MSIgnite 2024: Hotpatch for client comes to Windows 11 Enterprise

Today we announce the public preview of hotpatch updates for Windows 11 Enterprise, version 24H2. With hotpatch updates, you can quickly take measures to help protect your organization from the evolving landscape of cyberattacks, while minimizing user disruptions. Hotpatching represents a significant advancement in our journey to help make you and everyone who uses Windows more secure and productive.

Benefits of hotpatch updates​

Hotpatch updates are scoped and provide a complete set of OS security patches. No additional features are included. They are unique in that they take effect immediately upon installation without requiring you to restart your device, helping to ensure focused, rapid protection.

Hotpatch technology already has a proven, two-year record for Windows Server. Expanding hotpatching to Windows 11 Enterprise, version 24H2 client devices offers numerous benefits:

• Devices receive the same level of security patching as the standard monthly security updates released on Patch Tuesday.
• Hotpatch updates take effect immediately and don’t require user attention.
• Users maintain productivity and security without the need for a device restart.

How does it work? A year in hotpatching​

The first month of each quarter of the calendar year (i.e. January, April, July, and October), devices install the standard monthly security update and restart. This cumulative update contains the latest security fixes, new features, and enhancements. The following two months, devices are offered hotpatch updates, which include only security updates and install without the need to restart. At the start of the next quarter, the cycle repeats.

That’s it. Devices stay secure and productive, and you reduce the number of required restarts for Windows updates from twelve to just four thanks to eight planned hotpatch updates each year!

Get started with hotpatching​

To take advantage of the public preview, your organization will need the following to be eligible for hotpatching:

• A Microsoft subscription that includes Windows Enterprise E3 or E5 (e.g. Microsoft 365 A3/A5 or Microsoft 365 F3); or a Windows 365 Enterprise subscription
• Targeted devices running Windows 11 Enterprise, version 24H2 (Build 26100.2033 or later)
• Microsoft Intune

You can enable hotpatch updates for eligible devices using a new Windows quality update policy in Intune and Windows Autopatch. Using those policies, you can opt devices in (or out) for automated hotpatch update deployment. And, good news, the quality update policy can auto-detect if your targeted devices are eligible for hotpatching. All other Windows 10 and Windows 11 devices will continue to receive the standard monthly security updates, ensuring that your ecosystem stays protected and productive.

To learn more about managing Windows updates with Windows Autopatch, see Windows quality updates.

We look forward to your feedback!​

Hotpatching joins our catalog of innovations to help unlock a new level of security and productivity in your organization. Since hotpatching requires that devices be running Windows 11 Enterprise, version 24H2, now is a great time to plan for and upgrade to Windows 11.

As you try the public preview for hotpatch updates on your eligible devices, we look forward to hearing about your experience. Your feedback directly informs service improvements before it reaches general availability. Drop us a comment below and share your thoughts, then stay tuned for more information on hotpatch updates for Windows as we roll out the public preview!