (KMS) to activate Windows devices at scale. While KMS helped enable broad deployment scenarios, modern organizations increasingly require stronger assurances around device identity and activation integrity. Microsoft has continued to enhance activation capabilities with innovations that leverage hardware-backed validation to provide stronger protection against activation misuse and improve trust in device identity.

As attackers have exploited fake or cloned KMS servers, organizations face increased compliance and licensing risk. Microsoft is now further strengthening defenses with KMS Hardware-Secured, which uses Trusted Platform Module (TPM)-based attestation to help verify that a KMS host is running on trusted hardware before it can activate Windows devices.

Build trust into every activation

The cornerstone of this modernization is TPM-based attestation. Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients. This is achieved through TPM – a hardware root of trust that provides cryptographic proof of integrity.

TPM attestation delivers:

Stronger security: Help ensure only verified servers can issue activation licenses.
Tamper resistance: Help protect activation secrets from theft or spoofing by binding them to hardware.
Future-ready compliance: Help ensure the infrastructure is ready for future activation security requirements.

The result is a more trustworthy activation model that helps reduce spoofing risk today while preparing organizations for future security requirements.

How TPM attestation works:

Hardware identity: The KMS host uses TPM-backed attestation to prove its hardware identity. Microsoft verifies this proof before the host can activate devices.
Platform integrity: The TPM confirms the KMS host has not been subject to tampering.
Activation flow: Once verified, the KMS host can securely serve activation requests for Windows devices in the organization.

For customers, this means activation can be tied to a trusted host, not just a software configuration that can be copied or spoofed.

	KMS Hardware-Secured	Legacy KMS
Basis of trust	Hardware root-of-trust via TPM	Software-only; vulnerable to spoofing
Deployment requirement	TPM	No hardware requirement
Operational outcome	Greater trust and simpler long-term operations	Increased risk and operational overhead

Getting ready for KMS-Hardware Secured requirements

Preparing now helps ensure your KMS environment is ready for the transition to hardware-based trust. The following steps can help you assess readiness and plan any required updates.

Inventory your KMS hosts:
- For physical KMS host, confirm the host is certified for Windows Server on Windows Server Catalog. Ensure TPM is installed and enabled.
- For virtual KMS host, guidance for virtualized environments will be provided in future blogs.
Validate TPM attestation: In an elevated Windows PowerShell session, run

Get-TpmSupportedFeature -FeatureList "Key Attestation”

A successful response that displays “Key Attestation” confirms the server supports the TPM attestation capability for KMS Hardware-Secured.

Plan: Inventory your KMS hosts and identify any hardware upgrades needed to support KMS Hardware-Secured.
Communicate: Share readiness plans with IT teams and monitor upcoming enforcement timelines.

Coming soon: KMS Hardware-Secured readiness check

Starting August 2026, Windows Server 2025 will provide readiness messaging to help administrators assess whether a KMS host is ready for hardware-based security, giving teams time to plan upgrades before enforcement begins.

Where you’ll see them

Command line (slmgr /dlv)

✅ “This device is eligible to serve as a KMS host with hardware-based security.”

⚠️ “This device does not meet the requirements for using KMS host with hardware-based security.”

Event logs

Warning entries under Applications and Services Logs > Key Management Service.

Plan your transition now

With the next Windows Server LTSC release, TPM attestation will become mandatory for KMS Hardware-Secured activation. Taking action now gives your organization time to prepare and transition on your own schedule.

As Windows security continues to evolve, trusted activation infrastructure will play an increasingly important role. KMS Hardware Secured helps position your environment for the future while aligning with Microsoft's continued investment in hardware-rooted trust.

Securing today. Preparing for what’s next.

Security in Windows is built into the platform - continuously maintained and designed to evolve as threats change.

Learn more in the Windows Security book and Windows Server Security book or explore Windows 11, Windows Server, and Copilot+ PCs. For broader solutions, visit the Microsoft Security site, follow the Security blog, or connect with Microsoft Security on LinkedIn and @MSFTSecurity.   

Now available: Admin control for SSO prompts in Windows

Justin-Ploegert — Tue, 21 Jul 2026 20:42:06 GMT

IT administrators can now automatically accept SSO permissions on managed Windows devices using a supported registry setting. In this context, SSO, or single sign-on, refers to using the Microsoft credentials from a user’s Windows sign-in to access other Microsoft apps and services without seeing any prompts. This new capability is available beginning with the July 2026 monthly security update (KB5101650) for Windows 11, version 24H2 and 25H2.

Background: What changed and why

In the European Economic Area (EEA), Microsoft updated the Windows sign-in experience so that users are not automatically signed in to other Microsoft applications and services after signing in to Windows. Instead, Windows asks users whether they want to use the same credentials to sign in to additional apps or services — giving users choice over how their Windows account is used for sign-in.

For managed enterprise environments, some organizations wanted additional flexibility to manage the SSO prompt experience on devices where their organizations already manage sign-in policies and trust relationships. To support those scenarios, we’ve developed a registry-based control that lets IT administrators automatically accept SSO permissions on eligible managed Windows devices.

What’s new: Enterprise admin control for sign-in behavior

Starting with the July 2026 monthly security update for Windows 11, version 24H2 and 25H2, IT administrators can deploy the following registry policy to automatically accept SSO permissions on managed devices:

Registry Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD
Value: AutoAcceptSsoPermission (DWORD) = 1

This policy can be deployed via:

Group Policy (GPO)
Microsoft Intune or similar mobile device management (MDM) tool
Microsoft Configuration Manager
Any management tool that supports registry policy deployment

Important details

Scope: Applies only to managed enterprise devices with Microsoft Entra ID accounts
Personal accounts: Prompts remain for personal Microsoft accounts (MSA)
Unmanaged devices: Not affected —prompts remain for non-policy-controlled environments
Supported OS: Windows 11, version 24H2 and 25H2

Getting started

To get started:

Ensure that your devices are running Windows 11, version 24H2 and 25H2 or later.
Install the July 2026 monthly security update.
Deploy the registry policy via GPO, Intune, or your preferred management tool.
Validate SSO behavior across your managed device fleet.

For detailed deployment guidance, visit Admin control for SSO prompts in Windows.

What’s next

We’re continuing to evaluate additional admin controls and transparency features that will give your organization greater confidence in managing authentication experiences across your device fleet. Have feedback? Share your ideas in the Comments.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Understanding Windows monthly updates: Servicing explained

Chris_Morrissey — Thu, 09 Jul 2026 16:00:00 GMT

Windows updates help keep devices secure, reliable, and productive. Whether you're an IT admin or a general user, understanding the different types of Windows updates can help you keep devices protected, productive, and continuously improving.

Most individuals and organizations regularly deploy monthly security updates, released on the second Tuesday of each month. Windows also provides optional non-security preview updates, which give IT teams and early adopters an opportunity to validate upcoming fixes before they're included in the next monthly security update.

This guide explains the purpose of each update type, when updates are released, and how they fit into the modern Windows servicing model.

Monthly security updates

For many of you, the second Tuesday of each month (often referred to as "Patch Tuesday") is a regular part of Windows servicing for client and server endpoints. On this day, we publish monthly security updates for supported versions of Windows.

Monthly security updates are designed to help you maintain security, compliance, and device health. These updates are cumulative. They include security and non-security content introduced in the prior month's security and optional non-security preview updates (see below). In other words, deploying the latest update brings a device up to date with all previously released fixes for that version of Windows. This helps simplify update management and reduce fragmentation across devices.

Note: People tend to use "B release," quality update, security update, monthly cumulative update, and latest cumulative update (LCU) interchangeably.

You can deploy updates through a variety of channels depending on your scenario. General users and some small business environments rely on the built-in Windows Update, allowing Microsoft to manage your updates. Enterprise environments use any combination of Windows Update, Windows Autopatch, Microsoft Intune, Windows Server Update Services (WSUS), Microsoft Configuration Manager, the Microsoft Update Catalog, and/or non-Microsoft tools.

IT admins can also enroll devices in hotpatch updates for a faster time to compliance. Hotpatch updates include security fixes only. They don't include the additional features and enhancements contained in monthly security updates. A quarterly baseline (a monthly security update with restart) is required to bring devices up to date on all the features. After that, the design is that the two subsequent monthly security updates are installed without requiring a restart.

Optional non-security preview updates

Typically released during the fourth week of the month, optional non-security preview updates provide an opportunity to validate upcoming fixes before they become part of the next monthly security update. Optional non-security preview updates are also cumulative and are only offered for the most recent supported versions^[1] of Windows. These updates are intended primarily for early preview of new features before broader rollout, as well as for testing and validation.

New features, like point‑in‑time restore for Windows 11, might initially be released in an optional non-security preview update, then roll out broadly in the following month's security update. Please note that some features roll out gradually, so you might not see them on your devices immediately upon installing an update.

To access optional non-security preview updates on non-IT-managed devices, navigate to Settings > Windows Update > Advanced options > Optional updates. Select from the available updates and select Download and install. Additionally, see how to get Windows updates as soon as they're available for your device. The behavior of IT-managed devices depends on admin controls and policies.

Note: The term "optional non-security preview update" replaces what was formerly referred to as a "C" or "D" release. You might still see lettered shorthand references in IT management tools or documented release information. Inside Windows Update, you'll find them in the format of YYYY-MM Preview Update (KB number) (update build number). Learn more about Simplified Windows Update titles.

Out-of-band update

In exceptional cases, Microsoft releases an out-of-band (OOB) update outside the normal monthly servicing cadence. These updates are designed to help resolve a known issue or to address an immediate, high-risk security concern. Some of these are optional, while others are recommended as security updates. OOB updates are typically cumulative, meaning they include all previously released fixes for the supported version of Windows in addition to the targeted fix. In enterprise environments, these updates are available for deployment through quality update approval and scheduling in Windows Autopatch, the Microsoft Update Catalog, and other enterprise update management tools.

New features and improvements in Windows 11

Windows 11 uses multiple delivery mechanisms to bring new features, experiences, and improvements to supported devices throughout the year. New capabilities can reach you through the annual feature update, monthly updates, or Microsoft Store updates, depending on the scenario or applicable IT controls. This enables us to deliver enhancements when they're ready while maintaining quality and reliability.

In some cases, features become available to devices gradually over time, helping validate quality and compatibility before broader rollout. Aside from using optional non-security preview updates to release new capabilities before enabling them more broadly, Microsoft also uses Controlled Feature Rollout (CFR) technology. Capabilities released via CFR technology are typically disabled by default for organizations. If your organization needs greater control over when certain features become available, you can use commercial management controls.

Recommendations

Keeping devices up to date is critical for security. We recommend that organizations install the latest security updates as soon as they become available.

We also encourage you to take advantage of optional non-security preview updates to internally validate features and fixes ahead of the following month's security update. For early access to the latest Windows features and to give feedback, join the Windows Insider Program.

To help manage updates across your organization, bookmark these:

Update history and release notes: Windows 11, versions 25H2 and 24H2
Windows release health (also available in the Microsoft 365 admin center)
Additional tips and resources in Your Windows release information toolbox
The updated reference onthe Update release cycle for Windows clients

Whether you're updating your personal device or deploying updates across your organization, understanding the Windows servicing model can help you make informed decisions. Now you can manage updates better, prepare for new features with confidence, and keep devices protected and productive throughout the year.

^[1] As of July 9, 2026, "most recent supported versions" refers to Windows 11, versions 26H1, 25H2, and 24H2.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

RDP Multipath with redundant TCP is now generally available for Windows 365 and Azure Virtual Desktop

Rinku_Dalwani — Tue, 21 Jul 2026 16:42:03 GMT

Reliable connectivity is essential for delivering a productive Cloud PC and virtual desktop experience. Network variability—whether caused by packet loss, ISP instability, restrictive firewalls, proxy configurations, VPN routing, or UDP-restricted environments—continues to be one of the most common causes of session interruptions across enterprise remote desktop deployments.

Today, we're excited to announce the general availability of RDP Multipath with redundant TCP support for Windows 365 and Azure Virtual Desktop. This enhancement extends the resiliency benefits of RDP Multipath to TCP-based connections, helping organizations maintain a more reliable and consistent connectivity experience across a broader range of network environments.

