Microsoft to Enable Windows Hotpatch Updates by Default for Eligible Devices
Summary
Microsoft plans to enable hotpatch security updates by default for eligible Intune-managed Windows devices starting with the May 2026 update. The company estimates this could halve the time to reach 90% patch compliance; admins can manage the setting in Intune.
Key points
- Microsoft says hotpatch updates will be enabled by default for eligible Intune- and Microsoft Graph-managed Windows devices starting with the May 2026 security update.
- Updates will be delivered through Windows Autopatch and apply fixes without requiring device restarts.
- Microsoft estimates hotpatching will halve the time needed to reach 90% patch compliance; this is a company estimate.
- Intune controls scheduled for April 1, 2026, allow administrators to opt out at the tenant level or configure hotpatching for specific devices.
- Administrators can use Intune’s Hotpatch quality updates report to check device readiness and the April baseline update.
- Microsoft said organizations could opt out before deployments began, with May 11, 2026, given as the preparation deadline.
Article Details
- Event Type
- Microsoft announcement of default hotpatch security updates for eligible Windows devices managed through Microsoft Intune and the Microsoft Graph API, beginning with the May 2026 security update.
- Impact
- Updates will be delivered through Windows Autopatch without requiring device restarts. Microsoft estimates this will halve the time to reach 90% patch compliance. Administrators can manage or disable hotpatching through Intune controls scheduled to become available April 1, 2026; Microsoft says organizations have until May 11, 2026, before hotpatch updates are deployed.
Vendors
Products
Microsoft GraphMicrosoft will enable hotpatch security updates by default for all eligible Windows devices managed via Microsoft Intune and the Microsoft Graph API starting with the May 2026 security update.Microsoft IntuneMicrosoft will enable hotpatch security updates by default for all eligible Windows devices managed via Microsoft Intune and the Microsoft Graph API starting with the May 2026 security update.Microsoft WindowsMicrosoft will enable hotpatch security updates by default for all eligible Windows devices managed via Microsoft Intune and the Microsoft Graph API starting with the May 2026 security update.Windows AutopatchUpdates will be delivered through Windows Autopatch, which Microsoft says will halve the time to reach 90% patch compliance and can be managed or disabled using Intune controls that go live April 1, 2026.