There’s a genuine security gap in most provisioning: a device finishes Autopilot on whatever OEM image it shipped with, hands over to the user, and only then starts pulling the latest quality update. For however long that takes, someone’s working on a machine that’s missing the current month’s fixes. Device Preparation installing the monthly security update during OOBE closes that.
How it behaves
The monthly security update (the Windows quality update) installs as part of the out-of-box experience, after the device preparation page completes. The device hands over already current instead of catching up in the background afterwards.
Two things to know before you assume it’s free:
- It typically adds 20-40 minutes to provisioning, and it can require restarts. On a fleet rollout that’s real time.
- Unlike the ESP’s “Install Windows quality updates” toggle, this can’t be disabled for Device Preparation deployments. Device Prep doesn’t use the ESP, so that setting doesn’t apply — if you’re on Device Prep, the update is happening.
The trade you’re making
It’s the right default for security: no window where a freshly provisioned device is a month behind. But it’s a straight swap of time for currency. If you provision at scale, or techs are watching a progress bar waiting to hand devices over, budget for the extra half hour and the reboot rather than being surprised by it.
Source: Microsoft Learn. Summarised independently — check the source for the latest detail.