RDP Multipath continuously evaluates multiple available connection paths and dynamically selects the most reliable route for each session. If the active connection experiences degradation or becomes unavailable, RDP Multipath can automatically transition to an alternate path, helping reduce session interruptions and improve the overall user experience.

How RDP Multipath works

RDP Multipath establishes and maintains multiple available connection paths between the client device and the Windows 365 Cloud PC or Azure Virtual Desktop session host.

When UDP-based RDP Shortpath connectivity is available, UDP remains the preferred transport protocol for optimal performance and reliability. RDP Multipath can establish multiple UDP paths using STUN (Simple Traversal Underneath NAT) and TURN (Traversal Using Relays around NAT) protocols, enabling sessions to dynamically transition between alternate UDP routes if degradation or failure is detected.

With the addition of redundant TCP support, Windows 365 and Azure Virtual Desktop can now establish standby TCP paths alongside existing UDP connectivity. This means customers connecting through restrictive network environments can benefit from the same resiliency capabilities previously available only across UDP-based connections.

If the active connection becomes unavailable or experiences degraded performance, RDP Multipath automatically transitions to the next available path—UDP or TCP—without requiring user intervention or reconnection. In situations where all paths are lost, such as a temporary network outage, the session attempts to reconnect once connectivity is restored.

Many organizations operate in environments where UDP connectivity is restricted or unavailable because of firewall, proxy, or security requirements. In these scenarios, remote desktop sessions often rely on TCP-based Reverse Connect transport.

Previously, these environments generally relied on a single TCP connection. With redundant TCP support, Windows 365 and Azure Virtual Desktop can now maintain standby TCP paths and dynamically transition between them if the active connection becomes degraded or unavailable. This extends the resiliency benefits of RDP Multipath to customers operating in restrictive network environments.

Key Benefits:

Improved connection reliability: Multiple connection paths are maintained throughout the session. If the active path becomes unstable or unavailable, RDP Multipath can automatically switch to a backup path, helping reduce session interruptions.
Enhanced resiliency across network environments: Organizations can benefit from RDP Multipath whether connections are established through UDP-based RDP Shortpath or TCP-based Reverse Connect transport.
Seamless user experience: Path selection and failover occur automatically and transparently, helping users stay connected and productive without requiring any action.
No additional configuration required: RDP Multipath works automatically when prerequisite requirements are met, simplifying deployment and adoption for IT administrators.

Understanding RDP Multipath connectivity

The diagram above illustrates one example of how RDP Multipath can establish and manage multiple connection paths between a client device and a Windows 365 Cloud PC or Azure Virtual Desktop session.

The exact paths available for a connection depend on factors such as network topology, firewall and proxy configuration, NAT behavior, and whether UDP-based RDP Shortpath connectivity is available.

In the scenario shown above:

A UDP-based RDP Shortpath connection is used as the primary active path.
Additional UDP transport paths can be established through STUN or TURN when supported by the network configuration.
Redundant TCP transport paths can also be maintained as standby paths to improve resiliency.
RDP Multipath continuously evaluates available transport paths and monitors connection health.
If the active transport path becomes unavailable or experiences degradation, RDP Multipath can transition traffic to another available transport path to help maintain session continuity.

When UDP connectivity is available, it remains the preferred transport protocol for optimal performance and reliability. Redundant TCP transport paths extend Multipath resiliency to environments where UDP connectivity may be restricted or unavailable due to firewall, proxy, or network policies.

How to enable RDP Multipath

By default, this feature is enabled for everyone providing seamless integration and enhanced connectivity without requiring any changes from IT departments or end users. Redundant TCP transport paths are currently supported only on Windows devices using Windows App on Windows client, version 2.0.1069.0 or later.

Learn more

To learn more about RDP Multipath, visit:

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Windows 365 for Agents: A secured execution environment for AI agents

Aarthi_Sukumar — Wed, 08 Jul 2026 16:00:00 GMT

AI agents are rapidly evolving from answering questions to performing tasks across enterprise systems. As organizations move from experimentation to production, one question continues to rise to the top for security leaders: how do you run agents securely at scale?

Today, many agents operate in fragmented environments: local machines, shared virtual machines, or unmanaged cloud infrastructure. That can make it hard to consistently enforce identity, apply policies, and maintain the visibility security teams need.

Windows 365 for Agents changes that.

A Cloud PC for enterprise agents, with security built-in

Windows 365 for Agents provides secured, managed Cloud PCs built for AI agents. As your organization governs and protects your human users today, Windows 365 for Agents enables you to apply the same enterprise security and compliance controls to agentic workloads.

Windows 365 for Agents works with Microsoft Entra, Microsoft Intune, Microsoft Defender, Microsoft Purview, and Microsoft Agent 365¹ to provide identity, device management, security, and data governance capabilities for agentic workloads. Agents are designed to operate within enterprise security and compliance boundaries, running in a managed environment with identity, compliance, and security controls.

These core security tenets make it possible.

1. Reduced identity risk with distinct agent identity

Agents running in Windows 365 for Agents are provisioned with their own identity in Microsoft Entra, separate from any human user.

When an agent is hired, a unique agent identity is automatically assigned, helping ensure:

Every action is attributable to a specific agent
Permissions can be scoped precisely
Access can be revoked when necessary

This separation is foundational to Zero Trust. It reduces identity crossover risks and helps ensure agents operate only with the permissions they are explicitly granted. Agents can be governed with full lifecycle management, role-based access control, and auditability built in.

With Entra Conditional Access, organizations can enforce access policies by allowing access to organizational resources only when the Windows 365 for Agents Cloud PC is compliant with the organization’s security requirements. This helps ensure agents access enterprise resources only from managed and compliant Cloud PCs.

By combining identity-based access control with Intune device compliance, organizations can extend Microsoft’s Zero Trust policy engine to agents with the same rigor used for human users.

2. Reduced access risk with agent-only access

Windows 365 for Agents Cloud PCs are reserved exclusively for agents and run on isolated and enterprise-managed compute environments built for agent operations. By providing agents with a dedicated and contained execution environment, organizations can mitigate risks such as privilege escalation, accidental human-agent crossover, and lateral movement across shared accounts. IT administrators can further reinforce these boundaries through Intune provisioning policies that assign Cloud PCs only to agent users, helping ensure these environments are used for their intended purpose.

3. Consistent security and compliance enforcement

Every Windows 365 for Agents Cloud PC is Entra-joined and Intune-enrolled. Such Cloud PCs are managed by Microsoft Intune¹, applying the same security posture your organization already relies on for employee devices.

That means:

Security baselines and compliance policies can be applied from the moment of provisioning
Configuration, hardening, and updates are centrally managed

Agents inherit endpoint security controls, including antivirus, encryption, and device compliance checks. Because these Cloud PCs are managed like any other endpoint, you can extend your existing security investments directly to agentic workloads, simplifying operations while strengthening protection and governance.

4. Network protection with Global Secure Access

Windows 365 for Agents also extends agent security to how agents access the network. Windows 365 for Agents integrates with Microsoft Entra Global Secure Access (GSA) to provide an identity-driven network security layer for agents. This helps organizations apply the same Zero Trust principles they already use for users and devices to agent traffic.

With GSA, organizations can route internet traffic through secure, policy-enforced profiles to help protect agents from malicious destinations, risky connections, and unsafe web activity. Security teams can apply controls for web content filtering, URL-based access policies, and inline threat protection.

By combining network signals with identity and device context, organizations can extend Zero Trust protection beyond authentication and into every network connection an agent makes, while maintaining full visibility into how agents interact with enterprise and external resources.

Read our network security with Global Secure Access learn article to learn more.

5. Governance and visibility into Agent Activity

Security is more than prevention; it is also about governance, visibility, and control. By integrating with Microsoft Agent 365¹, organizations gain visibility into agent activity and can apply governance and policy controls across agent execution environments. Windows 365 for Agents is exposed as a model context protocol (MCP) server in Agent 365, and the telemetry flows into the tools your security teams already use such as Microsoft Defender and Microsoft Purview.

Resilience against threats with Microsoft Defender

Agent activity integrates into Microsoft Defender's AI agent inventory and protection, letting security administrators discover Agent 365 enabled agents in your estate. For agents, Defender offers:

Advanced hunting across all agent activity
Traceability of agent identity, tools, and actions
Threat detection and investigation workflows

Protection of sensitive data with Microsoft Purview¹

On the data side, Microsoft Purview extends your existing security and compliance controls to agentic workloads.

Data Security Posture Management (DSPM) for AI continuously assesses how agents interact with your data and helps you evaluate alignment with your policies.
Activity Explorer delivers granular visibility into agent data usage, including what was accessed, classified, or shared, so sensitive information stays within your policy boundaries.
Existing sensitivity labels, Data Loss Prevention (DLP), and retention policies apply to agent actions similar to human users.
Insider Risk Management (IRM) detects risky agent behaviors, identifies elevated risk levels, and prioritizes investigations before sensitive data is exposed or misused.

Together, Agent 365, Defender, and Purview provide organizations with governance, visibility, and security capabilities for agent activity on Windows 365 for Agents Cloud PCs.

This Windows 365 for Agents demo shows how agents execute in a secure, managed environment.

Are you ready for enterprise-ready agentic computing?

Windows 365 for Agents brings identity, device management, and observability together into a unified, secure platform built for AI agents. In summary, this includes:

Distinct identity to establish the Zero Trust foundation
Agent-only environments to reduce risk of misuse by design
Intune management that enforces a consistent security posture
Identity-aware, real-time network protection with Global Secure Access
Governance and visibility with Agent 365

As your organization scales AI adoption, this model provides governance, compliance, and security capabilities designed to help manage agent workloads throughout their lifecycle.

Ready to put agents to work securely? Learn more about Windows 365 for Agents security on our support page and start running enterprise-ready agentic workloads today.

Footnote: 1. Access to and use of Microsoft Entra, Microsoft Intune, Microsoft Defender, Microsoft Purview, and Microsoft Agent 365 capabilities are subject to applicable licensing requirements and may require separate purchases.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on  LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Windows settings backup becoming a new resilience baseline

Miranda_Leschke — Mon, 06 Jul 2026 21:45:48 GMT

Resilience is about to get easier for the Windows devices you manage! Eligible devices will now have the backup function on by default with Windows settings backup and restore (previously called Windows Backup for Organizations). Today, it's available to Windows Insiders and will be generally available starting with Windows 11, version 26H2. A recoverable list of settings and Microsoft Store apps is becoming a baseline part of the Windows experience rather than an opt-in configuration step.

Note: Restore behavior is unchanged and isn't enabled by default. You still need explicit admin configuration to restore Windows devices

A baseline designed with IT admins in mind

Staying resilient today is no longer a nice-to-have for businesses. Resetting, replacing, and reimaging a PC is fundamental to onboarding and user experience. It's also a baseline for staying resilient.

Imagine a lost laptop, a hardware refresh, or an unexpected reset. These are some of the moments when your users need backup most. And that's rarely when anyone wants to discover that backup was never turned on.

Making backup the baseline shifts it from a best-effort configuration step to a standard capability across your eligible fleet.

Recovery without configuration: Eligible devices with the backup policy in a Not Configured state under Windows settings backup and restore^[1] will back up automatically. Users' settings and Microsoft Store app list are captured out of the box. Note: Restore behavior still requires configuration to be enabled.
Explicit policy always wins: If you have already enabled or disabled the policy, your setting is honored. The default applies only when policy state is Not Configured.
Restore stays admin-managed: The default-on change applies to backup only. The restore function continues to require explicit admin configuration and is off by default.
User choice preserved:End user settings are protected automatically, and they keep full flexibility — they can run a backup at any time from the Windows Backup app and choose which settings are included from the Windows Settings page, all in line with the admin's policy.

We've experienced these benefits first-hand at Microsoft, when we made backups automatic for employees across the organization.

"Windows Backup for Organizations^[1] is changing how device refresh works. Pressure tested inside Microsoft on a global scale, it enables Microsoft Store apps and user settings to move seamlessly with our people and free IT teams from the heavy lifting of device reimaging. The result is a simpler, more resilient experience." - Brian Fielder, Vice President, Microsoft Digital

The operational benefit is simple: When a device needs to be reset, replaced, or reimaged, you can move forward immediately. No need to rush checking whether backup was ever configured for the users. Their familiar setup is already captured and ready to come back with them.

