Microsoft demystifies how Windows updates work
Microsoft has published a guide explaining the Windows servicing model, outlining the purpose of monthly security updates, optional preview releases, hotpatch updates, and the mechanisms used to deliver new features throughout the year.
“Most individuals and organizations regularly deploy monthly security updates, released on the second Tuesday of each month. Windows also provides optional non-security preview updates, which give IT teams and early adopters an opportunity to validate upcoming fixes before they’re included in the next monthly security update,” Chris Morrissey, Senior Director of Communications at Microsoft, explained.
Patch Tuesday updates
Client and server endpoints running supported versions of Windows receive monthly security updates on the second Tuesday of each month, known as Patch Tuesday. These cumulative updates include the security and non-security content introduced in the previous month’s security update and optional non-security preview update, simplifying update management and reducing fragmentation across devices.
Windows Update automatically manages updates for consumers and small businesses. Enterprise environments can use Windows Update, Windows Autopatch, Microsoft Intune, Windows Server Update Services (WSUS), Microsoft Configuration Manager, the Microsoft Update Catalog, or third-party update management tools.
Morrissey said IT administrators can enroll devices in hotpatch updates for faster compliance. Hotpatch updates include security fixes only and install without requiring a restart. A quarterly baseline update, delivered as a regular monthly security update, requires a restart and installs all new features and enhancements. The next two monthly security updates can then be installed without requiring a restart.
Testing upcoming fixes
Optional non-security preview updates are usually released during the fourth week of the month. They give IT teams and early adopters an opportunity to test and validate upcoming fixes before they are included in the next monthly security update. These cumulative updates are available only for the latest supported versions of Windows and also provide early access to selected new features before broader deployment.
As an example, Morrissey highlighted point-in-time restore for Windows 11, a new built-in recovery capability that restores a device to a previous state. He also noted that some features are rolled out gradually, so they may not appear immediately after an update is installed.
On unmanaged devices, optional non-security preview updates are available through Settings > Windows Update > Advanced options > Optional updates. Availability on IT-managed devices depends on an organization’s update policies.
Out-of-band releases
The company releases out-of-band (OOB) updates outside the regular monthly update schedule to resolve known issues or address immediate, high-risk security concerns. Some OOB updates are optional, while others are recommended as security updates. Most are cumulative.
Enterprise environments can deploy these updates through Windows Autopatch, the Microsoft Update Catalog, and other enterprise update management tools.
Rolling out new Windows 11 features
Windows 11 receives new features, improvements, and fixes throughout the year through several update channels. Depending on the feature and an organization’s update policies, new capabilities may be delivered through the annual feature update, monthly updates, or Microsoft Store updates.
Microsoft gradually rolls out some features to monitor quality and compatibility before broader availability. It also uses Controlled Feature Rollout (CFR) to introduce new capabilities in stages. Features delivered through CFR are typically disabled by default on managed devices, allowing organizations to decide when they become available through their management controls.