Windows 11: Quality Updates in OOBE with Autopilot and Intune ESP

Microsoft is rolling one more control layer into Windows setup: starting with the September 2025 security update, eligible Windows 11 devices enrolled through modern management can automatically download and install Windows quality updates during the Out‑of‑Box Experience (OOBE), with the default behavior enabled for new Enrollment Status Page (ESP) profiles in Microsoft Intune. This change promises fresher, more secure devices at first sign‑in — but it also tightens the screws on who controls updates, how long new device provisioning will take, and where administrators must focus testing and policy planning.

Background / Overview​

Microsoft’s shift is the culmination of a multi‑month rollout: a policy surfaced earlier in 2025 that allowed organizations to choose whether to apply quality updates during OOBE, and the functionality has now been made broadly available for eligible managed devices. The capability is surfaced through the Windows Autopilot Enrollment Status Page (ESP) and is manageable from the Microsoft Intune admin center. When enabled, the final stage of OOBE will detect applicable Windows quality updates, download and install them, then restart the device so users sign in to an already‑patched system.
The company frames this as a security and reliability improvement: deploying the latest cumulative fixes during setup reduces post‑deployment update overhead and the risk of shipping machines with known vulnerabilities. For many enterprise and education fleets, that benefit will be real. For others — especially organizations that prefer tightly controlled update cadences, or administrators who depend on image‑based provisioning and zero‑touch flows — the change will force process adjustments.

---

What Microsoft is changing — the mechanics​

Which updates are targeted​

• The change applies to quality updates (monthly cumulative updates that include security and reliability fixes) during the OOBE flow.
• Feature updates (major OS upgrades) and driver updates are not installed as part of this OOBE quality update mechanism; those remain governed by the organization’s feature update and driver management policies.

Eligible devices and SKUs​

• Devices must be running Windows 11, version 22H2 or later.
• Supported SKUs include Pro, Enterprise, Education, and SE.
• Devices must be Microsoft Entra‑joined (formerly Azure AD) or Entra hybrid‑joined and enrolled through an MDM that supports the Autopilot Enrollment Status Page model.
• The behavior becomes available on devices that either:
• Received the vendor OOBE zero‑day package (ZDP) delivered in August 2025, or
• Were imaged with the June 2025 Windows non‑security update or any later servicing package.

Where the control lives​

• The option to install quality updates during OOBE is exposed as a toggle in the Autopilot Enrollment Status Page (ESP) profile within Microsoft Intune.
• New ESP profiles created after this change default the "Install Windows quality updates (might restart the device)" setting to enabled.
• Existing ESP profiles retain their prior settings (the toggle remains off by default for profiles created before the change), which means administrators who use mature profiles won’t be immediately forced into the new behavior unless they edit or recreate profiles.

Admin visibility and constraints​

• If your organization uses Windows Autopilot + Intune and assigns ESP profiles, you can enable or disable the setting per ESP profile, giving you granular control across device groups.
• If you don’t use device ESP — for example, if you enroll devices via Autopilot device preparation or a third‑party MDM that does not map ESP settings — certain toggles may not be available and updates may be applied by default in some flows.
• The system respects Windows Update deferral and pause policies when they are synced to the device prior to the final update check during OOBE.

---

The admin controls: how to opt out or tune the behavior​

Administrators retain the ability to override the default, but action is required:

• Sign in to the Microsoft Intune admin center.
• Navigate to Devices > Enrollment > Enrollment Status Page (ESP).
• Edit an existing ESP profile or create a new one.
• Under Settings, locate the Install Windows quality updates (might restart the device) toggle.
• Set the toggle to off to prevent automatic quality updates during OOBE for devices that receive this profile.
• Assign the ESP profile to the appropriate Autopilot device group(s) or to “All devices” to ensure consistent behavior.

Key operational notes:

• New ESP profiles default this setting to enabled, so teams that programmatically create profiles or rely on templates must proactively set it to off to maintain prior behavior.
• If you plan to keep updates enabled during OOBE, test with representative device images and network conditions to measure the extra time added to provisioning and to verify that your critical provisioning tasks still complete reliably.

---

Why Microsoft is pushing this (the security and operational argument)​

There are solid reasons behind the policy change:

• Reduce vulnerability exposure at first sign-in. Devices that roll out of the box with outdated cumulative updates are exposed until IT can push updates; installing the latest quality update during OOBE shortens that window.
• Lower post‑deployment overhead. IT teams spend significant cycles patching new devices after imaging and deployment. Applying the latest quality update during setup reduces the number of immediate post‑provisioning tasks.
• Better user experience (in theory). Signing in to a device that doesn’t immediately require reboots or large updates can reduce help‑desk tickets and first‑day frustrations — again, only when updates are stable and quick.
• Consistency across fleets. Syncing an organization’s pause and deferral policies before the OOBE update check enables an administrator to ensure new devices land on the same approved build as the rest of the fleet.

