First, we should notice the update installed from 'check online for MS Updates' is same as from SCCM.
If so, the above situation occurs, it seems that there is scanning wrong between SCCM server and client. We should check if any error in UpdatesHandler.log, it records details about software update compliance scanning and about the download and installation of software updates on the client.
What could explain this? I am concerned that if I trust SCCM to tell me my clients are "compliant", yet in reality they don't have the patch installed unless manually check for updates, this could be trouble. Maybe there is some explanation for this?
Under normal circumstances, if the update is required by these clients, those computers will be listed in the list of "required" for the the patch.
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Sorry for the late response. Thank you for your explanation. I am testing an ADR to push all required updates out to clients.
Thanks for your update, here is the Microsoft doc about ADR, hope it can help you.