The scope of the default-on Windows backup

The default-on behavior applies to devices that meet all these conditions:

Running Windows 11, version 26H2^[2] or later
In countries or regions not regulated by the EU Digital Markets Act (DMA)Not in sovereign or restricted cloud environments
With the backup policy in a Not Configured state under Windows settings backup and restore*

Devices outside this scope keep their existing behavior:

Devices in privacy sensitive countries or regions remain off by default.
Devices in sovereign or restricted cloud environments remain off by default.
Devices with the backup policy explicitly enabled or disabled continue to honor that explicit setting.
Devices running previous supported Windows 11 versions (except for version 26H1) remain off by default.
Devices originally running Windows 11, version 26H1 will receive the same default-on treatment starting with the following feature update.

Getting started

If your environment is already in scope and in the state you want, you're ready. No action required. Otherwise, here's how to pick the behavior that fits your organization:

Keep backup on (recommended): No action required. Eligible devices with the backup policy in a Not Configured state under Windows settings backup and restore* will enable backup automatically at general availability of Windows 11, version 26H2.
Opt out: Explicitly disable the backup policy through Microsoft Intune, Group Policy, or your MDM solution. Explicit disablement always takes precedence over the default.
Make intent explicit: Set the backup policy to enabled today. This is functionally equivalent to the new default but provides an unambiguous, audit-friendly admin signal, and the ability for user-targeted enablement only.
Control restore behavior separately: Configure the restore policy on its own. The default-on change applies to backup only.

You can validate the experience early. The default-on behavior is available with Windows 11, version 26H2 in Windows Insider Program Experimental channel starting July 2026. It takes broad effect for eligible devices at Windows 11, version 26H2 general availability later this year. Devices originally running Windows 11, version 26H1 will receive the same default-on treatment starting with the following feature update.

Watch this video for a quick tour of the experience:

Ready for broader Windows resiliency

Thank you for your feedback that shaped this change. Making backup the baseline is one step in a broader Windows resiliency effort. We'll keep sharing what's coming next, so you can plan with confidence.

Catch up and learn more:

^[1]Windows Backup for Organizations is now Windows settings backup and restore. You'll start seeing the new name alongside the original name while we update documentation and policy surfaces.

^[2]Windows 11, version 26H2 is the annual feature update for Windows 11, versions 25H2 and 24H2. It will be released in the second half of the 2026 calendar year.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: June 2026

Chris_Morrissey — Wed, 01 Jul 2026 22:00:00 GMT

Earlier this month, we announced that Windows 11, version 26H2—the next annual feature update for Windows 11—is now available for early testing and validation via the Windows Insider Program. As this release will share the same servicing branch as versions 25H2 and 24H2, devices can be updated using an enablement package, quickly and with minimal disruption to users. Microsoft also announced major Windows 365 updates at Build 2026, introducing ready-to-code Cloud PCs, expanded developer-focused capabilities, and new support for secure enterprise AI agents.

Now let's dive into more developments in the world of Windows for IT admins from the month of June.

New in Windows update and device management

[RECOVERY] – Now generally available, point‑in‑time restore for Windows 11 can help users recover in minutes instead of hours by safely rolling a device back to a previous state. This built-in recovery capability is available for Windows Enterprise, Pro, and Home editions of Windows 11.
[W365] – An optimized Teams experience for Remote App scenarios is now available, offering improved audio and video performance, reliability, and security.
[PRINTING] – What was formerly the Modern Print Platform is now Windows Ready Print. It's now Windows preferred means of communicating to printers, including the Internet Printing Protocol (IPP), eSCL scanning, and Universal Print. Starting in July 2026, new printer installations will default to Windows Ready Print where supported, enabling a simpler and more reliable setup experience.
[APPS] – Auto-updates in Microsoft Intune Enterprise Application Management are now available. Keep managed applications on the latest incremental release, such as 4.1 to 4.2, without manual packaging or admin intervention.

New in Windows security

[SECURE BOOT] [TIPS] – If your organization hasn't yet finished updating Secure Boot certificates for client devices, servers, or virtual machines, find out which best practices can help. If you run into devices that are blocked from receiving updated Secure Boot certificates, explore actions you can consider.
[SECURE BOOT] [LINUX] – New guidance is now available to help you manage Secure Boot certificate updates for Linux on Azure virtual machines. This includes Trusted Launch and Confidential VMs with Secure Boot enabled.
[SECURE BOOT] [EVENTS] – In response to your feedback, two specialized Q&A events for Secure Boot will take place in July. Join Secure Boot Office Hours for virtualized environments (July 8). During OEM Secure Boot Office Hours (July 15), get answers from the OEM ecosystem, Broadcom, and Windows cloud experience experts. (Note: There is no on-camera or meeting component to these events. All Q&A will take place in the comments on the Tech Community.)
[IDENTITY] – IAKerb and LocalKDC are new capabilities that expand Kerberos authentication across enterprise and local account scenarios. That's how Microsoft is advancing efforts to reduce NTLM dependency and strengthen security. Available today in the Windows Insider Program, a public preview is coming for both client and server.
[W365] [DATA PROTECTION] – Context-based redirections for Windows 365 can now be explored in public preview. Apply more granular controls to device and resource redirection based on contextual signals. Available signals are device management state, compliance posture, user or group membership, and network conditions.
[HARDENING] – The final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update. This phase completes the transition from legacy encryption types such as RC4. It removes Audit mode and leaves Enforcement mode as the only supported behavior for Kerberos RC4 usage on Windows domain controllers.

To explore what's new in security across the Microsoft platform, see What's new in Microsoft Security: June 2026.

New in AI

[AGENTS] [SECURITY] – At Build 2026, Windows introduced new security foundations for AI agents. They're designed to provide governance, containment, and enterprise-grade controls for autonomous agent workloads.
[AGENTS] [W365] – Windows 365 for Agents is generally available within Agent 365. With this update, Cloud PCs that enable AI agents can execute multi-step workflows across software. Use it to open apps, navigate interfaces, enter inputs, and process data.

New in Windows Server

For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes.

[NETWORKING] – DoH support for Windows DNS Server is generally available on Windows Server 2025. You can now deploy encrypted and authenticated client-to-resolver DNS traffic directly within your existing on-premises DNS infrastructure.
[HOTPATCH] – Hotpatch update support for Windows Server 2022 Datacenter: Azure Edition has been extended through October 2027.

New in productivity and collaboration

Install the June 2026 security update for Windows 11, versions 25H2 and 24H2 to get these and other capabilities, which will be rolling out gradually:

[AUDIO] – Shared Audio can keep people productive on the move. Two people can now to listen to the same audio from a single Windows 11 PC at the same time.
[SECURITY] – When Windows Hello face or fingerprint is set up and available, it's now the default sign-in method every time you sign in. Even if you used a different method previously.
[FILES] – Windows Search will now find and prioritize files with as few as two characters.
[BATTERY] – This update improves resiliency against apps that could keep the sensor hub powered on and drain power. Enjoy a better battery life.

New features and improvements are coming in the July 2026 security update. You can preview them by installing the June 2026 optional non-security update for Windows 11, versions 25H2 and 24H2. This update includes the gradual rollout of:

[WIDGETS] – A quieter, more focused Widgets experience helps reduce interruptions and improves default settings and notification controls. For example, Widgets no longer open on hover, and notifications and taskbar badges are minimized by default.
[ACCESSIBILITY] – You can now apply a full-screen color overlay to help reduce eye strain and improve readability. You can also enter a zoom percentage directly and change it in increments in the Magnifier window for more precise, flexible control. And, you can now use voice access and voice typing in French, German, and Spanish.

To learn about planned productivity, security, and reliability updates for Windows 11, visit the Windows Roadmap.

Lifecycle reminders

[SERVER] – DirectAccess has been deprecated and will be removed in a future version of Windows Server. It has been replaced by a more modern, flexible solution: Always On VPN. For migration guidance, see Remote Access Always On VPN migration.
[WINDOWS 10] [ESU] – The Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year. Coverage is now available through Oct. 12, 2027.

Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025.

Additional resources

Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs, and more? Check out these resources:

Windows Roadmapfor new Windows features – filter by platform, version, status, and channel or search by feature name
Microsoft 365 Copilot release notesfor latest features and improvements
Windows Insider Blogfor what's available in the Beta and Experimental channels
Windows Server Insiderfor feature preview opportunities
Understanding update history for Windows Insider preview features, fixes, and changesto learn about the types of updates for Windows Insiders

Join the conversation

We are always looking to improve this monthly summary. Drop us a note in the Comments and let us know what we can do to make this more useful for you!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Best practices for deploying Secure Boot certificate updates

Nuno_Costa — Tue, 23 Jun 2026 21:00:00 GMT

Deploying Secure Boot certificate updates across the Windows ecosystem has required coordination across operating systems, device manufacturers, and firmware vendors. The steady and coordinated rollout is strengthening the platform root of trust worldwide.

Many individuals and organizations have already successfully updated certificates for client devices, servers, and virtual machines, with others close behind. Proven deployment and validation tools, automatic certificate installation via Windows updates, and firmware support from our OEM partners are helping us all move forward with confidence. However close you are, finishing Secure Boot certificate deployment remains important. If you're still on the path to finishing your Secure Boot certificate deployment, stay the course.

What we've seen work in practice

Every individual device and organization's environment is different.

In the commercial realm, across customer conversations, Ask Microsoft Anything (AMAs) events, and hands-on deployments, a few consistent patterns have emerged:

Early testing builds confidence. Many organizations start with pilots, validate results, and expand rollouts as confidence grows for both Windows and IT teams.
Layered deployment approaches work best. Teams have successfully deployed OEM firmware updates with Windows security updates, using a mix of automation and staged rollout.
Multiple tools can lead to success. From Microsoft Intune to Group Policy, Azure automation, and PowerShell, there isn't a single "right" tool, only the right fit for your environment.

From talking with many of you, we learned that the diversity of tools and deployment approaches is a key reason the transition has succeeded at scale. Organizations are using a flexible resource set that meets their needs where they are.

For home users and organizations that allow Microsoft to manage Windows updates, the experience has been equally straightforward. A few takeaways stand out:

Keeping devices up to date delivers the best experience. Individuals running supported versions of Windows and receiving regular Windows updates have generally received the newer certificates automatically. Don't pause Windows updates; keep them coming!
Built-in protections simplify the update. Secure Boot is enabled by default on most modern PCs, helping these devices receive the newer certificates without manual configuration. Simply keep Secure Boot enabled or re-enable it if needed.
Built-in tools help you be ready. The Windows Security app can help you track progress. It can show whether the new certificates have reached your device and whether Secure Boot remains enabled. If anything is preventing devices from receiving and applying the certificates, you can follow embedded instructions to make progress. Note: In enterprise environments, the Windows Security app is disabled by default.

Overall, for most supported Windows Home and Pro PCs and business devices managed by Microsoft, staying protected has been as simple as keeping Windows up to date and Secure Boot enabled.

NOTE: While most Secure Boot-enabled PCs receive the newer certificates through the monthly Windows update process, a small number might require a firmware update from the device manufacturer. The Windows Security app can help identify whether your device is waiting for a firmware update. In some cases, the firmware updates needed to support these changes might not be available for older device models, depending on the manufacturer's support lifecycle. Reach out to your device manufacturer if you encounter this case.

Our experience at Microsoft

Microsoft's internal deployment followed many of the same principles described throughout this post. We began with limited deployments, used validation and deployment signals to build confidence, and expanded over time. This phased approach helped us identify issues early, validate readiness, and scale deployment in a measured way.

Along the way, we encountered many of the same edge cases and scenarios that many of you are navigating. Those experiences shaped the tools and guidance we've continued to share externally, including:

New Secure Boot status messages in the Windows Security app that help users understand certificate readiness and identify issues that might require attention.
Secure Boot certificate update playbooks for both Windows Client and Windows Server, along with tailored guidance for Windows 365 and Azure Virtual Desktop.
Multiple Ask Microsoft Anything sessions, now available on demand.
Expanded tools for IT-managed environments, including event logs, PowerShell scripts, Microsoft Intune remediations, Microsoft Defender insights, and Windows Autopatch reporting.

