⚡ Quick Summary
- Microsoft will enable hotpatch security updates by default for all eligible Intune-managed Windows devices starting with the May 2026 security update, ending the previous opt-in model.
- Eligible devices must run Windows 11 24H2 or later on x64 hardware with Windows 11 Enterprise E3/E5 or equivalent Microsoft 365 licensing.
- Hotpatch eliminates reboots for security updates in eight of twelve monthly cycles, with full cumulative updates still required quarterly.
- The change addresses the critical patch compliance gap that threat actors exploit — often within 72 hours of a CVE's public disclosure.
- IT teams should audit Intune policies and licensing entitlements now to prepare for the May 2026 default activation and configure any necessary opt-outs.
What Happened
Microsoft has confirmed a significant shift in how it delivers security updates to Windows devices: beginning with the May 2026 Windows security update cycle, hotpatch updates will be enabled by default across all eligible Windows devices managed through Microsoft Intune and the Microsoft Graph API. This marks the first time the technology — which allows security patches to be applied to live, running systems without requiring a reboot — will be activated automatically at scale across the enterprise Windows ecosystem.
The change applies specifically to devices running Windows 11 version 24H2 or later on x64 (AMD64) hardware, the current eligibility threshold for hotpatching on the client side. Devices must be enrolled in Microsoft Intune and configured under a Windows quality update policy. Crucially, the hotpatch model operates on a quarterly cadence: full cumulative updates requiring a restart are delivered in January, April, July, and October, while hotpatch-eligible months — February, March, May, June, August, September, November, and December — push security fixes silently into memory without interrupting user sessions or demanding a system restart.
Microsoft has framed this transition as a direct response to enterprise feedback around update fatigue and the persistent challenge of patch compliance. According to the company, organisations that have already adopted hotpatching through preview and early access programmes have reported measurable reductions in reboot-related downtime and improved patch deployment velocity — two metrics that have historically plagued large-scale Windows fleet management. IT administrators managing fleets through Intune will see hotpatch enabled automatically unless they explicitly opt out through policy configuration, reversing the previous opt-in model that limited adoption.
The announcement also confirms that Microsoft Intune's reporting dashboard will surface hotpatch deployment status distinctly, giving administrators granular visibility into which devices are receiving live patches versus full cumulative updates in any given month.
Background and Context
Hotpatching is not a new concept in the Microsoft universe — but its journey to the Windows client has been long and technically demanding. The technology first appeared in a meaningful enterprise context with Windows Server 2022 on Azure Arc-enabled infrastructure, where Microsoft introduced hotpatch as a premium feature for Azure Automanage customers in 2022. That server-side implementation proved the model: security vulnerability fixes could be injected directly into the memory of running processes, bypassing the traditional requirement to write changes to disk and restart the operating system to load the patched code.
The underlying architecture relies on a baseline image — the most recent full cumulative update — from which hotpatches are generated as delta packages targeting only the in-memory code of affected modules. This means hotpatches are inherently smaller in download size and carry no risk of introducing regressions in system files that aren't being patched, a meaningful reliability advantage over full cumulative updates.
Microsoft's move to bring hotpatching to Windows 11 clients was first telegraphed at Ignite 2023, when the company outlined its vision for a more resilient, always-protected Windows fleet. A public preview for Windows 11 Enterprise clients managed through Intune followed in early 2024, initially restricted to Windows 11 22H2 and 23H2 before expanding eligibility to the 24H2 release. The preview period generated substantial data on patch compliance rates, with Microsoft citing internal telemetry suggesting hotpatch-enabled devices achieved security update installation within 24 hours of release at significantly higher rates than traditionally managed peers — a finding consistent with the intuitive logic that users are far more likely to defer a reboot than a background update they never notice.
