# Keep the ESP blocking setting aligned with OOBE quality updates

> Why can Windows quality updates be missed during setup even when their ESP option is enabled?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:05+00:00
- Modified: 2026-09-17T16:38:44+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why can Windows quality updates be missed during setup even when their ESP option is enabled?

## Potentially affected

Apply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.

## DSE recommendation

DSE recommends reviewing both settings together in the provisioning specification.

## Article

## Source facts

Microsoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page).

## Applicability

Apply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.

## DSE recommendation

DSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.

## Verification

Provision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.

## Official references

[Microsoft Learn: Set up the Enrollment Status Page](https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page). Source reviewed September 17, 2026.

## Primary reference

- Name: Set up the Enrollment Status Page in the admin center copy - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep the ESP blocking setting aligned with OOBE quality updates,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-055-keep-the-esp-blocking-setting-aligned-with-oobe-quality-updates/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.