Microsoft’s June 8 Windows 11 Builds Put Updates on the User’s Clock

Microsoft pushed three new Windows 11 Insider Preview builds to the Beta and Experimental channels on June 8, 2026, and the headline change is a user setting that, until now, has not existed on the consumer side of the operating system in over a decade: the ability to extend an update pause as many times as needed from the Windows Update page. The same flight also turns Administrator Protection into a one-click Settings toggle for individual users and opens a new 26H1 build train, with build numbers in the 28000 and 28100 series, that runs on a different Windows core than the 25H2 most PCs still ship with.

Read together, the three changes move timing of Windows updates, control of admin elevation, and the path of the next annual feature update out of the hands of centralized IT and into the hands of the person sitting at the keyboard. Whether that is a net win depends entirely on whether the device is managed, and how thoroughly.

What Microsoft Shipped on June 8

Three builds landed on the same day across two rings of the Insider program. Build 26220.8575 went out to the standard Beta channel and is the one carrying the new pause control. Build 28020.2236 went out to a brand new Beta (26H1) channel, and Build 28120.2242 went out to the Experimental (26H1) channel with general improvements plus the expanded Administrator Protection rollout. Microsoft said it had no new build for the standard Experimental channel or the Future Platforms channel this week.

The exact split, taken from the Insider team post on the three June 8 builds, looks like this:

• Beta (25H2): Build 26220.8575 adds the indefinite update pause extension, fixes an audio regression introduced in recent flights, repairs the reliability of Settings › Apps › Installed Apps, and resolves freezes when interacting with Search, Notepad, and several other scenarios.
• Beta (26H1): Build 28020.2236 ships a small set of general improvements and fixes for Insiders on the new 26H1 core. No new features.
• Experimental (26H1): Build 28120.2242 ships general improvements and rolls out the ability to turn Administrator Protection on from inside Settings, with a restart required.

The Indefinite Pause, Explained

For the entire life of Windows 10 and the early years of Windows 11, the consumer pause control has had a hard ceiling. A user could pause updates for up to 35 days, and once that period expired, Windows forced the pending updates to install before the user could pause again. Tom’s Hardware noted the cap had not changed in any meaningful way since the launch of Windows 10 in 2015. Build 26220.8575 removes that ceiling.

The exact framing in the Insider post is short: “We’re adding the ability to extend update pauses as many times as you need.” A user who pauses today can, on day 36, simply extend the pause for another 35 days, and repeat the process indefinitely. There is no system-level backstop that forces a patch to install before another pause can begin.

Microsoft positioned the change as a response to years of complaints about forced restarts in the middle of meetings and gaming sessions. The first Microsoft blog that introduced the broader pause-and-restart overhaul, posted on April 24, 2026, framed the 35-day extension limit as the old constraint and the new behaviour as letting users “plan around expected travel, conferences, exams, or even just busy weeks.” The June 8 flight is the first time that broader policy has actually shipped in a test build, and it sits inside the standard Beta channel rather than a feature-gated ring.

Administrator Protection Joins the Settings Menu

The second user-facing shift in the same flight is a one-click way to turn on Administrator Protection. Until now, the feature, which forces apps to request Windows Hello authentication each time they need to elevate, was an IT administrator control. The new build puts the toggle under Settings › Privacy & security › Windows Security › Account protection, with a restart required to take effect.

The mechanism is documented on the Administrator Protection reference page: a user signs in with a deprivileged token, and when an app asks for admin rights, Windows prompts for explicit Windows Hello authentication and runs the elevated action in a hidden, profile-separated account that is destroyed when the process ends. The account that ran the elevation is logged, the application path is logged, and the outcome is logged as one of two new ETW events, 15031 and 15032, on the existing Microsoft-Windows-LUA provider.

The path here has been bumpy. The Microsoft Learn page notes that the version of Administrator Protection listed in the October 2025 non-security update, KB5067036, was reverted and is rolling out at a later date. The June 8 build is the first one that places the toggle directly in Settings for individual users; the IT-admin-controlled path had resumed earlier, according to the Insider post, but the personal-user path is new. The trade-off, called out in the same documentation, is real: workflows that depend on admin rights being always available, scheduled tasks set to run with highest privileges, and apps that assume network credentials carry into the elevated session will need to be adjusted. Single sign-on does not cross the elevation boundary.

The 26H1 Branch Splits the Windows Core

The third change in the same flight is structural, and it is the one most likely to outlive the news cycle. Microsoft officially opened a new Beta (26H1) channel based on the 28000 series and shifted the existing Experimental ring to the 28100 series, both running a build train for the next major Windows version. Insiders can swap between the two 26H1 channels through Settings › Windows Update › Windows Insider Program, and the swap is an in-place upgrade with no clean reinstall required.

