Users are exempt from frequent restarts: Microsoft announces that enterprise Win11 devices will default to hot patch updates in May

IT Home, March 11 — Tech media NeoWin published a blog post yesterday (March 10), reporting that Microsoft announced it will start defaulting to push “Hotpatch” security updates to eligible Windows Autopatch enterprise customers beginning in May 2026.

The “Hotpatch” update method mainly targets enterprise devices managed via Microsoft Intune and Microsoft Graph API. Microsoft will distribute these updates through its enterprise-level service, Windows Autopatch, allowing Windows and Microsoft 365 software to automatically stay up to date.

IT Home cited the blog post, explaining that in the past, IT administrators had to wait several days after deploying security patches for employee devices to restart before the updates were fully applied. This window often exposed enterprise networks to potential attacks.

Now, hotpatches are small in size and can be installed instantly in the background, speeding up internal security compliance processes without interrupting users’ normal work.

Microsoft provides IT administrators with ample control, allowing them to disable hotpatch updates at the tenant level or enable them only for specific devices. These control features will officially launch in Microsoft Intune on April 1, 2026.

Since April is the baseline testing month for hotpatches, administrators will have enough time before the first hotpatch deployment on May 11, 2026, to review device status and adjust policies. Administrators can also use Intune’s reporting features to verify whether devices have installed the April baseline update and meet the prerequisites for receiving hotpatches.