Keep the ESP blocking setting aligned with OOBE quality updates

Source facts

Microsoft says enabling Install Windows quality updates is insufficient if Block device use until all apps and profiles are installed is set to No. With blocking disabled, the device can leave ESP before update policies and monthly security updates are applied. The update option does not support user-targeted ESP profiles. Microsoft Learn.

Applicability

Apply this check to supported Windows 11 provisioning with the Enrollment Status Page. Identify whether the device is registered with Autopilot and review the actual device-targeted ESP assignment before relying on the update behavior.

DSE recommendation

DSE recommends reviewing both settings together in the provisioning specification. Have the endpoint owner approve the intended setup wait and the update policy that should govern it. Check the device-targeted profile that actually applies, and document the required patch outcome for delivery rather than equating an enabled checkbox with completed installation.

Verification

Provision an approved representative device and compare its installed update level with the intended policy after setup. Record the ESP profile, assignment type, blocking value and observed outcome. Investigate any early exit before issuing additional devices. Include the user-visible setup experience in acceptance so support can explain the expected wait.

Official references

Microsoft Learn: Set up the Enrollment Status Page. Source reviewed September 17, 2026.