All of these are valid operational goals, particularly for security‑sensitive deployments such as regulated industries, health care, financial services, or education environments with large managed fleets.

---

The risks and downsides — why many admins will be wary​

Despite the benefits, this change carries several non‑trivial risks and tradeoffs that IT teams must weigh carefully.

Longer provisioning time and user frustration​

• Downloading and installing monthly cumulative updates during device setup can add tens of minutes to provisioning time. The actual duration depends on update size, Wi‑Fi throughput, and device performance.
• In distributed or bandwidth‑constrained environments (satellite offices, field deployments, or home networks), provisioning can be significantly delayed, disrupting scheduled handoffs and onboarding.

Stability and timing issues​

• Updates, even quality updates, sometimes introduce regressions. Rolling them into OOBE increases the chance that a newly imaged device will encounter a post‑update regression before it even reaches the first user.
• Recent update incidents in summer 2025 demonstrated how problematic cumulative updates can be; emergency out‑of‑band fixes and rollbacks are not unheard of. Applying those same updates during OOBE amplifies the blast radius if something goes wrong.

Partial loss of control & operational surprises​

• New ESP profiles default to enabling the setting. Administrators who create profiles without reviewing defaults may unintentionally expose certain device cohorts to forced OOBE updates.
• Organizations that rely on image‑based provisioning with specific tested KB sets may find the automatic OOBE updates break their carefully controlled build-to‑production process.

Dependency on Intune / Autopilot​

• The management model is tightly tied to the Autopilot/ESP workflow and works best with Intune. Organizations using other MDM solutions or on‑prem management may need to adapt workflows or wait for their vendor to support equivalent ESP functionality.
• Some third‑party MDM solutions do support ESP integration, but feature parity and default behaviors vary — requiring validation with each vendor.

User autonomy and trust​

• This is another step where Microsoft shifts the balance of control from the end user to the platform or the administrator. For devices where user consent is expected, the automatic application of updates during the initial setup may appear heavy‑handed.

---

Early signals and community reaction​

The rollout follows a tense period for Windows updates in mid‑2025: problematic cumulative updates and emergency out‑of‑band fixes generated significant community noise and interrupted recovery flows in some cases. That context matters because:

• Many administrators responded cautiously to the new OOBE update behavior, citing concerns about update stability and the added provisioning time.
• Consumer and enthusiast communities reacted negatively when Microsoft made App Store updates mandatory earlier in the year; that precedent amplifies sensitivity to any move perceived to reduce end‑user choice.
• Feedback from IT professionals has been consistent: Microsoft should provide clear, conservative defaults and an easy administrative opt‑out. The company appears to have listened to some degree by making the ESP toggle editable and leaving older ESP profiles unchanged.

---

Practical recommendations — how to prepare your environment​

Every organization’s risk tolerance and deployment pipeline are different. These pragmatic steps will help mitigate the downsides while getting the security benefits where appropriate.

• Inventory your Autopilot and ESP usage:
• Identify all ESP profiles in Intune and note which ones are newly created versus long‑standing.
• Audit assignments to Autopilot device groups and ensure you know which devices will receive new profiles.
• Review and update ESP defaults:
• For organizations that require tight image control, proactively edit new ESP templates to set the update toggle to off.
• Where you want OOBE updates, create a controlled pilot profile and assign only test devices.
• Increase temporary passcode validity during enrollment:
• Provisioning that takes longer because of OOBE updates can cause temporary access/password expiry problems. Extend temporary passcode validity where possible to avoid failed enrollments.
• Network preparation:
• Ensure provisioning networks have adequate bandwidth and that Windows Update endpoints are reachable. Consider a scheduled staging window for large device waves.
• On large deployments, use offline media or local update caching (where feasible) to shorten OOBE update time.
• Test, measure, iterate:
• Run pilot enrollments simulating remote office and typical end‑user networks.
• Measure average OOBE time with updates enabled vs disabled and document the delta.
• Establish rollback plans:
• Treat OOBE‑time updates like any other production change. Have a remediation plan for failed enrollments, and ensure IT support has the tools and instructions needed to recover devices that fail during OOBE updates.
• Communicate to end users:
• If updates during OOBE are enabled, add messaging to welcome‑pack and IT instructions so users know that setup may take longer and to keep devices plugged in.