Microsoft has been learning alongside you and turning those lessons into resources that you can use.

Keep going; you're on the right path

If you're an IT administrator still deploying Secure Boot certificate updates, you're not alone. Organizations and individuals are progressing at different speeds, based on their environments and requirements. This flexibility is intentional.

What we've seen consistently is that success comes from staying the course:

Keep your devices up to date with the latest Windows updates.
Check that the latest firmware version is installed. You can visit your OEM's support page or use their official support channels.
Continue with your phased rollout. Gradual deployment of certificates, boot managers, and updated OEM firmware, along with validation, remains the most reliable approach.
Use the tools available to you. Whether built into Windows, such as the Windows Security app, or designed for IT-managed environments, these tools help you monitor progress and make informed decisions.

Focus on progress over perfection. Each step forward strengthens your environment's platform root of trust.

Devices with older certificates will continue to function and receive updates, giving you time to complete deployment. Completing this transition helps ensure that your devices stay current with evolving Secure Boot protections.

Resources to support your next steps

We're nearly finished with rolling out automatic certificate updates to individual PCs and business devices. If you are still in the process of rolling out updates in your organization, these resources can help:

In the coming weeks, there are also still opportunities to ask questions. Save the date for these upcoming events:

July 1 – Windows Server Secure Boot AMA
July 8 – Secure Boot Office Hours for virtualized environments
July 15 – OEM Secure Boot Office Hours

Device owners using Windows Personal and Family accounts can use online support channels and phone numbers for additional help.

This has been a long and meaningful journey. Together, we have strengthened the platform root of trust that modern security depends on. Wherever you are in your certificates update process, you are contributing to that shared progress.

Point-in-time restore for Windows 11 is now generally available

Lia_Vargas — Tue, 23 Jun 2026 16:00:00 GMT

When a Windows PC experiences an unexpected issue, every minute of downtime matters. Devices are constantly evolving through updates, apps, policies, drivers, and user activity, which can make recovery complex. For IT teams, getting users back to work often means time-consuming troubleshooting, or full rebuilds that take hours.

Today, we’re excited to announce the general availability of point‑in‑time restore for Windows 11 new built-in recovery capability designed to recover in minutes instead of hours, with confidence, by safely rolling a device back to a previous state. Available in Windows Enterprise, Pro and Home SKUs, point-in-time restore provides admins and employees a quick, built‑in ability to go back in time to a moment before the issue occurred.

This release marks an important step forward in Windows recovery and resilience and reflects what we’ve heard consistently from Windows users and IT admins: recovery should be reliable, simple, and easy to use when it matters most.

Point-in-time restore shown in the Troubleshoot menu for Windows Recovery Environment (Windows RE)

What is point‑in‑time restore for Windows 11 PCs?

Point‑in‑time restore automatically captures comprehensive restore points on a predictable cadence and stores them locally on the device.

With point‑in‑time restore, a device can be restored to the exact system state captured earlier, including:

Windows OS
Installed applications
System and app configurations
Settings
Local user files

Key characteristics:

Automatic and predictable: Restore points are captured on a recurring schedule (default: every 24 hours), so recent recovery points are already available if an issue occurs.
Fast, full‑system recovery: Restore the entire system to a previous state in minutes*, minimizing user and business impact.
Designed for real‑world disruptions: Useful for both one‑off device issues and wider incidents affecting many machines, such as a problematic updates, driver regressions, app corruption, configuration errors or other user or admin-initiated changes that result in system instability.
Built into Windows 11: Configuration is available within system settings, and restore operations are initiated from Windows RE, providing a trusted recovery path even when the Windows PC won’t boot.

*Note: Restore time is dependent on several factors, such as changes that have occurred on the system since restore point capture and system performance.

Point‑in‑time restore is part of Windows resiliency, focused on helping organizations prevent, manage, and recover from PC incidents more effectively. Check out the click-through demo to see the configuration and restore experience. 

How is this different from System Restore?

You may be wondering how point‑in‑time restore compares to System Restore. While both features leverage Volume Shadow Copy Service (VSS) under the hood, point‑in‑time restore is more comprehensive and is built for modern Windows PCs management and recovery.

	Point-in-time restore	System Restore
Restore points	Automatic, configurable cadence; user files are included in restore point	Event-triggered or manual only; user files are excluded from restore point
Reliability	Strict retention and cleanup policies	No retention limits
User experience	Integrated in system settings	Limited to control panel
Storage impact	Minimizes storage impact by integrating with reserved storage*	Higher impact to storage space
Management	Will support robust remote management capabilities	Limited remote management capabilities

*Note: Reserved storage is a Windows feature that sets aside a portion of disk space for successful update installation. It helps ensure that updates, temporary files, and system processes can run reliably, without requiring users to free up space.

How does this feature in Windows 11 compare to point-in-time restore for Windows 365?

Some of you are already familiar with point‑in‑time restore for Windows 365 Enterprise, which protects Cloud PCs. While these features share the same goals of fast recovery and minimal downtime, they are optimized for different environments.

Each solution is purpose‑built for its environment, and organizations may use both depending on device types.

	Windows Client	Windows 365
Feature enablement	Can be enabled or disabled	Always on
Restore point retention	Up to 72 hours	Up to 1 month
Restore point types	Short-term only	Short-term, long term, and manual
Restore point sharing	No sharing, restore points remain local	Support sharing across Windows 365 and Azure Cloud
Restore speed	Likely faster due to local storage of restore point	Speed is affected by network latency and bulk vs. single restores
Storage constraints	Bound by physical disk limits	Scalable, cloud storage

What’s included in general availability (GA)?

Since its initial public preview, point-in-time restore has been enabled on over 2M devices and the feature has continued to mature based on feedback and real‑world testing. GA signals that point‑in‑time restore is ready for production use and to become part of your Windows recovery toolkit.

Highlights in the GA release include:

Availability for all users on consumer and commercial editions of Windows 11
CSPs for remote configuration
Integration with system reserved storage to minimize local storage impact
Visibility into restore points on the system and their disk usage
Consistency in settings across feature updates and integration with OneSettings
Updated documentation and guidance

Configuring point-in-time restore

Configuration defaults for general availability are outlined below:

Configuration	Default	Options	Editions eligible to configure
Feature On/Off	See below	On, Off	Home, Pro, Enterprise
Restore point frequency	Every 24 hours	4, 6, 12, 16, 24 hours	Enterprise only
Restore point retention	72 hours	4, 6, 12, 16, 24, 72 hours	Enterprise only
Maximum usage limit	2% of disk	Percent of disk (min 2 GB, max 50 GB equivalent)	Home, Pro, Enterprise

Point-in-time restore is on by default on some systems not under enterprise management:

Windows Home edition devices
Windows Pro edition devices that are not domain joined and not enrolled in enterprise endpoint management

Point-in-time restore is off by default, until Windows 11, version 26H2 on some enterprise-managed systems:

Windows Enterprise and Education edition devices
Windows Pro edition devices that are domain joined or managed by an organization

*Note: Only devices with an OS volume size of 200GB or greater, will have the feature on by default. The feature will be off by default on devices with OS volume size below 200GB, but admins can turn the feature on if desired.

Point-in-time restore can be configured in system settings: System > Recovery > Point-in-time restore. Only local admins can view or edit point-in-time restore settings on their system.

Point-in-time restore settings page in System > Recovery

Important considerations before you restore

Point‑in‑time restore is a powerful recovery tool, and it’s important to understand its behavior and impact:

Data loss: Any changes made after the selected restore point including files, apps, and settings will be lost. Cloud data is not affected but may require resync. Microsoft recommends storing data in the cloud.
Local storage: Restore points are stored locally and require sufficient disk space. Older restore points are automatically removed when limits are reached.
BitLocker protection: A BitLocker recovery key is required when restoring encrypted devices.

For detailed requirements, limitations, and best practices, we strongly recommend reviewing the documentation.

Restoring a device

Currently, a restore can only be triggered locally by the user when the device is in Windows RE. The steps to perform a point-in-time restore are below:

In Windows RE select Troubleshoot > Point-in-time restore
Enter Bitlocker recovery key
Select a restore point to restore PC to the exact state it was at the time of the restore point
Acknowledge the risks and limitations associated with this feature by selecting Continue
Review the restore point selection, OS version and warning of data loss and select Restore to start the restore process

*Note: Microsoft has announced plans to enable remote initiation in the future, through Intune recovery, giving organizations a more scalable way to restore devices when that capability becomes available.

Start using point‑in‑time restore today and provide feedback

Point‑in‑time restore is now generally available on Windows 11 Client PCs on versions 24H2 and later.

Learn more and get started: point-in-time restore for Windows 11 Microsoft Learn.

We strongly encourage you to share feedback through Feedback Hub, within Recovery and Uninstall > Point-in-time restore as we continue investing in Windows recovery and resiliency.

Looking ahead

Point‑in‑time restore is an important foundation for the future of Windows recovery. As part of Windows resiliency, we’ll continue to enhance point-in-time restore and expand recovery options, improving manageability, and reducing the time it takes to get users back to productivity across a broad range of issues. For the latest updates on Windows, please refer to the Windows IT Pro Blog.

Get ready for Windows 11, version 26H2

Jason_Leznek — Fri, 19 Jun 2026 17:05:18 GMT

The next annual update for Windows 11 is coming soon and is already available to Windows Insiders! Windows 11, version 26H2 continues our focus on delivering a predictable, low-disruption update experience for organizations and IT professionals.

For devices already running recent versions of Windows 11, this release should be easy to adopt. It builds on the same platform and servicing approach introduced in prior releases, while continuing to improve how updates are delivered, tested, and deployed.

In this post, we'll walk through how to prepare for Windows 11, version 26H2.

A familiar update experience, refined

Windows 11, version 26H2 uses the same shared servicing model as recent releases available annually in the second half of the calendar year. Supported devices get this feature update as a small enablement package instead of a full OS replacement.

If your organization is already on Windows 11, version 24H2 or 25H2, the update to 26H2 is similar to a regular monthly update in most environments:

A small, quick installation
Minimized disruption to users
No need for full reimaging or complex deployment motions

Note: Devices running Windows 11, version 26H1 won't be able to update to version 26H2. Instead, they'll have a path to update to a future Windows release. This is because Windows 11, version 26H1 is based on a different Windows core than Windows 11, versions 24H2, 25H2, and 26H2. Here's What to know about Windows 11, version 26H1.

This is possible because multiple versions of Windows 11 share a common servicing branch, including:

The same source code base
The same security and quality updates
The same compatibility validation

The difference between versions is simply which features are enabled.

Shared servicing branch progression

Why this matters for IT organizations

The shared servicing model isn't just a technical detail. It directly impacts how you manage updates across your environment. Compared to full OS upgrades of the past, Windows 11, version 26H2 comes with reduced deployment complexity, improved compatibility confidence, and faster time to value.

Reduced deployment complexity

Because features are delivered continuously and enabled later, there's no large "upgrade event." This makes planning easier and reduces operational overhead.

Improved compatibility confidence

Devices moving between versions on the same servicing branch typically benefit from:

Existing application compatibility validation
Lower risk of regressions
Fewer surprises during rollout

Faster time to value

With smaller updates and faster installations, organizations can move more quickly to the most current release. New features reach you without lengthy deployment cycles.

Support lifecycle considerations

As with previous annual feature updates, moving to Windows 11, version 26H2 resets the Windows support lifecycle for your devices.

This provides:

24 months of support for Home, Pro, Pro EDU, and Pro for Workstations editions
36 months of support for Enterprise, Education, IoT Enterprise, and Enterprise Multi-session editions

What does it mean for your servicing strategy? The annual update becomes a key milestone for maintaining a supported and secure environment.

How to prepare for Windows 11, version 26H2

Already managing Windows 11 in your organization? Preparing for 26H2 should align with your existing update processes.

1. Validate today

Begin testing with devices running recent versions of Windows 11 to confirm compatibility with your apps, policies, and infrastructure.

