Hotpatch for Windows 11 Enterprise (24H2+) delivers monthly security updates without rebooting. Managed via Windows Autopatch and Intune using a Windows quality update policy. Quarterly baselines still require a reboot, but the in-between months are reboot-free—less disruption, better compliance.

🎯 Why It Matters

• No “Restart now” interruptions: Security fixes apply silently.
• Faster compliance: Smaller payloads, quicker installs.
• Works with your rings: Hotpatch layers on top of existing update rings.

🧠 How Hotpatch Works

• Baseline month (with reboot): Full cumulative update sets the baseline.
• Two Hotpatch months (no reboot): Security-only updates apply in memory.
• Unplanned baseline: Rare, only for zero-day vulnerabilities that can’t be hotpatched.

Scope: Hotpatch covers monthly security updates. Feature updates, .NET, drivers, and firmware still require reboots.

✅ Prerequisites

• OS: Windows 11 Enterprise 24H2 or later.
• Licenses: Windows 11 Enterprise E3/E5, M365 F3/A3/A5, or Business Premium.
• Management: Intune + Windows Autopatch enabled.
• Security: Virtualization-Based Security (VBS) must be on.
• Baseline: Device must be on the latest quarterly baseline.

ARM64 note: Apply CHPE disable flag once and reboot.

🚀 Enable Hotpatch via Intune (Step-by-Step)

Step 1 – Go to Intune Admin Center
Navigate to Devices in the left menu.

Step 2 – Open Windows Updates
Under Manage updates, select Windows updates.

Step 3 – Create a Quality Update Policy

• Go to the Quality updates tab.
• Click Create, then select Windows quality update policy.

Step 4 – Configure Basics

• Enter a name for your policy.
• Click Next.

Step 5 – Configure Settings

• Under Settings, set:
  When available, apply without restarting the device (“Hotpatch”) → Allow.

• Click Next.

Step 6 – Assign Devices

• Select scope tags (or leave default).
• Assign the policy to your device groups.
• Click Next.

Step 7 – Review and Create

• Review your settings and click Create.

Tip: You can also edit an existing Windows quality update policy and set the same Hotpatch option to Allow.

🔍 User Experience

• Updates install silently.
• No reboot in Hotpatch months.
• Baseline months still prompt for restart.

🧰 Troubleshooting

• Not receiving Hotpatch?
  • Check OS version, VBS status, and baseline currency.
  • Confirm device is targeted by the policy.
• ARM64 issues?
  • Apply CHPE flag and reboot.
• Reporting gaps?
  • Review Hotpatch quality update report in Intune.

⚠️ Limitations

• Only security updates are hotpatched.
• Feature updates, .NET, and drivers still require reboots.
• Devices without VBS or latest baseline are ineligible.

Hotpatch is a simple change with a big impact: fewer reboots, happier users, and a stronger security posture. Start with a pilot group today and experience how seamless patching can be.