Microsoft Enables Windows Hotpatch by Default for Eligible Intune Devices

Windows Autopatch - the service that orchestrates Windows quality updates for Intune-managed fleets - now enables hotpatch security updates by default for eligible devices, starting with the May 2026 Windows security update. The change applies whether an organization uses Autopatch through Microsoft Intune or the Windows updates API in Microsoft Graph. Previously opt-in, hotpatch is now the default behavior for eligible devices unless an administrator explicitly opts out. Microsoft made the controls to block it available on April 1, 2026, and because April is a hotpatch baseline month, organizations had until May 11, 2026 to review and adjust before any hotpatch updates deployed under the new default.

Hotpatch applies monthly security fixes to code already running on the device, so the update takes effect without an immediate restart. It works on a quarterly rhythm: a baseline cumulative update (which does still require a reboot) is followed by monthly hotpatch updates that install silently between baselines. In practice that means eligible devices need roughly four baseline reboots a year for security patching instead of twelve, while still receiving monthly fixes. Hotpatch packages are also smaller than standard cumulative updates, so they install faster and use less bandwidth. Microsoft says applying fixes without waiting for a restart can get an organization to 90% compliance in about half the time, closing the window attackers exploit between patch release and full deployment.

The default applies only to devices that meet Microsoft's hotpatch prerequisites - not to every Intune-managed device. Eligible devices must run Windows 11 Enterprise version 24H2 or later, be managed by Windows Autopatch via Intune (or Graph), have Virtualization-Based Security (VBS) enabled (Microsoft notes this is most commonly the step needed for x86 devices), hold an eligible license (Windows 11 Enterprise E3/E5, Microsoft 365 F3, Windows 11 Education A3/A5, Microsoft 365 Business Premium, or Windows 365 Enterprise), and have the current quarterly baseline installed. Devices that don't meet the prerequisites automatically continue to receive the standard Latest Cumulative Update as before. ARM64 devices need a one-time step to disable CHPE binaries, and Microsoft has stated there are no plans to support hotpatch on Arm64 devices with CHPE enabled.

If you already use Windows Autopatch and want hotpatch on, no action is needed - Microsoft recommends keeping it enabled. To opt out at the tenant level, open Microsoft Intune > Tenant administration > Windows Autopatch > Tenant management, select the Tenant settings tab, and toggle "When available, apply updates without restarting the device (hotpatch)" to Block. Policy precedence matters: if a device belongs to a Windows quality update policy, that policy's hotpatch setting overrides the tenant default - so you can opt the tenant out but allow hotpatch for specific groups, or the reverse. Before accepting the default, verify devices meet the prerequisites (use the Hotpatch quality updates and Quality update status reports in Intune), confirm VBS is enabled across the fleet, validate licensing, and pilot with a representative group, testing LCU-fallback and rollback procedures.

Hotpatch is proven - it already runs on more than 10 million production devices - but flipping a default at scale is an operational decision. Some hotpatch releases have carried narrow known-issue advisories affecting specific scenarios (for example, certain connectivity or tooling interactions), so regulated environments and those with custom drivers or legacy software should validate before broad acceptance. The change also reinforces a broader pattern: advanced servicing capabilities are increasingly tied to specific Windows editions, licensing, and cloud management via Intune/Autopatch - worth factoring into licensing and governance reviews. Consumer PCs (Windows 11 Home/Pro), unmanaged business devices, and systems not enrolled in Intune/Autopatch are unaffected, and Microsoft has not announced hotpatch defaults for consumer editions.