If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. Want to attend the May 21 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar). We look forward to helping you.
Windows Autopatch is now broadly available in Government Community Cloud (GCC). The $0 Windows Enterprise (OLS) activation SKU is no longer required for Microsoft 365 G3 and G5 SKUs in GCC. Windows Autopatch is now included with eligible Microsoft 365 GCC subscriptions. Eligible subscriptions include Microsoft 365 G3 GCC, Microsoft 365 GCC G5, and Microsoft 365 GCC G5 without WDATP/CAS Unified. When will this happen:This change is now available. How this will affect your organization:The Windows Enterprise (OLS) activation SKU is no longer required to access Windows Autopatch features in Microsoft Intune. These features include update policies for feature, quality, and driver updates, plus enhanced reporting. What you need to do to prepare:No action is required. Windows Autopatch capabilities are now available automatically in Microsoft Intune for eligible Microsoft 365 GCC subscriptions
Secure Boot certificates start expiring in June of 2026. Whether you’re actively deploying or just starting to plan, an ongoing series of AMAs is here to provide you with clear, practical answers directly from Microsoft experts. When will this happen: The next Secure Boot AMA will take place on the Microsoft Tech Community at 8:00 AM PDT on May 18, 2026. What you need to do to prepare:Visit https://aka.ms/AMA/SecureBoot and sign in to the Tech Community to post your questions in advance or in real time during the event. You’ll also find options to add the event to your calendar. Additional information:For continued guidance and updates, bookmark the Secure Boot playbook and https://aka.ms/GetSecureBoot.
The May 2026 security update is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information about the contents of this update, see the release notes, which are easily accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Highlights for the Windows 11, version 25H2 update: This security update includes improvements that were a part of update KB5083631 (released April 30, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update expands high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient suc
A new guide is here to help you troubleshoot connection issues with the Windows Update service. Some of these issues have to do with the embedded network security design. The key is in the configuration of your network endpoints for firewalls and proxies. When will this happen: While the solution isn’t new, new guidance is now published to help with ongoing troubleshooting. How this will affect your organization: By design, Windows Update doesn’t trust servers that don’t have TLS certificates issued by an actual Windows Update trust anchor. Your firewalls and proxies might block access to the trustworthy and necessary Windows Update service if your configuration is either intercepting TLS connections or isn’t passing TLS requests through for the necessary DNS subdomains. The new guide helps you diagnose and fix related issues. What you need to do to prepare: Diagnose connection issues by
Windows Update can be used to perform an in-place upgrade of Windows Server without installation media. This Windows Server feature update can help move Windows Server 2022 or Windows Server 2019 installations to Windows Server 2025, following the same process used to download monthly updates through Windows Update. Upgrading helps keep your servers secure, supported, and able to use the latest features and performance improvements. Plan your installation and learn about the in-place upgrade paths by version, prerequisites, and restrictions, at Opt-In Windows Server 2025 Feature Update from the WS 2022 and WS 2019 Settings Dialog. When will this happen:This feature update path is available now. To see the Windows Server 2025 offer in Settings > Windows Update, servers must meet these update baselines:Windows Server 2022: March 2026 Cumulative Update (KB5078766) or later. Windows Server 2
The April 2026 non-security preview update is now available for Windows 11, versions 26H1, 25H2, and 24H2. Information about the contents of this update is available from the release notes, which are accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Looking to explore upcoming features and improvements in Windows 11? Check out the Windows roadmap. It includes what’s coming to the Windows Insider Program, what’s gradually rolling out, and what’s generally available. Highlights for the Windows 11, version 25H2 update: Xbox mode is now available on Windows 11 PCs, including laptops, desktops, and tablets. Xbox mode provides a streamlined, full-screen interface that places games front and center while minimizing background activity. You can enter Xbox mode from the Xbox app, Game Bar
Simplify Microsoft Store app management with dynamic removal on more devices across your enterprise. Use policy to remove any preinstalled MSIX/APPX app by referencing its Package Family Name (PFN). It's available to Enterprise and Education devices running Windows 11, versions 25H2 and 24H2. Starting with the April 2026 Windows non-security update, you can use Group Policy or custom OMA-URI for mobile device management (MDM). Additional Microsoft Intune capabilities are coming later. When will this happen:October 2025: The policy, “Remove default Microsoft Store packages from the system”, first became available. March 13, 2026: The expanded policy became available to Windows Insiders in the Dev and Beta channels. April 2026 Windows non-security update: The expanded policy is broadly available for use with Group Policy and custom OMA-URI. Future releases: Additional Intune capabilities a
IMPORTANT:This notice is only relevant for environments where:Visual Studio 2026 with .NET version 10.0.6 is used Scan Cab is used to check for update compliance The April 2026 Scan Cab was deployed before 10:30 AM PT on April 28, 2026 An updated version of the April 2026 Scan Cab was made available at 10:30 AM PT on April 28, 2026. This Scan Cab includes new metadata corresponding to updates for Visual Studio 2026. The Microsoft update for Visual Studio 2026 released on April 28, 2026, includes additional protections to address CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability. See the Additional information section of this message for details. How this affects your organization:IT administrators who downloaded the Scan Cab before 10:30 AM PT on April 28, 2026, should re-acquire and re-deploy it if the Scan Cab is used to assess updates for environments where Visual Stud
Microsoft Defender now provides IT teams centralized visibility into Secure Boot 2023 certificate readiness across your device fleet. A new assessment categorizes your devices automatically as exposed, compliant, and not applicable. In the Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations. For exposed devices, remediation guidance is directly available through the recommendation. When will this happen:The new Secure Boot 2023 certificate assessment is now available in Microsoft Defender. June 2026: Secure Boot 2011 certificates begin expiring and need to be replaced. How this will affect your organization:When certificates expire in June 2026, devices that haven't transitioned to the newer Windows UEFI CA 2023 certificates will no longer be able to receive new security protections for the early boot process. To help organizations prepare, Microsof
Improve user experience with a single Microsoft Copilot app to use on any given device. The new RemoveMicrosoftCopilotApp policy setting allows you to uninstall Copilot from devices in your organization in a non-disruptive way. It only applies to devices and users that meet the following conditions: Microsoft 365 Copilot is also installed. Copilot wasn’t installed by the user. Copilot wasn’t launched in the last 28 days. It’s available as a Policy CSP and Group Policy. When will this happen:The policy is broadly available as of April 14, 2026. It’s part of the April 2026 Windows security update and later. How this will affect your organization:This policy simplifies the user experience by providing a single Copilot app to use on any given device. What you need to do to prepare:No action is needed if your organization prefers the default experience and allows users to use Copilot by choic
Microsoft is hosting two upcoming Ask Microsoft Anything (AMA) events focused on updating Secure Boot certificate updates across your Windows estate before certificate expirations begin in June 2026. These AMAs are designed to help you get clarity on what’s changing and how to plan for deployment across your environment. Bring your questions and get practical guidance directly from Microsoft experts. When will this happen: Secure Boot certificates on Windows devices begin expiring in June 2026. The upcoming AMAs will take place on April 23, 2026 and May 18, 2026. What you need to do to prepare:Review the Secure Boot playbook to understand requirements, affected scenarios, and available tooling, then add one or both upcoming AMAs to your calendar:Secure Boot AMA – April 23, 2026, 8:00 AM PDT Secure Boot AMA – May 18, 2026, 8:00 AM PDT Post your questions in the comments section of each pa