---

A recommended checklist for Intune admins (quick action items)​

• Export a list of current ESP profiles and assignments.
• Identify which profiles were created after August 2025.
• For each new profile, verify the "Install Windows quality updates" toggle and set to off if needed.
• Create a pilot ESP profile with updates enabled and test across multiple hardware classes.
• Confirm Windows Update deferral policies are synced to Autopilot device groups.
• Validate temporary password lifetimes for Autopilot enrollments.
• Update onboarding documentation to reflect potential additional OOBE time.

---

Legal, governance, and policy considerations​

The change touches on larger debates about software governance and user choice. Administrators should consider policy and compliance impacts:

• For regulated environments that require strict change control, the default‑on nature of new ESP profiles requires administrative steps to avoid unintended automatic updates.
• Organizations with device procurement and imaging contracts should update operating procedure documents to capture the new OOBE update flow and any attendant SLA impacts between procurement, imaging teams, and IT operations.
• Privacy and consent: while updates themselves are not a privacy issue, any change to device behavior during initial setup that affects user experience should be reflected in IT acceptable‑use and onboarding documentation.

---

What this means for the wider Windows ecosystem​

This change underscores two broader trends:

• Microsoft continues to centralize update behavior and fleet hygiene mechanisms around cloud management (Microsoft Entra and Intune). The Autopilot + ESP path is now the canonical teleology for Windows provisioning for many organizations.
• The company is balancing security calculus (reduce unpatched devices in the field) against user and administrator control. Expect more such tradeoffs as Microsoft pursues a more consistent baseline across Windows fleets.

Industry and community reaction will inform how Microsoft tunes defaults and rollout cadence. If problematic updates continue to slip through, the company will face pressure to add more granular pre‑deployment controls, tighter staging, and perhaps server‑side rollout flags to mitigate risk.

---

Caveats and unverifiable concerns — what to watch for​

• The policy’s long‑term trajectory is not guaranteed. While the functionality is currently optional for administrators, Microsoft’s history shows it can change defaults and enforcement over time. Any claim that Microsoft will make this mandatory for all devices in the future is speculative and should be treated as a risk scenario, not a fact.
• The specific behavior of non‑Microsoft MDM integrations varies by vendor. Administrators using third‑party MDMs should verify vendor documentation and test behavior — the extent to which ESP settings are honored outside Intune isn’t uniform.
• Real‑world provisioning time impacts are highly environment dependent. Published averages are helpful, but teams must measure their own networks, image footprints, and device hardware to get reliable estimates.

---

Final analysis — balancing security and control​

Microsoft’s OOBE quality update capability is a defensible security move that will benefit many organizations by reducing the window of exposure for newly provisioned devices and by lowering immediate post‑deployment patching work. For fleets where speed, reproducibility, and strict image control are paramount, the default behavior for new ESP profiles represents an operational risk until tested, documented, and incorporated into existing processes.
The practical reality for administrators is straightforward: treat this as a configuration change that requires governance. Inventory, test, and update Intune ESP profiles now. Decide where the security uptick justifies the potential increase in provisioning time, and where the administrative burden or instability risk mandates an opt‑out.
In short: the feature is beneficial when used deliberately and tested comprehensively; it becomes a problem only when applied by default without organizational awareness. The path forward for most IT teams is to pilot with a controlled cohort, measure the impacts, then roll out with policy guardrails that match the organization’s operational priorities.

Microsoft is rolling a change that will alter the first minutes of life for new Windows 11 devices in many organizations: starting with the September 2025 security update, eligible enterprise and education PCs will check for and install the latest Windows quality updates during the Out‑Of‑Box Experience (OOBE) so the device reaches the desktop already patched and up to date.

Background / Overview​

For years IT teams have wrestled with a predictable pain point: freshly imaged or factory‑fresh devices arrive at users and promptly need multiple rounds of updates before they are secure and fully compliant. Microsoft’s new approach moves monthly cumulative quality updates into the final OOBE page for managed devices so those patches are applied before the first user login. The capability applies to Microsoft Entra‑joined or Entra hybrid‑joined devices running Windows 11, version 22H2 or later, and is controllable via Autopilot’s Enrollment Status Page (ESP) when devices are managed by Intune or compatible MDMs.
This change is aimed squarely at improving security, reducing post‑deployment remediation, and simplifying the “day‑one” support burden for IT departments. It also introduces new operational trade‑offs — notably longer provisioning times and new requirements for aligning update policies with enrollment flows — that must be planned for.

---

What Microsoft is changing​

The mechanics: updates during the final OOBE page​

At the last page of OOBE, Windows will now check Windows Update and, when applicable, download and install the latest quality update (monthly cumulative security and reliability update). That installation may trigger one or more restarts and will happen before the user reaches the desktop and signs in for the first time.
Key behavior points:

• Only quality updates (the monthly cumulative security/reliability rollups) are installed during OOBE. Feature updates and driver packages are excluded from this OOBE install path.
• The process is visible to the end user: OOBE will show a progress/status page while downloads and installs occur.
• The experience is managed: Intune/ESP can control whether a device installs updates during OOBE or not via a new toggle.

