MC1248388 High
Plan for Change: Windows Autopatch is enabling hotpatch updates by default
Summary AI-generated
Starting May 2026, Windows Autopatch will enable hotpatch security updates by default for eligible Intune devices, improving update speed; opt-out option available April 1, 2026.
Suggested actions AI-generated
- Ensure devices meet hotpatch prerequisites
- Enable Virtualization-based Security for x86 devices
- Use Quality Update policies or tenant setting to opt out if needed
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1247859 Windows Autopatch is enabling hotpatch updates by default
- MC1465692 More control for Windows Autopatch updates: quality updates, .NET Framework, and quick machine recovery
- MC1462918 Microsoft Windows Autopatch: September 2026 Windows security update requires a restart for hotpatch-enabled devices
- MC1171745 Hotpatch efficiency unlocked: Smaller update size
- MC1185309 Windows Autopatch for the US government: How to get started
- MC1242687 Prepare devices for successful updates with Windows Autopatch update readiness
Original post from Microsoft
Starting with the May 2026 Windows security update, Windows Autopatch is enabling hotpatch security updates by default because they are the quickest way to get secure. This change in default behavior will impact all eligible Intune devices. Additional controls are expected in April.
[When this will happen:]
- Devices will start receiving hotpatch updates by default with the May 2026 Windows security update.
- A tenant setting to opt out of hotpatch updates is expected to be available on April 1, 2026, or soon after.
[How this will affect your organization:]
Devices that meet hotpatch prerequisites will get secure faster because full Windows security updates are applied without waiting for a restart. Devices are secured as soon as the update is installed. You do not need to wait for devices to restart, saving on average three to five days.
Devices will restart during baseline months, which are January, April, July, and October.
[What you need to do to prepare:]
If you already use Windows Autopatch, no action is needed to get hotpatch updates enabled by default. We recommend keeping hotpatch updates enabled for your devices.
To maximize the number of devices receiving hotpatch updates, ensure they meet the prerequisites. Most commonly, this means enabling Virtualization-based Security (VBS) for x86 devices.
If you’re not ready for this change, you can opt out groups of devices using Quality Update policies or the whole tenant.
[Additional information:]
Read the announcement in Securing devices faster with hotpatch updates on by default.
Learn more about hotpatch updates with the following resources:
- Hotpatch updates
- Hotpatch for Windows client now available
- Hotpatching now available for 64-bit Arm architecture
- Hotpatch for client: Frequently asked questions
- Transforming security and compliance at Microsoft
- Hotpatch efficiency unlocked: Smaller update size
- YouTube: Inside hotpatch updates for Windows
- YouTube: Hotpatching 101: Enable virtualization-based security (VBS)
Additional details from Microsoft
- Summary
- Starting May 2026, Windows Autopatch will enable hotpatch security updates by default for eligible Intune devices, speeding up security without restarts. An opt-out setting will be available from April 2026. Devices must meet prerequisites like enabling Virtualization-based Security to receive hotpatches.