The catch is that 26H1 is not a normal feature update. Microsoft’s own Windows IT Pro Blog, in a post Microsoft has linked from the Insider announcement, lays out the constraints:

• 26H1 is a “targeted release” that supports specific device silicon launching in 2026. At the moment, that means devices with Qualcomm Snapdragon X2 Series processors.
• 26H1 is not offered as an in-place update from Windows 11, version 24H2 or 25H2 on existing devices.
• Devices running 26H1 will not be able to update to the next annual feature update in the second half of 2026, because 26H1 is built on a different Windows core than 24H2, 25H2, and the upcoming feature update. Microsoft said those devices will have “a path to update in a future Windows release.”
• 26H1 does not support hotpatch updates, the mechanism that lets admin-rebound Windows devices install security patches without a reboot.
• Security updates for 26H1 will be manageable through the same tooling as the rest of the fleet, including Windows Autopatch, Microsoft Intune, and Microsoft Configuration Manager.

Tom’s Hardware, covering the first 26H1 test build earlier in the program, identified the new platform as the “Bromine” core, an upgrade from the Germanium platform that powers 25H2 and 24H2. That platform split is the load-bearing detail: a 26H1 PC and a 25H2 PC will, from the second half of 2026 onward, be on different update tracks, and one will not roll cleanly into the other.

What the Two Cores Look Like Side by Side

For most IT teams the practical question is how 25H2 and 26H1 will diverge. The published constraints from Microsoft stack up like this:

The rows above are the limits Microsoft has stated in the IT Pro explainer on what 26H1 changes for fleets, and they are the lines any procurement decision in early 2026 has to draw against. The Snapdragon X2 wave is also not arriving alone: the same Arm-based silicon category is now drawing competition from Nvidia’s RTX Spark, a 20-core Grace-based laptop chip the chipmaker unveiled at GTC Taipei, covered separately in the Nvidia RTX Spark Windows on Arm story, which means the 26H1-only branch of the Windows ecosystem will be the first Arm-only Windows line in the product’s history.

What IT Departments Now Inherit by Default

The pause extension and the Administrator Protection toggle are framed, in Microsoft’s own post, as user-friendly changes. For an unmanaged consumer PC they are exactly that. For a managed fleet, the same default behaviours land on top of whatever policy is already in place, and the April 24, 2026 announcement that introduced the broader pause-and-restart overhaul flagged this directly. The Insider post linked from the June 8 flight was explicit that the indefinite-pause behaviour is “not applicable to commercial devices where the out of box experience is being managed.” The word where does a lot of work in that sentence: any fleet member that is not fully governed by Autopilot and an Intune update ring inherits the consumer defaults.

The closure, for IT, sits in policy, not in the build. A Intune settings catalog control called Block Pause Updates Ability removes the pause control from the Windows Update page entirely, and a compliance deadline set to 3 to 5 days for quality updates forces any pending security patch to install by the deadline regardless of the user’s pause state. The point of the build is that those settings are now the only thing standing between a managed device and a user who keeps re-pausing forever. Microsoft has not yet published a hard date for when the pause-and-restart overhaul ships broadly; the company has said only that commercial rollout guidance is coming.

For end users, none of the three changes arrives today. Build 26220.8575 is in the Beta channel, the 26H1 channels are a separate program opt-in, and the May 2026 broad rollout that brings the same user-control changes to non-Insider PCs has not yet shipped. Microsoft has framed the broader rollout as coming in a future Windows update, and the existing 25H2 build train is unaffected for now.

Frequently Asked Questions

Can I pause Windows 11 updates forever right now?

Only if you are running Insider Preview Build 26220.8575 in the Beta channel. The 35-day pause ceiling has been removed in that build, and you can extend the pause end date as many times as the Settings page will let you. Microsoft has not yet confirmed the exact build number or KB that will bring the same behaviour to non-Insider Windows 11 PCs, but the change is positioned as a future update to the consumer product, not an Insider-only feature.

Is Windows 11 26H1 something I should install on my current PC?

No. Microsoft has stated that 26H1 is not offered as an in-place update from Windows 11, version 24H2 or 25H2 on existing devices. The branch exists for new hardware that ships with specific silicon, including Qualcomm Snapdragon X2 Series processors. Most Insiders are advised to stay on the default Windows core version in the Advanced options of the Windows Insider Program settings rather than specifically selecting 26H1.

How do I turn on Administrator Protection?

On a device running Insider Preview Build 28120.2242, the path is Settings › Privacy & security › Windows Security › Account protection, then flip the Administrator Protection toggle on. A restart is required for the change to take effect. Outside the Insider program, the feature is currently available only through IT administrator configuration paths such as the Intune settings catalog, group policy, or CSP, per the Microsoft Learn documentation.

Will a Snapdragon X2 PC get the next H2 2026 feature update?

No. Microsoft has stated that devices running Windows 11, version 26H1 will not be able to update to the next annual feature update in the second half of 2026, because 26H1 is built on a different Windows core than the versions that will receive the H2 release. Microsoft has described the path forward as a “path to update in a future Windows release.” For organisations standardising on 25H2 today, the IT Pro Blog is explicit that no changes to existing enterprise rollout plans are required.

Should my IT team be worried about the indefinite pause?

Only on devices that are not already fully governed by Autopilot and an Intune update ring. The Microsoft April 24 announcement that introduced the broader pause overhaul stated that the indefinite-pause behaviour is “not applicable to commercial devices where the out of box experience is being managed.” The fix is policy: enable the Intune Block Pause Updates Ability setting and set a quality update compliance deadline of 3 to 5 days, which forces the patch to install regardless of the user’s pause state.