Admin control: the ESP setting​

The new control is surfaced in the Microsoft Intune admin center under Devices → Enrollment → Enrollment Status Page. Inside any ESP profile you’ll find the setting labeled:
Install Windows quality updates (might restart the device)
Administrators can:

• Turn this toggle on to allow quality updates during provisioning,
• Turn it off to preserve the previous behavior (no automatic quality updates during OOBE),
• Assign ESP profiles per Autopilot device group to apply different behavior across fleets.

Important defaults to watch:

• New ESP profiles created after the change default this setting to Yes (enabled).
• Existing ESP profiles preserve their prior setting (and therefore default to No until changed).
• The Intune default ESP profile is applied when no other profile is assigned; teams must check that default profile to avoid unintended behavior.

---

Which devices are eligible​

This OOBE quality‑update capability targets managed commercial devices with specific enrollments and images:

• Windows 11 devices running version 22H2 or later (Pro, Enterprise, Education, SE).
• Devices must be Microsoft Entra‑joined (formerly Azure AD) or Entra hybrid‑joined and enrolled in an MDM that supports Autopilot/ESP (Microsoft Intune is the primary management plane).
• Devices must either ship or be imaged with the required OOBE support: they need the vendor OOBE zero‑day patch delivered in vendor channels or be imaged with the June 2025 servicing package (or any later servicing update) so the OOBE UI and orchestration logic are present.

This capability does not apply to unmanaged consumer devices or to Windows 10 systems. Organizations that still run Windows 10 should note that mainstream support for Windows 10 ends in October 2025 and should plan migrations accordingly.

---

Why Microsoft made the change — the benefits​

This isn’t a cosmetic tweak. There are concrete operational and security benefits for organizations that adopt the new flow:

• Security from day one: Devices leave OOBE with the latest monthly security fixes, reducing the window of exposure for zero‑day or recently patched vulnerabilities.
• Lower post‑deployment workload: IT help desks spend fewer hours chasing unpatched new devices, which reduces tickets and user frustration.
• Consistent fleet baseline: When combined with Update Rings/deferral policies, the OOBE check can ensure devices land on the organization‑approved cumulative update.
• Better compliance posture: Devices are more likely to be compliant with corporate policies immediately after enrollment, aiding audits and reducing risk.
• Simpler imaging workflows: OEMs and hardware distributors can deliver devices that are closer to the corporate security baseline straight out of the box.

For many organizations the promise of reducing after‑deployment patching is compelling — especially ahead of large seasonal rollouts, new hire waves, or mass refresh cycles.

---

Operational trade‑offs and risks​

No sizable change to provisioning is without cost. IT teams should weigh the benefits against a handful of important operational trade‑offs.

• Longer OOBE time: Installing updates during OOBE adds time to device setup. Real‑world tests and vendor guidance suggest average additional provisioning can be around 20 minutes, but this varies widely depending on update size, device hardware, and network throughput.
• Temporary Access Pass (TAP) expiry risk: If you rely on short‑lived enrollment credentials (for example, Temporary Access Pass) they can expire while updates are installing. Microsoft recommends extending TAP validity or adjusting enrollment procedures to avoid lockouts.
• Network impact: Large batches of devices pulling updates at first boot can strain network links in branch offices or supply chain staging areas. Delivery Optimization and peer caching can help, but network architects must plan bandwidth.
• Forced updates if flow not managed: Organizations that do not assign ESP profiles or whose enrollment flows bypass ESP may find quality updates applied by default. If your default ESP (or enrollment flow) has the toggle enabled, devices will install updates automatically — administrators must confirm default behavior to avoid surprises.
• Policy misalignment: For the OOBE install to respect deferral and pause policies, those Windows Update policies must be synced to the device before the final update check. If Update Rings or Windows Update for Business policies are not correctly assigned to the same groups as the ESP profile, the OOBE install may not honor deferrals consistently.
• Increased vendor control concerns: Some administrators will view this as another example of Microsoft tightening control over update delivery, reducing flexibility for certain specialized deployment architectures.

These are not show‑stoppers, but they are real practical hurdles many enterprise teams will need to manage.

---

Practical mitigation and best practices​

IT teams can adopt straightforward practices to take advantage of the new capability while minimizing disruption.

