Important changes to the Windows enrollment experience coming soon

Windows Updates are essential to keeping your devices secure and up to date with the latest security, performance, and stability improvements. One of the most common customer requests is to enable Windows Updates during provisioning in the Out-of-Box Experience (OOBE), ensuring that devices are fully patched and ready to use as soon as they enroll in Mobile Device Management (MDM).

In the coming weeks, the Windows MDM enrollment experience will be updated to automatically enable quality updates during OOBE. Quality updates are monthly updates that provide security and stability fixes and improvements to existing features. These updates are critical to the performance and security of your device and we want to make them available to you as soon as possible. Not all monthly quality updates will be available through OOBE. Microsoft determines the availability of these updates based on the value of the update and its relevance to your device setup situation.

What’s changing?

With the upcoming October Windows Update, all Windows 11, version 22H2 and later devices enrolled in MDM (e.g., Microsoft Intune) will automatically download and install quality updates during OOBE. This applies to all MDM-enrolled devices, regardless of whether they were pre-enrolled in Windows Autopilot. Updates are applied before the user reaches the desktop, ensuring that the device is fully patched before signing in.

The new experience is as follows:

1. After your device connects to the Internet and checks for updates, if a good update is available, the device’s Updates page will display a message that an update is available and being installed.
2. The device will then download and install the quality update in the background while displaying the installation progress.
3. Once the update is installed, the device will restart and continue to the desktop. The user will then log in to the device and the device will complete enrollment.

This change only applies to quality updates. Feature updates, which are major updates that introduce new features, and driver updates that provide hardware-related fixes or improvements, are not applied during OOBE but are managed by MDM as per policy.

Influence and what it means to you

While we believe these changes will improve your Windows enrollment experience and make your devices more secure and reliable, we also want to make you aware of the potential impact and what to prepare for.

Additional time for OOBE

Installing quality updates during OOBE will add some additional time to the device setup process, depending on when the device was most recently updated, internet speed, and device capabilities. We recommend that you communicate this additional time to your vendors and customers and plan accordingly for your device deployment scenarios.

Organizations that use temporary passwords

If the installation takes additional time, use Temporary Access Pass (TAP), the passcode may expire before the user logs into the desktop. To prevent this, it is recommended to extend the temporary password validity period during registration.

summation

If a Windows Update for Business (WUfB) policy that blocks or delays updates is applied to the device before it reaches the New Device Update Page (NDUP), the update may not start. This can happen especially if the Enrollment Status Page (ESP) is significantly delayed due to app installations.

There is currently no option to control or disable quality updates during OOBE. As mentioned earlier in this blog, we are looking into making all monthly quality updates available and manageable during OOBE to provide the best overall experience.

We hope this change will improve your Windows Autopilot experience and make your device more secure and reliable. If you have any feedback or questions, please let us know in the comments or contact us via X. @IntuneSoupTeam.