If you'd like to get a peak of what's coming and begin previewing version 26H2 on devices now, the update is available through the Windows Insider Program in the Experimental channel. Otherwise, your organization might prefer to wait for the update to become available in Release Preview before doing more extensive testing. At that stage, the experience is closer to final shipping quality. We'll have more information to share when version 26H2 is in Release Preview.

2. Use your existing deployment tools

Windows 11, version 26H2 will be available through familiar channels, including:

Windows Autopatch
Microsoft Intune
Windows Server Update Services (WSUS)

3. Plan your rollout rings

Use your standard deployment rings to:

Pilot the update with a small group of devices.
Expand gradually based on validation results.

4. Stay current

Windows features are delivered continuously. Stay up to date with monthly updates to help ensure a smoother transition when the feature update becomes available.

Feature delivery over time with enablement moment

Looking ahead and staying informed

Windows 11, version 26H2 continues the move toward a more predictable and efficient servicing model. This model helps reduce disruption while helping your organization stay secure and up to date. By building on a shared platform and delivering innovation continuously, Windows enables you to focus less on large upgrade projects and more on delivering value to your users.

We'll continue to share updates and guidance as Windows 11, version 26H2 becomes available. In the meantime, test it in the Windows Insider Program's Experimental channel and use the updated plan-prepare-deploy learning path to get ready.

Be sure to follow the Windows IT Pro Blog and join us on the Windows Tech Community for the latest information and best practices.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Introducing Windows Ready Print and Modernized Driver Selection

elliesekine — Fri, 12 Jun 2026 16:00:00 GMT

Introducing Windows Ready Print: a simpler, more reliable path to modern printing with modern driver selection controls.

Windows Ready Print: A clearer path to modern printing on Windows

Printing on Windows is evolving.

As printing environments modernize, customers and partners are asking for solutions that are reliable, secure, and easy to manage across today’s devices. To reflect this shift and make the value of our platform clearer, we are evolving the Modern Print Platform under a new name: Windows Ready Print.

Windows Ready Print highlights what matters most: a streamlined, dependable printing experience built for modern Windows environments. It represents our commitment to simplifying printing, aligning modern standards, and delivering consistent, forward-looking experiences for users, IT admins, and partners.

Driving the transition to Windows Ready Print with driver selection controls

At the core of Windows Ready Print is a transition away from legacy, third party drive-based workflows toward modern, standards-based printing with IPP (Internet Printing Protocol) using the Windows inbox IPP printer driver.

Starting in July 2026, new printer installations will default to Windows Ready Print where supported, enabling a simpler and more reliable setup experience. This change reduces the need for traditional driver management and lays the foundation for a more scalable and predictable print experience.

However, we recognize that not all environments can move to Windows Ready Print immediately. To ensure a smooth and flexible transition, we are introducing the ability for users to configure Windows to install their printers using Windows Ready Print (if supported) or the OEM printer driver during installation.

You can find this setting under Settings > Bluetooth & Devices > Printers & Scanners > Default install printer using Windows Ready Print.

Driver selection configuration in Settings

This feature enables users and IT admins to control how Windows selects drivers when installing printers:

When “Default install printers using Windows Ready Print” is enabled, Windows Ready Print installation is preferred
When “Default install printers using Windows Ready Print” is disabled, default driver selection is used

The configuration applies to new printer installations only, without affecting existing devices.

To enable/disable this feature via group policy, go to:

Launch Group Policy Editor
Navigate to Local Computer Policy -> Administrative Templates -> Printers
Find and select 'Configure Windows Ready Print driver ranking' -> double click to open it
Select 'Enabled' (if you wish to enable Windows Ready Print driver selection) or 'Disabled' (if you wish to explicitly disable Windows Ready Print driver selection).
Select Apply
Select OK

How driver selection configuration works with Windows protected print mode

When you enable "Default install printers using Windows Ready Print", new printer installations will default to Windows inbox IPP printer driver when supported.

When you enable Windows protected print mode, printers are exclusively installed with Windows Ready Print. Devices that do not support Windows Ready Print cannot be installed.

Note: When you’ve enabled Windows protected print mode, you cannot disable “Default install printers using Windows Ready Print".

Teams Remote App/ Cloud App optimization for Windows 365 and Azure Virtual Desktop now GA

PavithraT — Thu, 04 Jun 2026 18:45:09 GMT

Today, we are announcing the general availability of Microsoft Teams for Remote App scenarios, expanding support for optimized Microsoft Teams experiences when connecting to Azure Virtual Desktop. Additionally, Cloud Apps for Windows 365 will also be supported. This update introduces a new media engine that replaces the legacy WebRTC-based optimization.

Optimized Teams experience for Remote App

The new optimization improves audio and video performance, reliability, and security, and simplifies ongoing support by enabling media engine updates without frequent upgrades to the infrastructure or client.

This feature will be available to anyone using Microsoft Teams as a Remote App on Azure Virtual Desktop or Cloud Apps on Windows 365 from Windows endpoints.

Teams users running in Remote App will automatically transition to the new optimization:

Audio and video performance and reliability are improved compared to the legacy WebRTC optimization.
Media engine updates no longer require frequent upgrades to the VDI infrastructure or client.

Note: Give and Take control is not supported at this time.

Try the optimized Teams experience for Remote App and Cloud Apps today

If you are using Windows App on Windows, you can try it today by meeting the following requirements:

On the user device, use Windows App for Windows version 2.0.964.0 or later
On the remote VM, install Microsoft Teams version 26043.2016.4478.2773 or later

Learn more: New VDI solution for Teams | Microsoft Teams | Microsoft Learn

Adaptive data protection with context-based redirections in Windows 365, now in public preview

Derek_Su — Mon, 15 Jun 2026 20:31:33 GMT

Today, we are excited to announce the public preview of context-based redirections for Windows App. This new capability helps organizations apply more granular controls to device and resource redirection based on contextual signals such as device management state, compliance posture, user or group membership, and network conditions. The result is a more adaptive way to help users stay productive while reducing the risk of data leaving the protected Windows environment.

Context-based redirections are part of our broader secure bring-your-own-device (BYOD) strategy. Instead of relying only on a one-size-fits-all redirection policy, admins can use Microsoft Entra Conditional Access authentication context with Windows 365 and Azure Virtual Desktop redirection settings to make redirection decisions that better match the trust level of the session.

Why context matters for redirection

Redirections control important data paths between the local device and the remote session. In BYOD scenarios, an unmanaged or noncompliant device may not meet the same security standard as a corporate-managed endpoint. Context-based redirections help admins align these data paths with policy intent: enable what users need when the session is trusted and restrict higher-risk redirections when the session is not.

This builds on the existing Windows App and RDP security model where the more restrictive setting takes precedence. For example, if one policy allows a redirection but another security layer disables it, the redirection remains disabled. The most restrictive wins behavior, helping provide defense in depth and reducing the chance that a configuration gap becomes a data loss path.

What is in scope for public preview

In this public preview, the core scenarios are centered on:

Clipboard redirection: Control whether clipboard data can move between the local device and the remote Windows session.
Drive and storage redirection: Control access to local fixed, removable, and network storage from the remote session.
Printer redirection: Control whether users can print from the remote session to local printers.
USB redirection: Control whether supported USB devices can be redirected into the remote session.

Context-based redirection will be supported across Windows, web, Android, iOS, and macOS Windows App clients and through a dedicated VM session.

Note: We are currently developing the feature Resultant Set of Policy (RSOP) that will help users and IT admins determine which redirections settings were applied to this connection and which policy source produced this value.

Prerequisites

Note: If you’re testing with a recent gallery image or already have policies in your environment that disable redirections, update those settings before testing, as the most restrictive policy always applies. For context-based redirection to function properly, configure the redirections you want to test as “Not Configured” or “Enabled.”

To simplify testing and rollout, we recommend creating a dedicated device group for pilot Cloud PCs. This allows you to target only test devices with these settings and later reuse the same group when deploying your context-based redirection policy more broadly.

For more information, please visit Manage device RDP redirections for Cloud PCs. | Microsoft Learn.

Get started

To get started with context-based redirections, admins will first create an Entra authentication context, then create an Entra Conditional Access to issue the authentication context.

Once the authentication context and Conditional Access policy are in place, admins can configure the Windows 365 Remote Connection Experience setting policy to require the specified authentication context for the targeted redirections.

Validating the provisioned context-based redirection policy

To validate whether the provisioned context-based redirection policy is working as intended, test it from the user perspective by connecting to a Windows 365 Cloud PC/Azure Virtual Desktop VM that’s associated with the targeted device group:

Use any Windows App client. You can use the Windows web client by going to windows.cloud.microsoft.
Find the targeted, managed Windows 365 Cloud PC/Azure Virtual Desktop VM and click the "Connect" button.
Once the remote session loads, verify the behavior of the 4 redirections. Please visit each redirection’s respective Microsoft Learn documentations for detailed testing instructions:
1. Clipboard redirection: Verify whether copy and paste work between the local device and remote session.
2. Drive redirection enabled: Configure fixed, removable, and network drive redirection over the Remote Desktop Protocol | Microsoft Learn
3. Printer redirection: Configure printer redirection over the Remote Desktop Protocol | Microsoft Learn
4. USB redirection enabled: Configure USB redirection on Windows over the Remote Desktop Protocol | Microsoft Learn

For more information, please visit the respective Microsoft Learn documents for each service:

Windows 365: Context-based redirections (Preview) | Microsoft Learn
Azure Virtual Desktop: Context-based Redirections (Preview) - Azure Virtual Desktop | Microsoft Learn

Reducing NTLM Dependency: IAKerb and LocalKDC in Windows Insider Preview

mariam_gewida — Tue, 02 Jun 2026 16:32:15 GMT

Today, Windows expands where Kerberos works—reducing the need for NT LAN Manager (NTLM) fallback with IAKerb and LocalKDC, coming to client and server public preview later this month for Windows Insiders in the Canary Channel. These capabilities extend Kerberos authentication to scenarios that previously required NTLM, helping organizations reduce their dependency on legacy protocols. For developers, this means more authentication flows can rely on modern, Kerberos-based identity (even in environments that previously required legacy protocols), reducing the need for application workarounds and helping ensure consistent behavior across managed and unmanaged environments.

With this release:

IAKerb will be enabled by default
LocalKDC will be disabled by default
Both features will be configurable through registry keys

Note: For this public preview, configuration is exposed through registry settings so you can evaluate these capabilities in Insider environments. Management surfaces, such as Group Policies and MDM-based management, will be introduced as these capabilities mature.

Why this matters

For many organizations, moving away from NTLM is a security priority. But in practice, NTLM often remains in use because there are still real-world scenarios where traditional Kerberos cannot be used directly, such as:

Devices that do not have direct line-of-sight to a domain controller
Authentication flows involving local accounts
Standalone or workgroup environments
Network topologies where Kerberos reachability is limited

IAKerb and LocalKDC address many of these gaps (though not all) by extending Kerberos support, reducing reliance on NTLM fallback across customer environments.

What is IAKerb?

IAKerb (Initial and Pass-Through Authentication using Kerberos) enables Kerberos to work when the initiating device (Kerberos client) does not have direct connectivity to a domain controller. In a traditional Kerberos flow, the client must communicate directly with a domain controller to obtain the tickets needed for authentication. In some environments, that path is not available even though the client can still reach the target service. In those cases, IAKerb enables the target service to act as a proxy for the Kerberos exchange, allowing authentication to stay on a Kerberos-based path rather than falling back to NTLM.

This makes IAKerb especially useful in environments with:

Network segmentation
Restricted domain controller visibility
Remote or cloud-connected access patterns
Architectures where clients can reach services but not DCs directly

What is LocalKDC?

LocalKDC is a local Key Distribution Center implementation in Windows that enables Kerberos-based authentication for local account scenarios. Historically, local account authentication across machines has often depended on NTLM. LocalKDC helps close that gap by allowing Windows to use Kerberos semantics for local identity scenarios that would otherwise require legacy authentication. This is especially relevant for scenarios such as:

Workgroup environments
Standalone devices
Local account access to remote resources
Peer-to-peer or small-scale environments without domain infrastructure
Administrative or file access scenarios where local identities are used

How these features fit together

IAKerb and LocalKDC address different but complementary gaps in Windows authentication, reducing reliance on NTLM across both enterprise and local identity scenarios.

