Microsoft’s Intune documentation says hotpatch is enabled by default for all eligible devices. You control it in two places. The tenant setting When available, apply updates without restarting the device (“hotpatch”) covers devices that aren’t in any Windows quality update policy. A quality update policy’s own hotpatch setting overrides the tenant default for its members. A device only gets hotpatch updates if it’s on Windows 11, version 24H2 or later, has an eligible license, has virtualization-based security (VBS) running, and is on the latest baseline. Everything else gets the normal cumulative update and restart.
Facts below were checked against Microsoft Learn and the Microsoft Support hotpatch release notes on October 19, 2026. Hotpatch details change often, so check those pages before you plan a rollout.
What hotpatch is
Microsoft’s Intune hotpatch article describes hotpatch updates as Monthly B release security updates that install and take effect without a restart. They’re smaller than standard cumulative updates. They don’t replace your update rings: ring settings, deferrals, and active hours still apply.
Hotpatch only covers the monthly security update. The release notes note that OS features, firmware, or application updates might still need a restart during the quarter.
Requirements
From the Windows Autopatch hotpatch article and the Intune article:
| Requirement | Detail |
|---|---|
| OS | Windows 11, version 24H2 or later |
| License | One of: Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise |
| Baseline | The device must be on the latest baseline release |
| VBS | Must be turned on before the device is offered hotpatch updates |
| Arm64 only | CHPE must be disabled (see below) |
| Management | Intune, with hotpatch allowed by the tenant default or a Windows quality update policy |
Hotpatch has the same prerequisites as Windows quality update policies:
- Microsoft Intune Plan 1, plus a Windows license that includes the Autopatch entitlement.
- Supported clouds: public cloud and Government Community Cloud (GCC).
- For reporting, your tenant must allow Intune to use Windows diagnostic data from enrolled devices.
A device that misses any requirement isn’t stuck. Microsoft says it gets the latest cumulative update (LCU) instead, which needs a restart, and your update ring settings stay as they are.
Arm64: disable CHPE
On Arm64 devices you must disable Compiled Hybrid Portable Executable (CHPE) usage and restart once. Use the DisableCHPE policy CSP, or set this registry value:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
HotPatchRestrictions = 1 (DWORD)Microsoft warns that disabling CHPE can cause failures or performance issues for 32-bit programs, such as VBA code using Declare statements or 32-bit COM add-ins with no 64-bit version. Find those devices first. Either move the programs to 64-bit or exclude those devices from hotpatch. To go back, set HotPatchRestrictions=0 and restart. Intel and AMD devices don’t use CHPE.
Configure hotpatch in Intune
Tenant default (devices not in a quality update policy)
- In the Intune admin center, select Tenant administration > Windows Autopatch > Tenant management.
- Open the Tenant settings tab.
- Set When available, apply updates without restarting the device (“hotpatch”) to Allow or Block.
Quality update policy (overrides the tenant default)
- Select Devices > Windows updates > Quality updates tab > Create > Windows quality update policy.
- Name the policy. Under Settings, set When available, apply without restarting the device (“hotpatch”) to Allow or Block.
- Set scope tags, assign device groups, then review and create.
I’d make the decision explicit for every device group rather than rely on the tenant default. A pilot group set to Allow and a group of app-sensitive devices set to Block is easier to reason about in an incident than a default that applies to whoever isn’t in a policy.
For ring design that sits alongside these policies, see Using AI to automate Intune Windows update ring management.
The release calendar and what 2026 looked like
Microsoft’s planned model is a baseline (cumulative update, restart) in January, April, July, and October, with hotpatch months in between:
| Quarter | Baseline (restart) | Hotpatch (no restart) |
|---|---|---|
| 1 | January | February and March |
| 2 | April | May and June |
| 3 | July | August and September |
| 4 | October | November and December |
The Autopatch article adds that Microsoft occasionally releases a baseline outside this schedule for security reasons, and the planned cadence doesn’t change. For example, if June becomes a baseline, July is still a baseline.
