According to Microsoft's Windows IT Pro Blog post of November 12, 2026, this isn't a new layer stacked on top of update rings. For approvals and deferrals, it replaces what your update rings were doing. If you haven't fully absorbed that, the first week of rollout could be confusing.
What's actually new
The blog post says a single quality update policy in Microsoft Intune can now cover three kinds of updates:
- Windows quality updates: monthly security, non-security preview and out-of-band releases
- Supported .NET Framework updates
- Quick machine recovery updates: Microsoft-supplied fixes for devices that can't boot
Each type gets its own approval method, automatic or manual. One policy can use both.
Microsoft first announced the change in the Microsoft 365 Message Center. Under message MC1478956, the Windows Autopatch enhancements were rolling out Sept 1–Oct 15, 2026. They cover customizable automatic/manual approvals, deferral settings, update pausing, and detailed per-device reporting. A related notice, MC1465692, was rated Admin Impact: Medium User Impact: Low. That fits: users are barely affected, but the admin workflow changes.
Why does this matter? Microsoft says that until recently, devices in update ring policies got security updates but not preview or out-of-band releases. If you wanted a pilot group to get a particular fix early, you had to do it awkwardly. Now you set per-type rules and decide which devices get which updates.
Where to find it
In the Microsoft Intune admin center, go to Windows Updates > Devices > Manage updates > Windows updates > Quality updates. Microsoft Learn describes the same path for creating a policy:
- Select Create, then Windows quality update policy.
- Give the policy a name under Basics.
- Under Settings, choose approval methods.
- The top section covers Windows quality updates and Windows 11 .NET Framework updates together.
- QMR settings sit directly below.
- For automatic approval, use Make updates available after to set a deferral of 0–30 days.
- Choose scope tags (or leave Default), assign devices, then review and create.
Defaults: Microsoft Learn says a new policy sets monthly security updates to automatic approval and everything else to manual. QMR also defaults to manual. Admin Jasper van Surksum confirms in his October 30 walkthrough that Quick machine recovery also defaults to manual approval in a new policy.
Deferral advice: Microsoft's documentation goes further than the blog. It recommends keeping quality update deferrals under three days so devices stay secure.
You can't change the approval method later. The Learn FAQ says the approval method of an existing policy can't be edited. If you want a different method, you create a new policy. Decide carefully before you click Create.
The deferral rule that will catch people out
This is the part to read twice. If a device is in both an update ring (or Windows Autopatch Group) and a quality update policy, the quality update policy's deferral replaces the ring's deferral. The two don't add up.
Microsoft's own example:
| Setting | Value |
|---|---|
| Update ring deferral | 5 days |
| Quality update policy deferral | 2 days |
| When the device gets the update | 2 days after release, not 7 |
With manual approval there's no deferral at all. The device gets the update once you approve it.
Other ring settings, such as deadlines and grace periods, stay in force. Van Surksum puts it this way: the quality update policy controls approvals and Quality Update deferrals, while the update ring settings for deadlines, grace periods and restart notifications remain relevant.
Microsoft Learn adds two precedence rules the blog skips:
- Multiple quality update policies on one device: the policy approving the latest release wins.
- A cloud quality update policy plus an older hotpatch-only policy: the cloud policy wins. Monthly security updates aren't offered until they're approved, manually or automatically.
That second rule is why the blog tells hotpatch users to revisit their policies. If you created a quality update policy for hotpatch before approvals reached your tenant, open it, review the approval settings and save it. Updates needing manual approval will then show under Needs review in Manage updates.
Learn also says that on a policy with hotpatch enabled, approved non-security updates aren't delivered. Installing them would knock the device off the hotpatch path and could cause unexpected restarts. To get non-security updates, you have to turn the hotpatch setting off.
Keeping your ring timing
To keep staged rollouts and still get approvals, Microsoft suggests one quality update policy per ring:
- Assign each policy to the same groups as its ring.
- Give it the same deferral.
If your rings use 0, 1 and 5 days, you'd create three policies with 0, 1 and 5 days. Your timing stays the same and you gain per-type approvals. It's more policy objects, but it avoids a surprise change in deployment speed.
Section summary: the quality update policy now controls approvals and deferrals. Rings still control deadlines and grace periods. Mirror your rings if you want to keep their timing.