• Prepare and test in a lab:
• Create representative ESP profiles and measure OOBE time across common device models.
• Test with images that include the June 2025 servicing package or OOBE ZDP applied.
• Audit your ESP assignments:
• Confirm which ESP profiles are assigned to which Autopilot groups.
• Inspect the default ESP profile — it may be applied when no profile is explicitly assigned.
• Align Update Rings and ESP groups:
• Ensure Windows Update/Update Rings profiles are assigned to the same device groups as ESP so deferrals and pause policies are synced before the OOBE update check.
• Extend enrollment credentials where needed:
• If you use Temporary Access Passes or other short‑lived tokens, extend their validity to accommodate the extra OOBE time.
• Plan bandwidth and caching:
• Configure Delivery Optimization, branch cache, or peer‑to‑peer caching for large deployments to reduce WAN consumption during OOBE.
• Stage images with the required servicing updates where possible so devices don’t need large downloads at first boot.
• Use exclusion groups for special hardware:
• For kiosks, shared devices, or imaging labs that cannot tolerate extra time, assign an ESP profile with the toggle set to No.
• Communicate to stakeholders:
• Update provisioning runbooks, help desk scripts, and new‑hire IT onboarding documents to set expectations about longer first‑boot times.
• Verify MDM vendor parity:
• If you use a third‑party MDM, confirm whether the vendor supports the new ESP toggle or how their enrollment flow interacts with Microsoft’s OOBE update path.

---

Step‑by‑step: how to control the behavior in Intune​

Administrators who manage Autopilot with Intune can implement or change the setting quickly:

• Sign into the Microsoft Intune admin center.
• Navigate to Devices → Enrollment → Enrollment Status Page.
• Edit an existing ESP profile (or create a new one), then open the Settings tab.
• Locate the Install Windows quality updates (might restart the device) toggle and set to Yes or No depending on your policy.
• Assign the ESP profile to the appropriate Autopilot device groups, ensuring priority order when multiple profiles apply.
• Confirm that Windows Update/Update Rings assignments are linked to the same device groups so policy sync occurs prior to OOBE update checks.

This configuration gives granular control per device group and is the recommended administrative surface for this capability.

---

Imaging, OEMs, and supply‑chain implications​

A subtle but important requirement is that devices must have OOBE support present in the image or receive the vendor OOBE patch to show the update UI and orchestrate installs. That has downstream implications:

• OEMs and system integrators must ensure images include the June 2025 servicing package or the later August OOBE zero‑day package so the OOBE update flow displays correctly.
• Enterprises that rely on vendor pre‑staging (device stagers, fleet imaging, or supply‑chain provisioning) should coordinate with OEM partners to confirm images include the necessary updates so OOBE behaves as expected.
• Resellers and distribution centers that unbox and stage devices at scale need to consider bandwidth and Storage/Delivery Optimization to avoid long delays in transit or at branch locations.

Planning with hardware partners reduces surprises during first‑time provisioning, especially for bulk rollouts.

---

Security and compliance considerations​

From a security standpoint, this change improves baseline posture by applying the latest cumulative security patch during provisioning. However, it does not replace ongoing vulnerability management or feature‑update strategy.

• OOBE installs only address quality‑update class fixes; feature updates (major OS upgrades) should still be controlled and scheduled via your Update Rings and feature update policies.
• Compliance and audit teams benefit from devices leaving OOBE at a known patch level, but administrators should still document update baselines and ensure telemetry and reporting reflect OOBE installs.
• Organizations with strict change control windows should synchronize their Update Rings and test cycles so only approved cumulative updates are offered during OOBE.

Implementing OOBE quality updates should be treated as part of the broader patch‑management lifecycle, not a one‑time fix.

---

The political and cultural angle inside enterprise IT​

Beyond the technical considerations, this change touches a recurring theme in enterprise IT: the balance between centralized control and administrative autonomy.

• For many IT pros this is welcome — fewer “first‑day” tickets and faster secure access.
• For others, especially those who depend on highly controlled, offline, or regulated provisioning flows, it feels like more automation is being imposed by Microsoft.
• The reality is nuanced: Microsoft provides control mechanisms — ESP toggles, Group Policy counterparts, and MDM policy mirrors — but organizations must proactively configure them. The most common operational mistake will be assuming old defaults persist and not auditing the default ESP profile or newly created profiles.

The move is emblematic of Microsoft’s broader strategy to reduce unpatched exposure while steering more customers toward cloud‑managed, Intune‑driven administration.

---

Quick checklist for IT teams (ready to copy into runbooks)​

• Verify device images include the June 2025 servicing package or ensure OEMs supply the OOBE Zero‑Day Patch.
• Audit your Intune ESP profiles and the default ESP profile setting.
• Align Update Rings with Autopilot device groups assigned to ESP.
• Configure Delivery Optimization for bandwidth‑constrained sites.
• Extend Temporary Access Pass validity during enrollment windows.
• Create exclusion ESP profiles for special‑purpose devices (kiosks, imaging labs).
• Update help desk documentation and new‑hire setup scripts.
• Validate third‑party MDM behavior if you do not use Intune.