That happened more than once in 2026. As of October 19, 2026, the Windows 11 Enterprise 25H2 release notes list:
| Month (2026) | Type | KB |
|---|---|---|
| January | Baseline | KB5074109 |
| February | Hotpatch | KB5077212 |
| March | Hotpatch | KB5079420 |
| April | Baseline | KB5083769 |
| May | Hotpatch | KB5089466 |
| June | Baseline | KB5094126 |
| July | Baseline | KB5101650 |
| August | Hotpatch | KB5120994 |
| September | Baseline | KB5124008 |
| October | Baseline | KB5127648 |
| November | Baseline (planned) | not yet published |
| December | Baseline (planned) | not yet published |
The release notes also list out-of-band hotpatch updates, for example September 14, 2026: KB5129241, OS builds 26200.9448 and 26100.9448.
Counting the planned November and December baselines, eight of the twelve months in 2026 are baseline months that need a restart, not four. If your user communication promised “a restart once a quarter,” correct it.
Two more calendar rules from Microsoft:
- In a hotpatch month, a hotpatch-enabled device that isn’t on the latest baseline gets both the baseline (restart) and the hotpatch.
- Upgrading a hotpatch device to a newer Windows version, for example 24H2 to 25H2, keeps it on hotpatch if you upgrade in a baseline month. Upgrading in a hotpatch month switches it to standard updates until the next baseline.
Monitor and troubleshoot
To see the report, go to Reports > Windows Autopatch > Windows quality updates > Reports tab > Hotpatch quality updates report.
If a device you expected to hotpatch got the LCU, work through Microsoft’s checks in order:
- Baseline and eligibility. Confirm the device is on the latest baseline and meets the requirements above.
- VBS. On the device, open System Information. Under System summary, Virtualization-based security should show Running. Autopatch also raises an alert, Hotpatch - VBS not running.
- Policy. Confirm the device’s quality update policy (or the tenant default) is Allow. On the device, Settings > Windows Update > Advanced options > Configured update policies should list Enable hotpatching when available.
- Arm64. Confirm CHPE is disabled.
- Event Viewer. Filter for
AllowRebootlessUpdates. A value of1means the device is enrolled with hotpatch turned on. - Errors. Filter the Application log for hotpatch. Microsoft says an inbox monitor service logs hotpatch health errors there. On a critical error, the device installs the standard LCU instead.
If a hotpatch causes problems, you can’t roll it back automatically. You can uninstall it and install the latest standard cumulative update, which needs a restart. For a structured way to investigate update failures, see AI-assisted root cause analysis for Windows Autopatch failures.
When a known issue’s fix ships as both a cumulative update and a hotpatch, check that hotpatched devices received the hotpatch version. The Dell Intel IPF driver KB5095093 article is one example.
FAQ
Is hotpatch on by default in Intune?
Yes. Microsoft’s Intune documentation says hotpatch is enabled by default for all eligible devices. Devices not in a quality update policy follow the tenant setting. Devices in a policy follow that policy’s hotpatch setting.
Which licenses include hotpatch?
Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise, per Microsoft’s Autopatch hotpatch article.
Does hotpatch work on Windows 10 or Windows 11 23H2?
No. Microsoft requires Windows 11, version 24H2 or later. Other devices get the standard cumulative update.
Will devices still restart for updates?
Yes, in baseline months, and in 2026 that was most months. They can also restart for OS features, firmware, or app updates. Check the release notes for the current year’s calendar.
Can I roll back a hotpatch?
Not automatically. You can uninstall it and install the latest standard cumulative update, which requires a restart.
Is hotpatch supported in government clouds?
Quality update policies list public cloud and GCC as supported. GCC High and DoD aren’t on that list.
Sources
- Use hotpatch with Windows quality updates, Microsoft Learn (updated April 29, 2026)
- Hotpatch updates (Windows Autopatch), Microsoft Learn (updated June 2, 2026)
- Manage Windows quality updates in Intune: prerequisites, Microsoft Learn
- Release notes for Hotpatch on Windows 11 Enterprise version 25H2, Microsoft Support (checked October 19, 2026)
- Policy CSP - System: DisableCHPE, Microsoft Learn