.NET Framework: same policy, separate controls
By default, each release category's approval setting applies to both the Windows OS update and the matching .NET Framework update. You can still review, approve and pause .NET releases on their own in Manage updates. Pausing one type doesn't pause the other.
Microsoft's blog says shipping .NET updates in the same cycle as Windows updates, now the default, means fewer interruptions and restarts for users. Fewer reboot prompts usually means fewer helpdesk tickets.
Microsoft Learn lists some limits:
- Windows 11 only. Only Windows 11 devices in the policy follow the .NET behavior described here.
- Windows 10 ESU devices still get .NET Framework updates from Windows Update based on client-side settings. The policy controls only their OS updates, so expect a separate restart.
- .NET Framework 3.5 isn't managed at all. Those updates arrive as standalone Windows Update packages under client-side settings, and they don't appear in the quality updates workflow.
Pausing: pausing a release withdraws its approval, so no new devices get it, but devices that already installed it keep it. Approve it again to resume. Microsoft warns that devices can take up to eight hours to pick up a pause.
Quick machine recovery fixes
Quick machine recovery handles widespread boot failures. Microsoft describes how it works:
- A device fails to boot into Windows twice in a row.
- It enters the Windows Recovery Environment (WinRE).
- If Microsoft has published a fix for the problem, the device downloads and applies it.
As Neowin summarized at the first announcement, admins can choose whether these recovery updates should be automatically approved or manually reviewed first.
Manual is the default. If you choose automatic, you can add an optional deferral. Approving, pausing and resuming work as they do for other quality updates in Manage updates. Microsoft Learn adds that on a policy set to automatic with a deferral, you can still approve a fix immediately.
Watch for conflicts with existing settings. Learn says some devices have QMR approval set through a quality update policy and remote remediation set through CSP or the Settings catalog. Those devices won't get the fix until it's approved in the cloud policy, because cloud approval takes precedence.
Think about what that means in practice. Your boot-loop recovery tool could sit waiting in a "Needs review" queue during the very incident it exists for. Manual QMR approval is reasonable, but only if someone is actually watching the queue when things go wrong.
Reporting: two reports, refreshed every four hours
Open them at Reports > Windows Autopatch > Windows quality updates, then the Reports tab. Data refreshes every four hours.
Quality update status
Use this report to see each device's update status. Two columns matter most here:
- Target release: the latest approved quality update the device should install. For update-ring devices, the blog calls this the latest "B week" (Patch Tuesday) update.
- The deadline column: the blog calls it Target release available, while Microsoft Learn calls it Target compliance. If the names in your tenant don't match either one, that's probably why.
How that date is calculated:
| Approval method | Date calculation |
|---|---|
| Automatic (or update ring) | Release date + deferral days + deadline days |
| Manual | Approval date + deadline days |
The manual row matters in practice. If you approve late, every device's deadline moves later too, which auditors may notice.
Quick machine recovery updates
This report stays empty until a boot-critical problem happens and QMR fixes are deployed. Device states:
- In boot failure: the device has a boot failure and a fix is available. You need to approve it before the device moves on.
- In progress: the fix is approved and recovery is under way.
- Remediated: the device is back in Windows.
The report also shows the QMR fix version, its release date, the policy deploying it and the device's OS version.
Our take
This is a real improvement. Before, you managed Windows and .NET separately and had little control over previews and out-of-band releases. Now you can choose a speed for each update type. Microsoft's recommended setup, automatic for security and manual for optional updates, is a sensible starting point.
The downside is complexity:
- The non-stacking deferral rule
- The fixed approval method per policy
- The hotpatch precedence rules
- The Windows 10 ESU and .NET 3.5 exceptions
- The CSP versus cloud approval rule for QMR
Any one of these could cause a "why did that deploy on Tuesday?" moment. The four-hour report refresh and up to eight-hour pause delay also mean the console lags behind what devices are actually doing.
Before you turn it on:
- List your ring assignments and current deferrals.
- Decide automatic or manual for each release category before creating any policies, because you can't change it afterward.
- Create one policy per ring if you want to keep your timing.
- Check Windows 10 ESU devices and .NET 3.5 dependencies.
- Open and re-save any older hotpatch quality update policies.
- Choose QMR's approval method and check for overlapping CSP or Settings catalog settings.
- Make sure someone monitors Needs review if you use manual approval anywhere.
Planned well, this gives you per-type approvals with fewer surprises. Rushed, it can change how fast updates reach your devices without anyone noticing.