IAKerb is meant for enterprise and corporate environments, where domain credentials are used but Kerberos authentication cannot always complete because the client lacks direct line of sight to a domain controller. By allowing authentication to remain on a Kerberos-based path in these situations, IAKerb helps reduce NTLM usage for high-value corporate credentials . This is important because reducing the use of NTLM for enterprise credentials helps strengthen defenses against credential theft and relay-based attack paths, including forms of lateral movement that have historically relied on NTLM fallback.
LocalKDC addresses a different class of scenarios: local and non-domain identities, including workgroup, standalone, and local account access patterns. In these cases, LocalKDC helps bring Kerberos-based protections to scenarios that traditionally depended on NTLM for local credentials.

Together, these capabilities extend Kerberos in two directions: domain-based enterprise credentials, and local and consumer-style account scenarios, further reducing the exposure to credential theft and relay-based attacks. This matters because, as part of a broader shift toward modern and enforced authentication, simply disabling older protocols is not enough. Organizations also need secure, reliable authentication that works consistently, without falling back to legacy protocols. These features help deliver that by providing modern, compatible alternatives that reflect how customers operate today.

Registry Configuration:

For this public preview, IAKerb and LocalKDC can be configured using registry settings under:

The supported values for this preview are:

DisableIAKerb
DisableLocalKDC

Set the value to:

0 to enable the feature
1 to disable the feature

Note: If a registry value is not present, Windows uses the default behavior for that release. In this preview, the defaults are:

IAKerb: enabled by default (0)
LocalKDC: disabled by default (1)

This gives you flexibility to evaluate the features in Insider environments while controlling rollout and validation according to your needs.

What you can do now

With this public preview, customers participating in the Canary Channel can test these capabilities in preview environments and validate the scenarios where NTLM is still commonly used. These features are designed to address important NTLM fallback scenarios but will not eliminate every remaining NTLM dependency in Windows environments; some scenarios may still require NTLM based on application behavior, infrastructure assumptions, or legacy dependencies. Our goal with this preview is to close some of the key gaps by extending Kerberos to more scenarios, while continuing broader work to reduce NTLM dependency across the platform over time. Once available, you can use this preview to help:

Identify scenarios already covered by IAKerb or LocalKDC
Validate those scenarios in controlled environments, and use the documented configuration options to control enablement during testing
Understand where NTLM dependencies still remain using our enhanced NTLM Auditing
Check for dependencies such as name resolution, SPN configuration, or legacy assumptions
Prepare for future improvements that will address additional cases

We also recommend evaluating the following areas:

Access to SMB shares
Remote administration scenarios
Environments with limited or no direct Domain Controller (DC) connectivity
Workgroup or standalone device authentication
Local account access patterns
Scenarios being prepared for NTLM reduction or eventual NTLM blocking

This preview is an opportunity to validate application compatibility, infrastructure dependencies, and operational readiness before broader rollout decisions are made. Learn more about upcoming work in this space here: Advancing Windows security: Disabling NTLM by default - Windows IT Pro Blog.

Troubleshooting and Feedback

As you evaluate IAKerb and LocalKDC in preview environments, you may encounter scenarios where authentication behaves differently than expected. Windows provides built-in logging to help you understand what is happening and identify potential issues. These logs help you:

Verify whether Kerberos authentication is being used
Identify cases where IAKerb or LocalKDC is involved
Detect failures or fallback conditions

You can also leverage NTLM operational logs to:

Identify when NTLM is still being used
Understand why fallback to NTLM is occurring
Prioritize scenarios for further investigation

Reviewing these logs together can help you determine whether authentication is staying on a Kerberos path (via IAKerb or LocalKDC) or falling back to NTLM and why.

When to expect fallback behavior

Because this is a preview release, some scenarios may still fall back to NTLM due to:

Application-specific dependencies
Environmental configuration (e.g., name resolution or SPN issues)
Interactions between domain accounts and local accounts on the same machine

IAKerb and LocalKDC are designed to address a subset of common NTLM fallback scenarios, and continued improvements are planned to expand coverage over time.

Share feedback and scenarios

If you encounter a scenario that does not behave as expected, or if you have a unique authentication flow you would like us to evaluate, we encourage you to contact us at ntlm@microsoft.com.

Please include details such as:

The scenario you are testing
Expected vs. actual behavior
Relevant event log entries (if available)

Your feedback is critical to helping us improve coverage and ensure these capabilities work reliably across real-world environments.

Securing today. Preparing for what’s next.

Security in Windows is built into the platform—continuously maintained and designed to evolve as threats change.

Learn more in the Windows Security book and Windows Server Security book or explore Windows 11, Windows Server, and Copilot+ PCs. For broader solutions, visit the Microsoft Security site, follow the Security blog, or connect with Microsoft Security on LinkedIn and @MSFTSecurity.   

Made for developers and agents, Windows 365 at Build 2026

BhavyaChopra — Wed, 03 Jun 2026 00:38:24 GMT

Build 2026 is here, and Windows 365 is showing up in a BIG way. Over the past year, we’ve listened closely to developers and IT teams using Cloud PCs at scale. You told us that bringing a new developer onto a Cloud PC needs to be streamlined—that signing in should mean being ready to code, not spending hours on setup. We hear from you that compute choice matters, and that a one-size-fits-all approach doesn’t work for dev teams building everything from web apps to AI/ML workloads. In addition, you told us that agents are already in use—and they need a real place to run, backed by the same security, identity, and policy you trust. Today, we’re announcing our biggest release yet of developer and agent capabilities on Windows 365. It brings secure Cloud PCs preconfigured with common development tools, expanded compute options, a new platform for enterprise AI agents, and stronger security and connectivity—so you can build and scale from anywhere, on any device.

A development experience that starts ready

Every developer knows this story: a new machine, a fresh image—and hours lost to setup before a single line of code gets written. That friction repeats with every onboarding, project switch, and refresh. We’re solving it with ready-to-code Windows 365 Cloud PCs, enhanced image management, and flexible customization—so developers can get to coding faster.

With Microsoft Dev Box now in maintenance mode, Windows 365 is the forward-looking path at Microsoft for teams seeking to standardize developer environments on Cloud PCs, backed by an investment roadmap focused on developer productivity, AI workloads, and enterprise scale.

Windows 365 now supports Windows 11 developer configuration image, in public preview: It delivers a preconfigured, ready‑to‑code environment with tools developers already use, including Visual Studio Code, Git, GitHub CLI, Python, Node.js, and Windows Subsystem for Linux (WSL), available from first sign‑in. Developers can navigate across Windows and Linux (via WSL), local and cloud, and AI workloads, all from the same starting point.

Video caption: With GitHub remote capabilities enabled on your Cloud PC, you can monitor and manage a running CLI session from another endpoint, such as your local device, as demonstrated in this video.

Building on this, autopilot device preparation now available for Windows 365, automates the installation of apps and scripts on Cloud PCs through Microsoft Intune before a user ever signs in. This helps ensure a ready-to-use, compliant environment without manual setup. Coming soon in preview, we will introduce expanded customization capabilities that give teams greater flexibility to tailor Cloud PC environments to their project needs, including configuring required SDKs, CLIs, packages, build tools, repositories, and onboarding workflows, all while remaining within enterprise guardrails and enabling developers to get productive immediately. In addition, Azure Compute Gallery support is now generally available. This enables organizations to store and manage custom images in Azure Compute Gallery and import them into Windows 365 to create Cloud PCs.

For developers building AI‑powered apps, select language models (LM) now run directly on your Windows 365 Cloud PC, extending this ready-to-code experience to advanced workloads. and enabling developers to build and iterate on LM-driven applications using Cloud PC compute.

Flexible plans to choose from

As part of ongoing Windows 365 portfolio update, Windows 365 Flex, formerly known as Windows 365 Frontline, fits how employees work, whether through shared access or cost-efficient dedicated experiences.

And that flexibility shows up in compute choice. 32vCPU Windows 365 Cloud PCs are now available in Windows 365 Enterprise and Windows 365 Flex, supporting compute-intensive workloads like software development, data modeling, simulations, and AI/ML. Similarly, a new Windows 365 GPU Select plan is now available, expanding the Windows 365 GPU-enabled Cloud PC portfolio and giving developers a more accessible GPU option alongside the existing Standard, Super, and Max plans. The new capabilities are optimized for smooth, low-latency visual performance across applications, multimedia, and hardware accelerated graphic workflows, providing developers with more ways to accelerate build and test scenarios. All GPU-enabled Cloud PCs are available across both Windows 365 Enterprise and Windows 365 Flex (in shared or dedicated mode).

Enterprise-managed execution environment for AI agents

As AI agents move from reasoning to execution, a key challenge is enabling them to take action across enterprise applications and systems, not just APIs. Many enterprise workflows still depend on browsers, desktop applications, and legacy tools, which require agents to operate beyond traditional integration points.

Windows 365 for Agents is now generally available. Agent makers can use it as part of Agent 365 tools or through Microsoft Copilot Studio (preview). It enables enterprise AI automation by providing agents with secured, managed, and available Cloud PCs that run within real business environments. Agents can interact directly with applications and browsers, execute multi-step workflows, and operate across modern and legacy systems. Each Cloud PC is Entra-joined, Intune-managed, and policy-enforced, helping IT scale agents with consistent security, governance, and compliance. While Agent 365 secures and governs the agent, Windows 365 for Agents provides a dedicated workspace to support performance and security needs.

Designed to support agent creators, Windows 365 for Agents works with agents built using both no-code and pro-code approaches. It's already powering agentic experiences across Microsoft, from computer-use scenarios in Researcher to Project Opal within Microsoft Copilot Studio, demonstrating enterprise readiness. Beyond Microsoft’s own experiences, the platform also supports third-party agents, including partner-provided examples such as Sai from Simular. This always-on AI coworker can operate applications on a Windows Cloud PC by interacting with the user interface through mouse and keyboard inputs, similar to a human.

Watch Simular’s AI agent Sai in action in the demo below.

Video caption: Using Windows 365 for Agents, Sai runs an overnight claims-processing workflow in a Contoso claims app with no APIs. Sai reads scanned claim forms, extracts key fields, verifies coverage, and enters results directly through the UI. 

Secure access and reliable connectivity

Developers get consistent experience, agents run in a dedicated runtime, and IT maintains centralized control across both. Windows 365 brings these capabilities together, combining developer productivity with the provisioning, policy enforcement, and compliance controls organizations require. Building on this foundation, context-based redirection, in public preview starting in June, adds more adaptive data protection. Organizations can apply granular redirection policies based on contextual signals, such as device management status, user network and location status to control how content is accessed and redirected.

To improve connection reliability and user experience, Remote Desktop Protocol (RDP) multipath with redundant Transmission Control Protocol (TCP), now generally available (Windows 365/Azure Virtual Desktop), enhances connection resiliency by maintaining multiple transport paths (UDP and TCP) between the client and session host. This dynamically selects the most reliable path, particularly in TCP-only or UDP-restricted environments- improving session reliability and continuity while reducing disruptions to enhance the overall user experience. In addition, health checks in Windows App, now available on sovereign clouds (generally available) provides lightweight diagnostics that validate device readiness, network connectivity, and sovereign-specific endpoint reachability, enabling faster troubleshooting and more reliable connections in government cloud environments.

For shared and controlled usage scenarios, Snapshot-based reset for Windows 365 Flex (in shared mode), now in public preview, automatically reverts shared Windows 365 Flex Cloud PCs to a clean state after each user signs out. Every user starts with a clean Cloud PC, simplifying management and supporting the shared licensing model for Windows 365 Flex.

Beyond organizational boundaries, using Azure Files and FSLogix as a user profile management solution for external identities in Azure Virtual Desktop is now generally available, enabling secure access for external users such as partners and vendors. To see more, check out our latest blog.

Get started today

With these updates, Windows 365 moves into a new phase that further reduces setup friction, keeps developers in flow, and helps teams build, run, and scale across environments.

Windows 365 Enterprise and Windows 365 Flex now include new developer capabilities - buy or contact sales.
Contact sales to try Windows 365 32 vCPU and Windows 365 GPU-enabled Cloud PCs today.
Try 50 free hours of Windows 365 for Agents Cloud PC with Microsoft Copilot Studio.