---

Final analysis — who should enable OOBE quality updates today?​

For most mainstream corporate fleets — laptops and desktops used by knowledge workers that enroll via Autopilot and are managed by Intune — enabling quality updates during OOBE is a net win. It reduces risk, cuts help desk load, and improves compliance.
Caveats apply for:

• Branch offices with constrained WAN links where simultaneous first‑boot updates will overload networks.
• Scenarios that rely on strictly timed enrollment tokens or where provisioning must complete in a minimal timeframe (kiosks, field units).
• Organizations using non‑Intune MDMs that might not expose the new toggle immediately.

The right path is pragmatic: test, measure provisioning time, and roll the setting out by device group rather than relying on one blanket decision.

---

Conclusion​

Microsoft’s decision to offer Windows quality updates during OOBE addresses a long‑standing operational gap: new devices that are secure and compliant the moment they reach an employee’s hands. The feature brings meaningful security and lived productivity benefits for enterprise and education customers but also introduces operational costs that require planning — longer setup times, credential expiry considerations, and careful policy alignment.
Administrators who treat this as an opportunity — audit ESP assignments, align Windows Update policy groups, stage images with the required servicing, and prepare network and help‑desk teams — will find day‑one security significantly improved and the post‑deployment patch sprint much shorter. The change is powerful, but like any automation, its value depends on the discipline and testing that organizations put around it.

Starting in September 2025, Microsoft will change how Windows 11 devices are provisioned for enterprise and education customers by installing the latest Windows quality updates during the final page of the out‑of‑box experience (OOBE)—a move that promises stronger security and fewer post‑deployment patching tasks but also introduces new operational trade‑offs IT teams must plan for.

Background​

Microsoft’s OOBE quality‑update capability is an evolution of prior work to make device provisioning more secure and predictable. The feature targets Windows 11 devices on version 22H2 or later, and is scoped to devices that are Microsoft Entra‑joined or Entra hybrid‑joined and managed through Microsoft Intune or a compatible MDM. The mechanism checks Windows Update on the last page of OOBE and installs applicable quality updates (monthly cumulative security/reliability rollups) before the user reaches the desktop. Feature updates and hardware driver packages are explicitly excluded from the OOBE installation path.
Microsoft first outlined the concept and a policy control earlier in 2025 and has since moved the capability into production‑ready guidance, with broader availability tied to the September 2025 monthly update cadence and prerequisite packages (including the August 2025 OOBE zero‑day package or the June 2025 non‑security image update). Administrators will see a new toggle in the Autopilot Enrollment Status Page (ESP) settings to control whether Windows quality updates install during provisioning.

---

What exactly is changing?​

The mechanics: when and what updates run​

• On the final page of the OOBE, Windows will check Windows Update and, when appropriate, download and install the latest quality update applicable to that device build. The installation may require one or more reboots before the user completes first sign‑in. Feature updates and driver packages are not installed through this OOBE path.
• The update action is visible to the end user: OOBE will display a status/progress page while downloads and installs occur, and a restart sequence will complete before the desktop is shown. Microsoft notes average additional setup time can be around 20 minutes, though real‑world time depends on update size, network bandwidth, and hardware performance.

Which devices are eligible​

• Windows 11 devices running 22H2 or later.
• SKUs supported: Pro, Enterprise, Education, and SE.
• Devices must be joined to Microsoft Entra (Azure AD) or hybrid‑joined, and be managed by Intune or another supported MDM that integrates with Autopilot/ESP.

Admin controls: the Intune/Autopilot ESP toggle​

Administrators can manage the behavior through the Intune admin center by editing an Enrollment Status Page (ESP) profile:

• Sign into the Microsoft Intune admin center.
• Go to Devices > Enrollment > Enrollment Status Page.
• Select or create an ESP profile and open Settings.
• Locate and set Install Windows quality updates (might restart the device) to Yes or No.

Crucial defaults to watch:

• New ESP profiles created after the change default the setting to Yes (enabled).
• Existing ESP profiles keep their current value (typically No) until edited.
• The Intune default ESP profile is applied when no other profile is assigned; admins should verify the default to avoid unexpected behavior.

