Windows Quality Updates During OOBE Are Back Again

Starting January 2026, Windows 11 devices can again install quality updates during out of box experience when using Intune and Enrollment Status Page. This matters because this feature has already been announced, implemented, and rolled back twice and many admins stopped trusting it to actually work.

What it enables / Why this matters

Historically, OOBE finished first and patching happened later. In real tenants, devices were handed to users without the latest security updates, sometimes for days. That gap is exactly what this feature is meant to close.

The first implementation had no controls and was pulled. The second introduced controls in ESP around September, but those controls did nothing. They stayed visible in Intune, but updates still did not run during OOBE.

With the January 2026 Windows security update, the controls finally become functional. Quality updates can run during ESP and follow assigned update rings. Deferrals and pauses apply. This makes day one patch level predictable instead of theoretical.

When to use it

Use this for Autopilot based corporate devices where security state at first login matters. Typical scenarios are new hires, hardware refreshes, shared devices, or environments with strict patch compliance requirements.

It fits well when ESP is already blocking user access until required apps and policies are installed.

Do not rely on this without ESP. Devices enrolled without ESP or using Autopilot device preparation still skip updates during OOBE.

Also consider** provisioning time**. Running quality updates during OOBE increases setup duration and network usage. In low bandwidth or time critical deployments, this trade off may not be acceptable.

Recommendation

If you use ESP today, revisit this setting and test it properly. The controls are finally wired up, but only for Windows 11 22H2 and later. Treat this as a security improvement, not a default you enable blindly.

References

🔗 Microsoft Message Center MC1191345

Quality updates during OOBE are finally real, not just visible in the UI.

Admin context

For Microsoft admins, the practical point in Windows Quality Updates During OOBE Are Back Again is to treat the change as something that should be validated before it becomes tenant-wide behavior. Check the affected users, devices, assignments and support process so the Nugget turns into a controlled operational improvement instead of another undocumented setting.

Runbook notes for Windows Quality Updates During OOBE Are Back Again

Windows Quality Updates During OOBE Are Back Again deserves a little more operational context because the decision usually affects OOBE update planning. The related items are Windows quality updates, OOBE, Autopilot, deployment timing, readiness checks. Treat this Nugget as a starting point for a concrete tenant decision: who is in scope, which Microsoft portal or policy is touched, and what visible result should confirm that the configuration worked.

When validating Windows Quality Updates During OOBE Are Back Again, keep the test narrow enough to understand the result. Select one representative user, device, workload or subscription, capture the current state, then apply the change and compare the outcome. This avoids guessing later when support sees a different enrollment state, access result, model response, update status or admin center signal.

The most useful documentation for Windows Quality Updates During OOBE Are Back Again is practical rather than theoretical. Record the assignment logic, the owner, the expected monitoring view and the exception path. If the change affects users, include the wording support teams should use when they explain the behavior. If it affects devices or services, include the exact place where administrators can verify health.

For search consistency, keep the phrase Windows Quality Updates During OOBE Are Back Again connected to the body text, the internal links and the category context. That helps readers understand why this Microsoft admin topic belongs with the surrounding Intune, Entra, Azure, Copilot, Security or automation Nuggets, and it gives AI search systems clearer signals about the real subject of the page.

Revisit Windows Quality Updates During OOBE Are Back Again after the next rollout wave or Microsoft service update. Cloud behavior, licensing boundaries and portal labels can move quickly, so a short review prevents stale instructions. Confirm that the original assumption is still true, remove obsolete exceptions, and update the runbook if the operating model changed.