This announcement also arrives in the context of Microsoft's broader Secure Future Initiative (SFI), launched in late 2023 following high-profile security incidents including the Storm-0558 breach that compromised Exchange Online mailboxes of senior US government officials. SFI placed patch velocity and attack surface reduction at the centre of Microsoft's internal security culture, and the productisation of hotpatching for the general enterprise Windows base is a direct downstream output of that commitment. For those running genuine Windows 11 in business environments, this evolution represents the most substantive change to the patching model in over a decade.
Why This Matters
The implications of making hotpatch the default — rather than an opt-in feature — are profound, and they extend well beyond the technical elegance of reboot-free updates. At its core, this decision addresses one of the most stubborn problems in enterprise security: the gap between patch availability and patch deployment.
Cybersecurity industry data consistently paints a damning picture. The Ponemon Institute and various threat intelligence vendors have repeatedly found that the median time between a vulnerability's public disclosure and its exploitation in the wild has compressed dramatically over the past five years — in many cases falling below 72 hours for high-severity CVEs. Meanwhile, enterprise patch deployment cycles, even in well-managed organisations, frequently stretch to two or three weeks when reboot scheduling, change management windows, and user resistance are factored in. That gap is precisely where ransomware operators, initial access brokers, and nation-state actors thrive.
By eliminating the reboot requirement for the majority of monthly security updates, Microsoft is effectively collapsing that window for eligible devices. A security fix that can be deployed silently during business hours, without scheduling a maintenance window or badgering users to save their work, is a security fix that actually gets deployed. This is not a marginal improvement — it is a structural change to the economics of enterprise patch management.
For IT and security teams, the default-on posture also removes a critical decision point that has historically been a source of inertia. When hotpatch was opt-in, organisations had to evaluate, test, and deliberately enable the feature — a process that, in many enterprises, never completed. Default-on means the security benefit accrues automatically to the entire eligible fleet from May 2026 without requiring a project or a budget cycle.
There are licensing considerations worth noting. Hotpatch for Windows 11 clients requires a Windows 11 Enterprise E3 or E5 licence, or equivalent coverage through Microsoft 365 E3, E5, Business Premium, or F3. This is not a feature available to Windows 11 Pro users without Intune enrolment and appropriate licensing, which means organisations running mixed licence environments will need to audit their estate. Businesses looking to optimise their licensing spend while accessing these enterprise security capabilities should explore enterprise productivity software options through authorised resellers to ensure they have the right entitlements in place before May 2026.
Industry Impact and Competitive Landscape
Microsoft's move to default hotpatching puts meaningful pressure on competing endpoint management and operating system vendors to articulate their own patch velocity stories — and the competitive landscape reveals some interesting asymmetries.
Apple, whose macOS and iOS platforms have long been cited as security exemplars in consumer contexts, has historically relied on rapid forced updates and a much smaller enterprise management surface. Apple's Rapid Security Response (RSR) feature, introduced with macOS Ventura and iOS 16.4 in 2023, offers a conceptually similar capability — delivering targeted security fixes outside the normal OS update cycle without a full restart in some cases. However, RSR's enterprise management integration through MDM solutions remains less mature than Microsoft's Intune-native implementation, and Apple's enterprise market share in traditional desktop environments, while growing, remains a fraction of Windows' dominance. IDC data consistently places Windows above 70% of enterprise PC operating system deployments globally.
On the Linux side, live kernel patching technologies — including Canonical's Livepatch, Red Hat's kpatch, and SUSE's kGraft — have offered reboot-free kernel security updates in server contexts for years. These solutions have been influential in cloud and data centre environments but have not translated meaningfully to managed desktop fleets. Microsoft's implementation is notable precisely because it targets the client endpoint at scale, a use case Linux live patching has never seriously addressed in enterprise desktop management.
For endpoint management platform vendors like VMware Workspace ONE (now part of Broadcom), Ivanti, and Jamf, Microsoft's deepening integration between Windows, Intune, and hotpatch creates a gravitational pull toward the Microsoft-native stack. Organisations running heterogeneous management environments will increasingly need to evaluate whether third-party MDM solutions can surface and manage hotpatch status with the same fidelity as Intune — and current evidence suggests the answer is no, at least not without Microsoft's direct API cooperation through the Microsoft Graph API endpoints being expanded for this feature.