---

Why Microsoft is doing this: benefits for security and IT operations​

Microsoft frames the change as a response to enterprise feedback: administrators want devices to be secure and consistent before users start using them. The main benefits are:

• Immediate hardening at first boot: devices receive the latest security and reliability patches before first sign‑in, reducing the attack surface from day one.
• Fewer follow‑up updates and helpdesk tickets: early patch application reduces the common scenario where users receive devices and then face immediate update prompts, restarts, or app breakages—items that frequently generate support calls.
• Better alignment with change control: the new mechanism synchronizes with Windows Update for Business policies (deferrals, pause windows) when those policies are applied to the same Autopilot/ESP device group, enabling organizations to keep provisioned devices on the same approved update version.

These are practical gains for organizations deploying at scale: fewer post‑deployment surprises, consistent starting baselines for security audits, and less variance across newly delivered devices.

---

Operational trade‑offs and risks​

The feature is beneficial, but not without operational impact. IT and security teams should weigh the following risks and caveats.

1. Longer provisioning windows and logistics​

Installing quality updates during OOBE can add time to device provisioning—Microsoft cites an average of around 20 minutes, with possible variance up to 30 minutes or more depending on the update size and network/hardware conditions. For large rollouts or in‑the‑field device activations (kiosks, retail, schools), that additional latency can create queues, user frustration, and calendar slippage.

2. Temporary Access Pass (TAP) and authentication expiry​

Because OOBE may take longer, Temporary Access Pass tokens used during Autopilot enrollment can expire before the user reaches desktop sign‑in. Microsoft recommends extending TAP validity or adjusting enrollment workflows to avoid mid‑provisioning authentication failures. Failure to plan for TAP expiry can strand end users and increase support calls.

3. Imposed updates when ESP is absent or misaligned​

If devices are enrolled via Autopilot device preparation policies or do not have a device‑level ESP profile assigned, the OOBE update action may be applied by default and might not be immediately disableable in some scenarios. Microsoft’s documentation warns that when you’re not using device ESP, you may not be able to turn off Windows updates during OOBE—this behavior can be surprising for organizations that rely on custom image workflows or third‑party provisioning. Administrators must confirm their Autopilot and ESP assignments to avoid unintended enforcement.

4. Update failures during OOBE​

Applying updates during a zero‑touch or near zero‑touch provisioning flow raises the stakes: if a monthly quality update contains a regression that impacts a subset of hardware, an entire batch of new devices could hit the same fault during setup and require remediation. The usual mitigations (pilot rings, staged rollout) become critical here because the failure surface is front‑loaded into an automated provisioning path.

5. Policy synchronization complexity​

To ensure the new behavior respects deferrals and pause rules, Windows Update rings and the ESP profile must be assigned to the same device group; inconsistent assignments could yield unexpected update behavior. This creates an operational dependency that needs explicit provisioning logic and group management to avoid drift.

---

Practical guidance for IT teams: recommended rollout plan​

To adopt OOBE quality updates responsibly, follow a tested, staged approach:

• Pilot cohort
• Create a small pilot device group representing key hardware models and imaging paths.
• Assign an ESP profile with Install Windows quality updates = Yes and validate the flow.
• Verify prerequisites
• Ensure devices are on Windows 11 22H2 or later and include the August 2025 OOBE ZDP or are imaged with the June 2025 non‑security update where applicable.
• Align update rings
• Assign Windows Update for Business rings to the same Autopilot/ESP groups to guarantee deferral and pause policies are applied pre‑NDUP (New Device Update Page) check.
• Adjust authentication windows
• Increase Temporary Access Pass (TAP) lifetimes or change enrollment flows to avoid expiry during longer OOBE sequences.
• Test recovery and rollback
• Prepare a recovery plan for failed OOBE updates: documented steps for reimaging, network isolation, or vendor assistance if a monthly quality update breaks a hardware family.
• Communicate with stakeholders
• Notify procurement, vendor partners, and end users about the potential extra time during out‑of‑the‑box provisioning and update any device handoff scripts or SLAs accordingly.
• Monitor telemetry
• Use Intune diagnostics, Windows Update logs, and A/B pilot telemetry to detect abnormalities before scaling to broader groups.

This approach reduces risk while enabling the security benefits of patched devices at first sign‑in.

---

Policy, compliance, and security implications​

From a governance standpoint, installing security updates during OOBE aligns device provisioning with baseline compliance requirements out of the gate. That matters for:

• Regulated industries: devices delivered to users are immediately at the organization’s approved patch level, simplifying audits and reducing zero‑day exposure.
• Zero trust initiatives: reducing windows of unpatched exposure for freshly provisioned endpoint hardware supports broader identity and device posture checks that modern security stacks enforce.
• Supply‑chain and vendor imaging: organizations that accept vendor‑imaged devices should verify the image includes the required preconditions (the June 2025 non‑security update or later) so OOBE update behavior is predictable.

