Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
To install monthly Windows security updates during supported Windows 11 Autopilot provisioning, enable Install Windows quality updates in the device-targeted Intune Enrollment Status Page (ESP) profile and set Block device use until all apps and profiles are installed to Yes. Configure Microsoft Defender Antivirus real-time protection and security intelligence updates separately through an Intune Antivirus policy or Settings Catalog. These controls cover different update layers; the ESP option does not update every Defender component.
Know which protection and update layer you are configuring
Windows quality updates, Defender security intelligence, Defender platform updates, cloud-delivered protection, and real-time monitoring are related but distinct. Configuring one does not automatically configure the others.
As an Amazon Associate I earn from qualifying purchases.
| Layer | What it does | Where to configure or verify it |
|---|---|---|
| Windows quality updates | Monthly Windows security update releases during supported OOBE provisioning. | Intune ESP setting Install Windows quality updates, subject to the conditions below. Microsoft Autopilot documentation |
| Defender security intelligence | Protection intelligence, also called definitions. Microsoft identifies these updates as KB2267602. | Configure the update-check interval in Defender Antivirus policy; Microsoft documents the update types and cadence. Microsoft Defender protection updates |
| Defender platform | Updates to the Defender platform, separately identified as KB4052623. | Not controlled by the ESP Windows quality-update switch. See Microsoft Defender protection updates. |
| Cloud-delivered protection | Uses cloud-delivered protection capabilities; an active internet connection is required. | Check connectivity and Defender policy independently. See Microsoft Defender protection updates. |
| Real-time protection | Defender Antivirus real-time monitoring. | Configure the real-time monitoring control in Intune Antivirus policy or the Settings Catalog. Microsoft Intune Antivirus policy settings |
Configure Windows quality updates during OOBE
- Choose the device-targeted ESP profile used by the deployment. The setting is supported for Autopilot-registered devices and for devices not registered with Autopilot when they are targeted through All Devices. User-targeted ESP profiles are not supported for this setting. See Microsoft’s Autopilot documentation.
- Enable Install Windows quality updates. New ESP profiles default to Yes; existing profiles default to No until edited. This option installs monthly security update releases in supported OOBE scenarios, not every category of Windows update. The setting and its behavior are described in the Microsoft Autopilot documentation and Autopilot change log.
- Set Block device use until all apps and profiles are installed to Yes. This keeps ESP in place while policies and monthly quality updates apply. If device use is not blocked, ESP may exit before those items have applied even though quality updates are enabled. See Microsoft’s Autopilot documentation.
- Confirm the Windows version and deployment route. The guidance applies to currently supported Windows 11 versions. Windows Autopilot device preparation does not use ESP, so this setting does not apply to that flow. With pre-provisioned Autopilot, monthly security updates are not installed during Technician Flow; the setting is honored during User Flow. See Microsoft’s Autopilot documentation.
- Review update rings and network conditions. Monthly security releases are not installed during OOBE on a metered network. Update-ring deferrals and pauses are honored, so confirm the device receives the intended ring and that its rollout settings allow installation during provisioning. See Microsoft’s Autopilot documentation.
Set Defender real-time protection and intelligence cadence separately
Use an Intune endpoint security Antivirus policy or the current Windows Settings Catalog to manage Defender Antivirus. The Intune reference for older profile formats identifies the real-time monitoring setting as AllowRealtimeMonitoring and the security intelligence update check interval as SignatureUpdateInterval. The interval accepts 0–24 hours; zero means no check for new signatures. Because the cited settings reference covers legacy profile formats, use the Settings Catalog for profiles created with the newer format and verify the exact setting shown in your tenant’s admin center. See Microsoft Intune Antivirus policy settings.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Security intelligence updates and platform updates are separate from monthly Windows quality updates. Microsoft identifies Defender intelligence updates as KB2267602 and platform updates as KB4052623. Cloud-delivered protection requires active internet connectivity and does not replace regularly receiving security intelligence updates. See Microsoft Defender protection updates.
#1 Best Overall
Sale
Microsoft Surface Laptop (2026), 13.8-inch Premium Performance Laptop, Snapdragon X2 Elite Processor, Touchscreen Display, 16GB RAM, 512GB SSD Storage, Windows 11 Copilot+ PC Built for AI, Platinum
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Plan for provisioning time and restarts
Microsoft Intune documentation states that installing monthly quality updates during OOBE adds 20–40 minutes to provisioning; a restart may also be required. Treat that range as Microsoft’s guidance, not a guaranteed duration for each device. A restart can interrupt provisioning scenarios that depend on autologon. Teams should weigh security currency at handoff against longer setup, their update-ring testing and deferral policy, and whether their deployment can tolerate a restart. See Microsoft’s Autopilot documentation and Autopilot change log.
Quick Recap
Best Value
Sale
Microsoft Surface Laptop (2026), 13.8-inch Premium Performance Laptop, Snapdragon X2 Elite Processor, Touchscreen Display, 16GB RAM, 512GB SSD Storage, Windows 11 Copilot+ PC Built for AI, Dune
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Rank #4
Sale
Microsoft Surface Laptop (2026), 15-inch Premium Performance Laptop, Snapdragon X2 Elite Processor, Touchscreen Display, 16GB RAM, 1TB SSD Storage, Windows 11 Copilot+ PC Built for AI, Black
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Rank #3
Sale
Microsoft Surface Laptop (2026), 13.8-inch Premium Performance Laptop, Snapdragon X2 Elite Processor, Touchscreen Display, 16GB RAM, 512GB SSD Storage, Windows 11 Copilot+ PC Built for AI, Black
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Rank #2
Microsoft Surface Laptop 5 13.5" Touchscreen Notebook - 2256 x 1504 - Intel Core i7 12th Gen i7-1265U - Intel Evo Platform - 16 GB Total RAM - 512 GB SSD (Platinum) (Renewed)
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Troubleshoot when updates or protection settings do not apply
- Check which device-targeted ESP profile is assigned and confirm its Install Windows quality updates value.
- Verify that the device runs a supported Windows 11 version, ESP is enabled, and Block device use until all apps and profiles are installed is Yes.
- Confirm the device is using a supported Autopilot or All Devices targeting route rather than a user-targeted ESP profile.
- Identify the deployment flow. Autopilot device preparation does not use ESP; pre-provisioning Technician Flow does not install these monthly security updates.
- Check for a metered connection, network restrictions, and whether update rings defer or pause the release.
- Inspect Defender Antivirus policy or Settings Catalog assignments separately from ESP; Windows quality-update settings do not enable Defender real-time protection or set its intelligence cadence.
- If behavior still differs from Microsoft’s guidance, investigate assignment precedence, conflicting tenant policies, network filtering, and device logs. Documentation alone cannot identify a tenant-specific cause without its configuration and logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