The Graph API angle is strategically significant. By routing hotpatch management through Graph API, Microsoft is making hotpatch status a first-class data object in its ecosystem, accessible to security information and event management (SIEM) platforms, compliance tools, and third-party orchestration layers that already consume Graph data. This positions hotpatch not just as a patching mechanism but as a compliance signal — one that will increasingly appear in Microsoft Secure Score calculations and Defender for Endpoint posture assessments.
Expert Perspective
From a strategic standpoint, Microsoft's decision to flip hotpatch to default-on is a masterstroke in the ongoing effort to make Windows the most defensible enterprise operating system by default configuration — not by capability alone. The distinction matters enormously. Enterprise security posture is as much a function of what happens automatically as what is technically possible, and Microsoft has learned, sometimes painfully, that features requiring deliberate activation are features that get skipped.
The timing relative to the Secure Future Initiative is also telling. SFI was, in part, a response to criticism that Microsoft's security defaults were insufficiently aggressive — that the company prioritised backward compatibility and operational flexibility over hardened-by-default configurations. Hotpatch-by-default is a concrete, measurable deliverable that Microsoft can point to as evidence of cultural change, not just policy statements.
The risks are not zero. Hotpatch's architecture — injecting code changes into running processes — introduces a theoretical attack surface if the hotpatch delivery mechanism itself were compromised. Microsoft's use of signed packages and the Windows Update infrastructure mitigates this substantially, but security researchers will scrutinise the implementation closely. There is also the question of enterprise change management: some organisations have strict policies requiring testing of all patches in staging environments before production deployment, and the default-on model may create friction with those workflows. Intune policy controls exist to manage this, but IT teams will need to act proactively rather than reactively.
Looking at the broader trajectory, this move signals that Microsoft views patch velocity as a competitive differentiator — a security SLA it can offer enterprise customers that no other major desktop OS vendor currently matches at scale.
What This Means for Businesses
For IT decision-makers and security leaders, the May 2026 deadline is not a distant horizon — it is approximately one annual planning cycle away, and the preparation required is non-trivial. Here is what organisations should be doing now.
First, audit your Windows 11 deployment against the eligibility criteria. Hotpatch default enablement applies to Windows 11 24H2 on x64 hardware managed through Intune. If your fleet is still partially on Windows 10 — which reaches end of support in October 2025 — or on 22H2/23H2, you have a hardware and software refresh dependency to address before you can benefit from this change. Organisations that have been deferring Windows 11 migration should treat this announcement as an additional forcing function.
Second, review your licence entitlements. Windows 11 Enterprise E3 or Microsoft 365 Business Premium is the minimum threshold for hotpatch eligibility. If you are running Windows 11 Pro without Intune management, you are not in scope. This is an opportunity to consolidate licensing intelligently — businesses can access significant savings on affordable Microsoft Office licences and Windows entitlements through legitimate resellers, reducing the cost barrier to reaching the enterprise licensing tier that unlocks hotpatch.
Third, review your Intune Windows quality update policies before May 2026. Organisations that need to maintain explicit opt-out from hotpatch for specific device groups — perhaps due to change management requirements or specialised workloads — should configure those exclusions proactively rather than discovering them reactively after the default changes.
Key Takeaways
- Microsoft will enable hotpatch security updates by default for all eligible Intune-managed Windows devices starting with the May 2026 security update cycle, reversing the previous opt-in model.
- Eligible devices must run Windows 11 24H2 or later on x64 hardware with appropriate enterprise licensing (E3/E5 or Microsoft 365 equivalent) and Intune enrolment.
- Hotpatch eliminates the reboot requirement for security updates in eight of twelve monthly update cycles, with full cumulative restarts still required quarterly in January, April, July, and October.
