ESP Can Control Windows Updates During OOBE

For a long time, Windows Autopilot always installed pending Windows quality updates during the first Out Of Box Experience. While this kept devices secure from day one, it also caused long provisioning times, unexpected reboots, and occasionally broken ESP flows.

With the latest Intune update, Microsoft introduced a new setting in the Enrollment Status Page that lets you decide whether Windows quality updates should run during OOBE or not. This gives you real control over the balance between security and provisioning speed.

What Actually Changed

In your ESP profile you now find the option Install Windows quality updates during OOBE.

• If enabled, Windows installs all pending quality updates before ESP completes. This can include one or more reboots.

• If disabled, updates are skipped during provisioning and the device completes ESP using the current image state. Updates are applied later based on update rings or Autopatch.

This setting currently applies to Windows 11 devices that use Device ESP.

Why This Matters in Real Life

Running updates during OOBE improves security from the first login, but it also comes with trade-offs:

• Provisioning time can increase by 20 to 40 minutes

• Reboots during ESP can confuse users

• App installations can be delayed or blocked

• Troubleshooting becomes harder because multiple processes run in parallel

On the other hand, skipping updates can leave devices temporarily unpatched after delivery.

Recommended Usage Strategy

• For remote or external device delivery, enabling updates during OOBE makes sense for security reasons.

• For corporate in-office rollouts, disabling updates often results in a faster and more predictable provisioning experience.

• Always align this setting with your Update Rings, Autopatch, and compliance requirements.

Recommendation

Decide per deployment scenario, not globally. Security-first environments may benefit from OOBE updates. High-volume rollouts usually benefit from faster provisioning and controlled patching after first login.

Stable provisioning is just as important as fast patching.

Admin context

For Microsoft admins, the practical point in ESP Can Control Windows Updates During OOBE is to treat the change as something that should be validated before it becomes tenant-wide behavior. Check the affected users, devices, assignments and support process so the Nugget turns into a controlled operational improvement instead of another undocumented setting.

Runbook notes for ESP Can Control Windows Updates During OOBE

ESP Can Control Windows Updates During OOBE deserves a little more operational context because the decision usually affects ESP update behavior. The related items are Enrollment Status Page, OOBE, Windows quality updates, update timing, Autopilot experience. Treat this Nugget as a starting point for a concrete tenant decision: who is in scope, which Microsoft portal or policy is touched, and what visible result should confirm that the configuration worked.

When validating ESP Can Control Windows Updates During OOBE, keep the test narrow enough to understand the result. Select one representative user, device, workload or subscription, capture the current state, then apply the change and compare the outcome. This avoids guessing later when support sees a different enrollment state, access result, model response, update status or admin center signal.

The most useful documentation for ESP Can Control Windows Updates During OOBE is practical rather than theoretical. Record the assignment logic, the owner, the expected monitoring view and the exception path. If the change affects users, include the wording support teams should use when they explain the behavior. If it affects devices or services, include the exact place where administrators can verify health.

For search consistency, keep the phrase ESP Can Control Windows Updates During OOBE connected to the body text, the internal links and the category context. That helps readers understand why this Microsoft admin topic belongs with the surrounding Intune, Entra, Azure, Copilot, Security or automation Nuggets, and it gives AI search systems clearer signals about the real subject of the page.

Revisit ESP Can Control Windows Updates During OOBE after the next rollout wave or Microsoft service update. Cloud behavior, licensing boundaries and portal labels can move quickly, so a short review prevents stale instructions. Confirm that the original assumption is still true, remove obsolete exceptions, and update the runbook if the operating model changed.

A clean handover for ESP Can Control Windows Updates During OOBE should also include a fallback. Write down how the team pauses the change, narrows the scope, or returns to the previous configuration if the result creates noise. This makes the Nugget safer to use in production because the implementation path includes both the happy path and the recovery path.