Learn more at Microsoft Build 2026

Join the Windows 365 sessions at Microsoft Build 2026 to learn more and see these capabilities in action. Microsoft Build in 2026 offers two full days of content, from keynotes, breakouts, hands-on labs, to on-demand sessions that you can join live or watch anytime. The digital experience is free to attend. Register today to explore the full schedule, discover featured partners, and save your must-see sessions.

Tuesday, June 2, 2026:

Wednesday, June 3, 2026:

Build on-demand sessions available beginning June 2:

Windows news you can use: May 2026

Chris_Morrissey — Mon, 01 Jun 2026 21:00:00 GMT

First, as we head into June and the first set of Secure Boot certificates start to expire, there will be another Secure Boot Ask Microsoft Anything (AMA) on Thursday, June 4. Do save the date and post your questions early or at any time during the live stream if you need assistance. You can also watch the May edition on demand.

For more general questions around Windows deployment, updates, and management, you can join the chat-based Windows Office Hours every third Thursday. The next event will be June 18 at 8:00 AM PDT.

Now let's dive in to more Windows news you can use you might have missed this past month.

New in Windows update and device management

[AUTOPATCH] [GCC] – Windows Autopatch is now included automatically for Government Community Cloud (GCC) customers using Microsoft 365 G3 GCC, Microsoft 365 GCC G5, or Microsoft 365 GCC G5 without WDATP/CAS Unified. The $0 Windows Enterprise (OLS) activation SKU is no longer required. For guidance on how to get started, read Windows Autopatch for the US government.
[HOTPATCH] – Starting with the May 2026 Windows security update, hotpatch updates are now on by default for those using Windows Autopatch through Microsoft Intune or the Windows updates API in Microsoft Graph. The default tenant setting; however, is only applied to devices that aren't members of a quality update policy. Windows Autopatch respects your configuration of quality update policies.
[BACKUP] – Start managing Enterprise State Roaming (ESR) through Windows Backup for Organizations policies. By the end of June, you'll no longer be able to access ESR policies through the Microsoft Entra portal and will instead need to use Microsoft Intune.
[W365] – Admin Insights for Windows 365, now in public preview, brings together important signals from existing reporting, monitoring, and alerting from Intune. Quickly understand what's happening in your environment and where to focus.
[ARM] – Does your organization use, or plan to adopt, Arm-based Windows devices? Check out a snapshot of companies that have recently delivered or expanded print solutions supporting Windows on Arm.
[SKILLING] – Still have devices running Windows 10? Need advice on optimizing how you roll out new versions of Windows and Microsoft 365 apps in your organization? Use the updated Stay current with Windows learning path to plan, prepare for, and deploy for updates across your organization.

New in Windows security

[SECURE BOOT] – The updated Secure Boot status report in Windows Autopatch provides better device-level visibility into certificate status, trust configuration, and readiness for Secure Boot certificate updates. New interactive certificate-level details fit directly into your certificate rollout workflow.
[SECURE BOOT] – Microsoft Defender now provides centralized visibility into Secure Boot 2023 certificate readiness across your device fleet. A new assessment categorizes your devices automatically as exposed, compliant, and not applicable.
[FIREWALL] [NETWORKING] – Have devices that experience difficulties receiving updates? New guidance is available to help you identify potential causes and implement solutions to ensure updates roll out smoothly moving forward.
[PRINTING] – A new icon appears on the Printers & scanners settings page. It helps you easily understand which devices support a more secure printing experience with Windows protected print mode.
[PASSKEYS] – World Passkey Day was May 7. Learn how Microsoft is Advancing passwordless authentication.

To explore what's new in security across the Microsoft platform, see What's new in Microsoft Security: May 2026.

New in AI

[DEVELOPERS] – Microsoft Build runs June 2-3! It features sessions on building, modernizing, and optimizing Windows apps and developer experiences. Check out especially AI-powered capabilities, cloud integration, and next‑gen tooling like Copilot, WinUI, and GitHub Copilot.
[AGENTS] – Windows is adding a new way to monitor your agents from the taskbar. This experience supports agents across first- and third-party apps, with Researcher in the Microsoft 365 Copilot appas the first adopter.
[COPILOT] [M365] – The Copilot app has been redesigned to be faster and more responsive. What do you think about the way Copilot shows up across Microsoft 365 apps?
[COPILOT] [M365] – New Microsoft 365 Copilot resources are now available to help you get started with adopting Copilot capabilities across your organization.

To learn about latest capabilities for Copilot+ PCs, visit the Windows Roadmap and filter Platform by “Copilot+ PC Exclusives.”

New in Windows Server

For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes.

[HOTPATCH] – Hotpatch updates enabled by Azure Arc are now available at no additional cost for Windows Server 2025. Read the announcement for details on eligibility and guidance on how to get started.
[SKILLING] – All 19 sessions from Windows Server Summit 2026 are now available on demand. Learn and improve your skills on your schedule.

New in productivity and collaboration

Install the May 2026 security update for Windows 11, versions 25H2 and 24H2 to get these and other capabilities, which will be rolling out gradually:

[FILE EXPLORER] – View and Sort preferences are now preserved in folders such as Downloads and Documents when apps launch File Explorer directly to those locations. File Explorer also now supports uu, cpio, xar, and NuGet Packages (nupkg) archive formats.
[INPUT] – Voice typing on the touch keyboard now looks simpler and more intuitive. The updated design removes the full‑screen overlay and shows voice typing animations directly on the dictation key.

New features and improvements are coming in the June 2026 security update. You can preview them by installing the May 2026 optional non-security update for Windows 11, versions 25H2 and 24H2. This update includes the gradual rollout of:

[AUDIO] – Shared audio enables two people to listen to the same audio from a single Windows 11 PC at the same time.
[CAMERA] – Windows 11's Multi-App Camera feature allows multiple applications to access your camera stream at the same time.
[MAGNIFIER] – Magnifier now provides clearer and more consistent announcements when working with a screen reader. You'll hear helpful announcements when you zoom in or out, switch views, turn color inversion on or off, or turn Magnifier on or off. In addition, Magnifier now supports magnification of permitted protected content.
[SEARCH] – Windows Search will now find and prioritize files with as few as two characters.
[PERFORMANCE] – Task Manager now provides enhanced visibility into NPU usage, including new metrics and AI activity insights.

Lifecycle reminders

Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025.

Additional resources

Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs, and more? Check out these resources:

Windows Roadmap for new Copilot+ PCs and Windows features – filter by platform, version, status, and channel or search by feature name
Microsoft 365 Copilot release notes for latest features and improvements
Windows Insider Blog for what's available in the Beta and Experimental channels
Windows Server Insider for feature preview opportunities
Understanding update history for Windows Insider preview features, fixes, and changes to learn about the types of updates for Windows Insiders

Join the conversation

We are always looking to improve this monthly summary. Drop us a note in the Comments and let us know what we can do to make this more useful for you!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Updated Secure Boot status report in Windows Autopatch

Harman_Thind — Tue, 19 May 2026 19:50:26 GMT

Do more with the improved Secure boot status report in Windows Autopatch. Now, you can gain better device-level visibility into certificate status, trust configuration, and readiness for Secure Boot certificate updates. New interactive certificate-level details fit directly into your certificate rollout workflow:

Identify devices that aren't up to date.
Use trust configuration and certificate details to understand applicability.
Check confidence level to determine your rollout strategy.
Use alerts and timestamps to validate reporting freshness and prioritize action.
Plan targeted remediation instead of broad deployments.

From policy deployment to actual Secure Boot readiness

Secure Boot is a core Windows security feature that helps ensure devices start up using only trusted, digitally signed components. It helps protect against boot-level malware and enforces a root of trust during startup. As Secure Boot certificates evolve and older certificates approach expiration, visibility into device readiness becomes critical.

To deploy Secure Boot certificate updates, the recommended option is to enable the EnableSecurebootCertificateUpdates policy. When active, the policy automatically sends certificate updates to supported and eligible devices but requires a device restart to complete the process.

However, before enabling a Secure Boot policy, it's important to understand:

Which devices have updated their certificates and are protected
Whether firmware configuration blocks updates
Whether devices are ready for rollout
When to take action

The Secure Boot status report addresses this gap by giving you a data-informed view of device readiness, not just policy assignment status. The report provides a device-level view of Secure Boot across your Windows Autopatch-managed devices. Let's walk through how to quickly understand your fleet's readiness.

Note: Certificate readiness presupposes devices with Secure Boot enabled. Devices with Secure Boot disabled are included for visibility only. They don't require any action.

How to use the Secure Boot status report

The report includes several key signals designed to help you make informed decisions.

Ready to see it in action? Start here:

Go to the Intune admin center.
Open Reports > Windows Autopatch > Windows quality updates.
Select Reports.
Open Secure Boot status.

Identify devices that aren't up to date by certificate status

Find the new column called Certificate status. See which certificates require action based on an aggregate view. Here's what each status means:

Up to date: No action is required.
Not up to date: Devices require certificate updates.
Not applicable: Secure Boot isn't enabled.

Drill into this field to see per-certificate details. No need for custom scripts or manual validation. Select the status cell for any device to see whether Secure Boot is enabled, its trust setting, and status for each of the four required certificates.

Use trust configuration and certificate details to understand applicability

Not all devices require the same set of Secure Boot certificates. The Secure Boot trust setting column shows whether a device trusts:

Microsoft-only components
Both Microsoft and non-Microsoft components

This is important because certificate applicability depends on how the device is configured, not just what exists on disk. For example, a device may be fully compliant even if certain certificates aren't present. This happens if certificates aren't required for that configuration.

Check confidence level to determine your rollout strategy

This is one of the most important additions in the new version of the report. The Confidence level column helps guide deployment decisions based on Microsoft-observed data across similar devices and firmware configurations. Select any cell to see a flyout summary for that device. Review the description of the status and the recommended action. It also states whether the high-confidence deployment policy is allowed.

Use this data to:

Confidently auto-deploy updates to high-confidence devices.
Manually validate devices with limited or no data.
Pause rollout where known issues exist.

Here are recommendations based on confidence level labels:

High confidence: Deploy the certificates depending on the policy setting:
- If the high-confidence policy is allowed: No action is required. Devices will automatically receive Secure Boot certificate updates through Windows Update.
- If the high-confidence policy isn't allowed: Deploy certificate updates manually when ready.
Under observation: Test certificate updates in controlled rollout.
No data observed: Carefully validate certificate updates before broad deployment. Microsoft hasn't observed this type of device in Secure Boot update data.
Temporarily paused: Don't deploy. Devices in this group are affected by a known issue. Consult with your OEM for possible firmware updates.
Not supported: Exclude these devices from automation.

Use the confidence level data to take out guesswork from your Secure Boot certificate rollout strategy and turn it into data-informed deployment.

Use alerts and timestamps to prioritize action

A new Alerts column helps you validate reporting freshness and prioritize action. The report surfaces the following operational signals:

Devices missing diagnostic data
Devices requiring action
Timestamp of last reported diagnostic data

Important! To avoid false assumptions when validating rollout progress, note these important limitations:

Status updates can take up to 12 hours after restart to be reflected.

Devices must send required diagnostic data to appear correctly in the report.

Inactive devices might show up as Unknown.

Plan targeted remediation of Secure Boot certificates

Secure Boot certificate updates are not uniform across devices. They depend on firmware, configuration, and trust models. Due to this variation, applying Secure Boot updates sometimes sees unexpected results.

Without clear visibility, organizations risk:

Missing required updates
Deploying updates too broadly
Misinterpreting device readiness

The Secure Boot status report gives you a more precise, device-level understanding of readiness, so you can act confidently and help reduce risk across your estate. Together, these improvements focus on one thing: making the data actionable. If needed, make data-informed decisions on targeted remediations instead of broad deployments.

Note on Secure Boot updates and hotpatch updates

If you're using hotpatch updates, plan for a one-time change in strategy. More devices become eligible for Secure Boot certificate updates over time based on high-confidence diagnostic data. High-confidence deployment relies on data included in monthly non-security preview updates, which are typically released the fourth week of the month. By definition, devices receiving hotpatch updates don't receive these preview updates. As such, these devices might not progress at the same rate as other devices. Here's the implication:

Devices might not receive updated high-confidence data in May or June.
Some devices might not become eligible for automatic deployment during that time.