However, there are trade‑offs: if a monthly quality update introduces an unforeseen regression, devices provisioned during the rollout could exhibit the same faulty behavior en masse—making staging and pilot testing non‑optional for high‑risk deployments.

---

Technical caveats and edge cases​

Network constraints and bandwidth considerations​

Bulk provisioning in constrained networks—branch offices, classrooms, retail stores—may suffer from excessive bandwidth use and prolonged setup times. Consider local caching (WSUS/Delivery Optimization) or image management strategies to reduce per‑device download times.

Non‑Intune MDMs and third‑party provisioning​

While Microsoft’s control surfaces are in Intune/Autopilot ESP today, other MDM vendors supporting Autopilot may offer equivalent toggles. Admins should confirm vendor support and test non‑Intune enrollment paths to ensure parity.

Devices that ship with very old images​

Devices imaged with older Windows builds may require larger cumulative downloads during OOBE. Imaging teams should prioritize shipping devices imaged with June 2025 non‑security update or later to reduce OOBE download volume and time.

OOBE Zero Day Package (ZDP)​

Microsoft’s ZDP mechanism for last‑minute critical fixes remains distinct: ZDP updates begin downloading automatically as part of OOBE when required, and are not changed by this new policy. The OOBE quality update feature supplements, but does not replace, existing ZDP behavior.

---

Real‑world scenarios: wins and gotchas​

Scenario: Enterprise laptop refresh (win)​

A global sales team receives new laptops. With OOBE quality updates enabled for the pilot group, devices arrive at users already at the approved security baseline, eliminating follow‑up restarts and ensuring immediate compliance with conditional access policies. Helpdesk tickets for “why did my laptop restart?” drop sharply.

Scenario: School rollouts (gotcha)​

A school orders 200 laptops and plans to hand them out on the first day. On‑site Wi‑Fi cannot sustain 200 simultaneous downloads; OOBE times balloon, students and teachers miss morning lessons, and TAPs expire. Solution: stage the rollout, preseed images or use local delivery optimization.

Scenario: Vendor imaged desktops (potential surprise)​

A vendor ships desktops using an older base image. Because an ESP profile wasn’t assigned or because device preparation policies were used, the OOBE update runs by default and forces a large download and multiple restarts, delaying device acceptance at the receiving site. The receiving IT team must coordinate image expectations with vendors to avoid surprise delays.

---

Action checklist for administrators (concise)​

• Verify device eligibility (Windows 11 22H2+, supported SKUs).
• Confirm your tenant has the August 2025 OOBE ZDP or that images include the June 2025 update.
• Audit ESP profile assignments and the Intune default ESP profile.
• Create a small, representative pilot group and validate the end‑to‑end OOBE + update sequence.
• Align Windows Update rings and ESP assignments to the same device groups.
• Extend TAP lifetimes or adjust enrollment flows to account for longer OOBE.
• Communicate provisioning time expectations to procurement, vendors, and users.
• Prepare a remediation/rollback playbook for update failures during provisioning.

---

Final analysis: is this a net positive?​

On balance, the change is a pragmatic, security‑focused improvement for enterprise and education environments. The ability to ensure a device starts its life at the organization’s approved patch level reduces exposure to known CVEs and simplifies compliance. For IT organizations that already use Autopilot and Intune, the new ESP toggle provides a familiar control surface and integrates with Windows Update for Business policies, offering flexibility. However, the feature raises legitimate operational concerns around provisioning time, authentication token expiry, imaging and vendor workflows, and the risk of an out‑of‑band quality update introducing regressions during a mass rollout. These are not blockers, but they are meaningful risks that require disciplined pilot programs, group alignment, and communications with procurement and vendors.
In short: the technical design is sound and aligned with modern endpoint security goals, but success depends on rigorous operational readiness. IT teams that treat the change as simply “flip the toggle” will likely encounter friction; teams that plan, pilot, and align update policies and Autopilot assignments will realize significant gains in security, compliance, and user experience.

---

Conclusion​

Microsoft’s move to install Windows quality updates during OOBE for managed Windows 11 devices (22H2+) represents a notable shift in how organizations can harden endpoints from the moment they’re first powered on. The capability—managed via the Autopilot Enrollment Status Page (ESP) in Intune—delivers concrete security and operational benefits, but it introduces new dependencies around provisioning time, group alignment, and vendor imaging workflows. With careful testing, clear communication, and updated enrollment playbooks, IT teams can make this change an effective tool to reduce post‑deployment patching work and deliver more reliable first‑use experiences for end users.
Cautionary note: some behavior details—especially around devices enrolled without an ESP profile and interactions with non‑Intune MDM solutions—can vary depending on provisioning paths and policy alignment; organizations should validate behavior in their specific environment before broad adoption.