Enabling 1-day Deferrals for Windows Hotpatch

Starting in May 2026, Microsoft enabled Hotpatch by default for eligible devices with Windows 11 or Windows Server 2025 that were managed through Windows Autopatch in Microsoft Intune.

Windows Hotpatch updates are Windows Security updates deployed to eligible devices without requiring a restart.

To verify if your Tenant has Hotpatch enabled, navigate to your Microsoft Intune Admin portal. From here, select Tenant administration on the left-hand side of your page.

From the Tenant admin section, select Tenant management, and confirm that the "When available, apply updates without restarting the device ("Hotpatch")" option is set to Allow.

Microsoft releases Hotpatch updates through a phased rollout. This means that availability can vary across devices during the first 24 hours after release and may not be immediate.

To help prevent unintended application blocks from ThreatLocker, it is recommended that all Windows Autopatch rings responsible for managing Windows Updates use an update deferral period of at least 1 day. This provides additional time for the latest Hotpatch files to be received, validated, and incorporated into the ThreatLocker Windows Hotpatch (Built-In) and Windows Core definitions before updates are deployed broadly.

Enabling 1-day deferrals for Hotpatch Updates

Please refer to the following guide to enable a one-day deferral for Hotpatch updates.

Step 1:

In your Microsoft Intune Admin Center, navigate to Devices > Manage Updates > Windows updates > Update Rings.

Step 2:

Select the Update ring for which you're enabling the 1-day deferral.

Step 3:

Navigate to the section labeled Deployment rings and distribution and select the Edit option.

Step 4:

From the Edit page, select the Next button at the bottom of the screen until you reach the Release schedules page. 

Step 5:

Once on the Release schedules page, select 'Edit' next to the correct Deployment ring under the “Quality and driver updates” section.

In the Edit deployment ring settings page, navigate to the dropdown labeled Client update deferrals. Set this number to one, then select the 'Save' button at the bottom of the page. 

Step 6:

Select the 'Next' button at the bottom of the page once more.

Step 7:

Select the 'Save' button at the bottom of the page once you have reviewed and confirmed all changes to these settings.

Once you have completed these steps, the applicable Windows Autopatch deployment ring will defer Windows quality updates for at least 1 day after release before offering them to devices.