In addition, applying Secure Boot updates requires device restarts to complete changes to:

Secure Boot certificates
The Windows Boot Manager

As a result of this design, devices receiving hotpatch updates will only receive updates automatically during the next baseline month (for example, April or July).

To move forward sooner, your organization can:

Install the latest monthly non-security preview update (instead of a hotpatch update) to pick up updated high-confidence data.
Restart the devices to complete the update process.
Optional: Temporarily pause hotpatch updates and plan maintenance windows during Secure Boot rollout. Then resume hotpatch updates.

Learn more or bookmark these resources:

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Admin Insights for Windows 365: Stay on top of what needs attention — now in public preview

madelinecarr — Tue, 19 May 2026 16:00:00 GMT

When IT administrators are looking for the most critical actions to take, being able to quickly understand what is happening in their environment can make a big difference.

With this in mind, we’re excited to announce Admin Insights for Windows 365, now in public preview, designed to help IT administrators quickly understand what’s happening in their environment and where to focus.

To learn more and access technical guidance, visit the Admin Insights for Windows 365 documentation.

Understanding your environment, faster

IT administrators managing Windows 365 Cloud PCs rely on a range of signals—including reports, alerts, and device views—across the Microsoft Intune admin center to understand the health of their environment.

These signals provide valuable visibility across the Windows 365 environment. As environments scale, quickly surfacing what needs attention—and acting on it—becomes more important.

Bringing key signals together in one place

Insight cards surface signals for review when thresholds are met.

Admin Insights builds on existing reporting, monitoring, and alerting by bringing important signals together directly into the Windows 365 experience.

With Admin Insights, IT administrators can:

Identify what needs attention across their Cloud PC environment
Understand environment health at a glance, without digging through multiple reports
Spot unexpected changes and outliers, such as spikes in failures or degraded performance
Focus on what to do next, using signals surfaced in one place

What powers Admin Insights

Admin Insights surfaces dynamic insight cards in the Windows 365 management portal in Intune, based on changes and patterns across your Cloud PC environment:

Insight cards are generated automatically, based on activity across your environment
Up to 15 insight cards may be displayed, covering general health and outlier conditions
Cards appear contextually, highlighting what needs attention as changes are detected
Each card maps to a specific scenario, such as unhealthy Cloud PCs or connectivity failures

Get started with Admin Insights

Admin Insights are available on the Cloud PC Overview page. Insight cards appear when defined thresholds are met, surfacing key signals.

To learn more, visit the Admin Insights for Windows 365 documentation. The feature will continue to extend to new scenarios and Windows 365 surfaces in the Intune portal, providing IT administrators with the information they need, where they need it.

Easily identify Windows protected print mode compatible devices

elliesekine — Thu, 14 May 2026 16:00:00 GMT

As organizations work to modernize their print environments and reduce reliance on legacy drivers, Windows protected print (WPP) mode helps improve system security by enforcing the use of the Windows modern print stack and introducing additional security features.

To help IT admins and users easily understand which devices are compatible with this more secure printing experience, Windows is introducing a new icon that can be found in Settings > Bluetooth & devices > Printers & scanners:

Printer with compatibility icon indicating support for Windows protected print mode.

This icon appears next to each installed printer that supports Windows protected print mode, which requires IPP-capable printers.

This update helps IT administrators quickly evaluate printer readiness for Windows protected print mode before enabling it across managed devices. If your environment’s printers support WPP, we highly recommend enabling it to create a more secure print ecosystem.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Configuring firewall and proxies for smooth Windows updates

Dave_Roth — Mon, 11 May 2026 16:00:00 GMT

Having trouble connecting to Windows Update? If your devices experience difficulties getting updates, you're likely just one step away from the solution. The key is in the configuration of your network endpoints for firewalls and proxies. This post provides actionable guidance on how to identify the cause of the issue and remedy the situation.

How the Windows Update service and networking interact

The Windows Update service makes use of Internet hosted services to widely distribute updates to Windows devices. Windows devices connect to Windows Update services to check for various updates, including monthly security and non-security updates, driver and .NET Framework updates, machine learning (ML) model updates, and more.

Typically, a Windows Update scan occurs automatically or when triggered manually by the user. Once started, the process scans for updates, downloads, and installs them. However, some network configurations obscure this process, leading to errors or the inability to update a device. Luckily, there are measures you can take to avoid this.

Security is embedded in the Windows Update experience

Security is paramount for Windows Update. Its whole purpose is to help keep your devices protected and productive. Therefore, there are multiple protections to ensure that your device connects to authentic Windows Update services. However, there's one specific networking security consideration we'll focus on: Transport Layer Security (TLS).

You probably know TLS (sometimes referred to by an older protocol known as SSL) as the https:// element you type into your browser. This moniker instructs your browser to connect to a web server using HTTP over a TLS connection. Doing so helps ensure the following between your device and a web server:

The connection is protected from eavesdropping. It encrypts the data between your device and the server.
The connection can detect changes made to your data over the network. It provides integrity checks that your device can validate.
The connection is trusted. Your device inspects a TLS “certificate of authenticity” that the server provides to prove who it is.

When Windows interacts with the Windows Update service, it performs all of these checks. Additionally, it double-checks that the server isn't only trusted, but it's what it claims to be. This is done by verifying that the server's TLS certificate is chained up to a specific certificate authority (CA). Windows refers to this as a Windows Update trust anchor.

If the TLS certificate isn't issued by an actual Windows Update trust anchor, Windows won't trust that the server is a genuine Windows Update server and immediately disconnects. That's good news until you accidentally lock yourself out of accessing trustworthy Windows Update services.

Proxy server and firewall configurations to watch

Some networking environments implement special firewalls or proxies that intercept TLS connections. They typically perform TLS inspection, validating that the request to a server is legitimate and adheres to an organization's security and other policies. This is how some firewalls and proxies might block access to forbidden content.

When TLS inspection occurs in this way, the firewall or proxy server generates its very own certificate. Even though it is generated by the firewall or proxy, it appears to be legitimate (containing SAN entries for the URL's fully qualified domain name) and is trusted by the client's browser. Typically, this involves generating a TLS certificate to match the requested URL and signing it by the organization deploying these firewall/proxy services. Since the client device is a member of the organization, it inherently trusts these certificates signed by the same organization.

When this occurs, the Windows Update client detects that the TLS certificate issuer isn't a genuine Windows Update issuer. By design, the client only trusts certificates issued by the Windows Update service. This feature of “pinning” solely to TLS certificates issued by the Windows Update service protects the distribution and delivery channels from man-in-the-middle (MITM) attacks. Again, this is good news for your security posture, except when exceptions are needed.

The role of VPNs

Some virtual private network (VPN) providers block access or DNS lookups to prevent overloading the VPN network with high-volume traffic downloads. That's another potential cause of blocked access for Windows devices. If you're experiencing Windows Update issues over a VPN connection, contact your VPN provider.

Care with scripting

If you're an avid PowerShell administrator, you might be forcing Windows Update to scan using scripts that call into the Windows Update public API. In this case, these calls might return one of the error codes listed below and add an entry for the error to the Windows Update log. If this happens, remediation steps are the same as if you found them in the Windows Update log.

Note: The Windows Update protocol is complex and consists of multiple different connections and endpoints. Simply connecting to one of the Windows Update servers doesn't tell the bigger picture of end-to-end protocol success. Rely on API result codes and/or the Windows Update log to determine success.

How to tell if you're blocked

If your Windows device is not receiving Windows updates as you expect, check if your connections are being blocked. Whether the source of the issue is a proxy server, firewall, or VPN, you can use the following steps to troubleshoot and move forward.

The first thing to check is the Windows Update audit log. Generate it from PowerShell, running the Get-WindowsUpdateLogs command:

$output = "$env:TEMP\WindowsUpdate.log"
Get-WindowsUpdateLog -LogPath $output
Write-Host "Windows Update log written to $output"

Once you have the log file, look for any of the following error codes:

0x8024402c (decimal: -2145107924)
This is the WU_E_PT_WINHTTP_NAME_NOT_RESOLVED error. It means that the Windows device was unable to resolve the Windows Update server DNS name to an IP address. Your organization might be blocking Fully Qualified Domain Name (FQDN) to IP address resolution.
0x80240438 (decimal: -2145123272)
This is the WU_E_PT_ENDPOINT_UNREACHABLE error. You receive this if the FQDN has been properly resolved to an IP address, but the Windows device is unable to connect to the server. This is probably due to a firewall or proxy blocking access.
0x80245006 (decimal: -2145103866)
This is the WU_E_REDIRECTOR_INVALID_RESPONSE error. This can show up for several reasons. For the sake of this discussion, it typically means one of the following:
- Your connection with the Windows Update service was unable to procure data it needs. For example, your connection might have dropped during the client-server interaction. In this case, check that your connection to the Internet is stable and not dropping.
- Your device was unable to validate the server's TLS certificate via trust anchor certificate pinning. This is most likely the case if your firewall or proxy is performing TLS inspection.
0x80240437 (decimal: -2145123273)
This is the WU_E_PT_SECURITY_VERIFICATION_FAILURE error. Your device was unable to prove that the connected server is legitimate and genuine Windows Update. Similar to the WU_E_REDIRECTOR_INVALID_RESPONSE error, your device couldn't validate the server's TLS certificate via trust anchor certificate pinning. Again, check if your firewall or proxy is performing TLS inspection.

If your log shows any of these error codes, work with your IT team to help ensure that firewalls and proxies are properly allowing Windows Update connections. In some cases, VPNs may be blocking FQDN resolutions or connections to the Windows Update service. If you're using a VPN, check with the VPN provider.

Recommended configurations and exceptions

A trusted connection requires trusted subdomains

To ensure that Windows devices can properly access genuine Windows Update services, firewalls and proxies need to allow those connections to pass through uninterrupted. That is to say, without generating and using its own TLS certificate.

To do this, proxies and firewalls need to create “pass through” exceptions for these Windows Update connections. This is typically done by allow-listing specific Windows-Update-related DNS host names. There are several of these qualified DNS names (FQDN) that you need to accommodate. You can learn more about the FQDNs requiring these exceptions in the Windows Update sections of the following:

Note that for the FQDNs related to Windows Update, the * wildcard is recursive. For security and scalability purposes, host and DNS subdomain names might need to periodically change.

For example, here's a recommended DNS host name:

*.update.microsoft.com

It represents all of the following hosts and subdomains:

update.microsoft.com
sls.update.microsoft.com
tas02.sls.update.microsoft.com

This means that you should trust all the DNS hosts and subdomains related to wildcard FQDN for the connection to work properly. Check if these subdomains are missing. In many cases, it should only take you a few minutes to update your proxy and firewall configurations to include them.

A special case of WSUS servers

Do you use Windows Server Update Services (WSUS) in your networks? In this environment, instead of connecting to the Windows Update service directly, Windows devices connect to an IT-managed WSUS server. If you're a server administrator, you orchestrate which updates are available on the WSUS server for your devices to update. And since these devices don't need to traverse a proxy or firewall for a genuine Windows Update server, the FQDN exceptions aren't necessary.

You can require TLS connections between your devices and the WSUS server. Additionally, you have the option to certificate-pin the WSUS server to your TLS certificates, much like you do with Windows Update. To use this option, you might need to make proper proxy or firewall exceptions for any device connecting to your TLS, certificate-pinned WSUS server. To learn more about WSUS certificate pinning, see:

An easy fix is good news

Difficulties keeping Windows devices up to date with the latest updates might have to do with the embedded network security design. Windows Update doesn't trust servers that don't have TLS certificates issued by an actual Windows Update trust anchor. Your firewalls and proxies might block access to the trustworthy and necessary Windows Update service if your configuration is either intercepting TLS connections or isn't passing TLS requests through for the necessary DNS subdomains. The good news is that there's normally an easy fix for Windows Update connection issues. Essentially, make sure to trust FQDN subdomains of the recommended DNS subdomains.

Here are some resources to help you learn even more:

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.