Windows 11 hotpatch : Intune requirement Vs only managed through WUFB services

1. For Windows 11 Enterprise hotpatch, Microsoft Intune is an explicit eligibility requirement in current documentation. Devices must be “enrolled in Microsoft Intune and Windows Autopatch Windows Quality Update policy” to receive hotpatch updates. Hotpatch is not documented as a general Windows Update for Business capability independent of Intune/Autopatch. The prerequisites for both x64 and Arm64 explicitly call out:
   • “Microsoft Intune with a Hotpatch-enabled Windows quality update policy”
   • Devices “must be enrolled in Microsoft Intune and Windows Autopatch Windows Quality Update policy for organizational IT management. Only your work devices qualify for such enrollment and, therefore, for hotpatch updates.”
2. Based on the current prerequisites, a device that meets OS, licensing, VBS, and other technical requirements but is not managed via Intune/Windows Autopatch is not described as eligible for hotpatch. The documented model is:
   • Windows 11 Enterprise 24H2/25H2 on the required baseline build
   • Eligible license (Windows 11 Enterprise E3/E5/F3, Education A3/A5, Microsoft 365 Business Premium, Windows 365 Enterprise)
   • VBS enabled
   • For Arm64, CHPE disabled
   • Managed by Microsoft Intune with a hotpatch-enabled Windows quality update policy (Windows Autopatch)
   The documentation does not describe or support deployment of Windows 11 Enterprise hotpatch updates solely via:
   • Group Policy–configured WUfB
   • Microsoft Graph / WUfB deployment service APIs (outside the Intune/Autopatch context)
   • Third‑party UEM/patch tools
   • Direct Windows Update Agent API calls
   In addition, hotpatch is explicitly stated as not available for unmanaged/non‑work devices.
3. Publicly documented controls and signals for Windows 11 hotpatch in this context are:
   • CSP/policy to disable CHPE on Arm64 so the device becomes “hotpatch ready”:
     • System Policy CSP path: ./Device/Vendor/MSFT/Policy/Config/Hotpatch/DisableCHPE = 1
     • Equivalent registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\HotPatchRestrictions = 1
   • These are used to make Arm64 devices eligible (by disabling CHPE), not to orchestrate hotpatch cadence itself.
   The context does not document:
   • A CSP or policy to globally “enable/disable hotpatch” as a servicing mode separate from Intune/Autopatch
   • APIs/CSPs to query hotpatch eligibility state, monitor hotpatch deployment/compliance, or distinguish baseline vs monthly hotpatch updates programmatically
   Baseline vs monthly hotpatch behavior is described conceptually (for example, devices rejoin hotpatch cadence after the next baseline month, and hotpatch updates are combined with the latest SSU), but no specific detection/monitoring API is provided in the referenced material.
4. In the referenced documentation, hotpatch for Windows 11 Enterprise is tied to Intune and Windows Autopatch quality update policies:
   • Eligibility requirements explicitly include Intune and Windows Autopatch.
   • Hotpatch is described as available only for work devices enrolled in Intune/Autopatch.
   There is no statement in the provided content that hotpatch is or will be a general WUfB servicing capability independent of Intune. The supported servicing architecture described here is: eligible, Intune‑managed, Autopatch‑configured devices receive hotpatch updates; unmanaged or non‑Intune‑managed devices do not.

References:

• August 12, 2025—Hotpatch KB5064010 (OS Build 26100.4851)
• September 9, 2025—Hotpatch KB5065474 (OS Build 26100.6508)
• Frequently Asked Questions about Windows Autopatch
• Understanding security updates that get installed without a restart
• March 16, 2026—Hotpatch KB5084897 (OS Builds 26200.7984 and 26100.7984) Out-of-band