- The change directly addresses the enterprise patch compliance gap — the period between vulnerability disclosure and deployment — which threat actors routinely exploit, often within 72 hours of a CVE going public.
- Management and reporting for hotpatch status is surfaced natively in Intune and through the Microsoft Graph API, making it accessible to third-party SIEM and compliance tooling.
- Organisations on Windows 10 or non-enterprise Windows 11 licences will need to address upgrade and licensing dependencies before benefiting from default hotpatch coverage.
- IT teams should audit Intune policies now to configure any necessary opt-outs for specialised workloads before the May 2026 default activation.
Looking Ahead
The period between now and May 2026 will be critical for shaping how broadly this technology actually lands. Microsoft is expected to publish updated Intune documentation and policy guidance well ahead of the rollout, and it would be surprising if hotpatch eligibility were not expanded to ARM64 devices — including the growing Copilot+ PC category — before the default-on date arrives. The Surface Pro 11 and Surface Laptop 7, both ARM64 devices, are currently excluded from hotpatch eligibility, an omission that becomes increasingly conspicuous as Qualcomm Snapdragon-powered Windows devices gain enterprise traction.
Watch also for Microsoft Secure Score to incorporate hotpatch compliance as a scored signal, which would create additional organisational incentive beyond the operational benefits. The intersection of hotpatch data with Microsoft Defender for Endpoint's attack surface reduction recommendations is a natural product evolution that could arrive within the same timeframe.
Finally, the October 2025 end of support for Windows 10 will drive a significant wave of enterprise Windows 11 migrations through the second half of 2025 and into 2026 — migrations that will land devices squarely in the hotpatch-eligible cohort just as the default activation occurs. The timing is unlikely to be accidental, and the combined effect could make May 2026 a genuine inflection point in enterprise Windows security posture.
Frequently Asked Questions
What devices are eligible for Windows hotpatch updates in 2026?
Devices must be running Windows 11 version 24H2 or later on x64 (AMD64) hardware. They must also be enrolled in Microsoft Intune and managed under a Windows quality update policy. Appropriate enterprise licensing is required — at minimum Windows 11 Enterprise E3, or equivalent coverage through Microsoft 365 E3, E5, Business Premium, or F3. ARM64 devices, including Copilot+ PCs, are currently outside the eligibility scope, though Microsoft is expected to address this before or alongside the May 2026 rollout.
Will IT administrators still be able to opt out of hotpatch after it becomes the default?
Yes. Microsoft has confirmed that IT administrators can configure opt-outs for specific device groups through Intune Windows quality update policies. Organisations with strict change management requirements or specialised workloads that need explicit patch testing before deployment can maintain those workflows by proactively configuring exclusions. The key change is that action will be required to opt out, rather than to opt in — reversing the current dynamic.
How does Windows hotpatch differ from a standard monthly security update?
A standard monthly cumulative update writes changes to system files on disk and requires a full reboot to load the patched code into memory. A hotpatch injects security fixes directly into the memory of running processes without writing to disk or requiring a restart. This means users experience no interruption, and the patch is active immediately after deployment. Hotpatches are generated as delta packages against the most recent full cumulative update baseline, making them smaller in download size and narrower in scope — they only touch the specific in-memory modules affected by the security vulnerabilities being addressed.
Does this change affect Windows 10 or Windows 11 Pro users?
No. Windows 10 is not eligible for hotpatch and reaches end of extended support in October 2025. Windows 11 Pro users without Intune enrolment and enterprise-tier licensing are also outside the scope of this change. Hotpatch for Windows clients is an enterprise feature requiring the management infrastructure of Intune and the licence entitlements of Windows 11 Enterprise or equivalent Microsoft 365 plans. Organisations running Windows 11 Pro should evaluate upgrading their licensing to access these security capabilities, particularly given the converging deadline of Windows 10 end of support and the May 2026 hotpatch default activation.