{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "slug": "dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates", "url": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/" }, "title": "Keep the ESP blocking setting aligned with OOBE quality updates", "summary": "Why can Windows quality updates be missed during setup even when their ESP option is enabled?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:05+00:00", "modified_at": "2026-09-17T16:38:44+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Apply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.", "dse_recommendation": "DSE recommends reviewing both settings together in the provisioning specification.", "primary_source": { "name": "Set up the Enrollment Status Page in the admin center copy - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. Microsoft Learn.

\n

Applicability

\n

Apply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.

\n

DSE recommendation

\n

DSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.

\n

Verification

\n

Provision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.

\n

Official references

\n

Microsoft Learn: Set up the Enrollment Status Page. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. Microsoft Learn.\nApplicability\nApply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.\nDSE recommendation\nDSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.\nVerification\nProvision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.\nOfficial references\nMicrosoft Learn: Set up the Enrollment Status Page. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page).\n\n## Applicability\n\nApply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.\n\n## DSE recommendation\n\nDSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.\n\n## Verification\n\nProvision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.\n\n## Official references\n\n[Microsoft Learn: Set up the Enrollment Status Page](https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "url": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep the ESP blocking setting aligned with OOBE quality updates", "item": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "url": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/", "headline": "Keep the ESP blocking setting aligned with OOBE quality updates", "description": "Why can Windows quality updates be missed during setup even when their ESP option is enabled?", "abstract": "Why can Windows quality updates be missed during setup even when their ESP option is enabled?", "articleBody": "Source facts\nMicrosoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. Microsoft Learn.\nApplicability\nApply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.\nDSE recommendation\nDSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.\nVerification\nProvision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.\nOfficial references\nMicrosoft Learn: Set up the Enrollment Status Page. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:05+00:00", "dateModified": "2026-09-17T16:38:44+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep the ESP blocking setting aligned with OOBE quality updates" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Set up the Enrollment Status Page in the admin center copy - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page" } } ] } }