HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Devices & Intune

How should a business plan its Windows 11 upgrade?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

Start with a readiness report to find which PCs meet Windows 11 hardware requirements, test critical apps on a pilot group, then upgrade eligible devices in waves with Intune feature update policies or Windows Autopatch. Replace ineligible hardware on a schedule, and cover any Windows 10 stragglers with Extended Security Updates only as a short bridge.

Key facts

  • Windows 10 reached end of support in October 2025; unsupported PCs no longer get security updates without ESU.
  • Windows 11 needs TPM 2.0, Secure Boot capable UEFI and a supported processor.
  • Intune Windows 11 readiness reports show which devices can upgrade.
  • Feature update policies let you target a specific Windows 11 version and stage rollout.
  • Extended Security Updates for Windows 10 are a paid bridge, not a strategy.

Where things stand

Windows 10 support ended on October 14, 2025. Devices still on Windows 10 without Extended Security Updates no longer receive security fixes, which is a risk for cyber insurance, compliance programs and plain security. Microsoft offers a commercial ESU program for Windows 10, sold yearly for a limited number of years, at a cost that rises each year.

For most businesses the priority is to finish the move to Windows 11 for supported hardware and set a replacement plan for the rest.

Step 1: hardware readiness

Use the Windows 11 readiness report in Intune Endpoint analytics or Windows Update for Business reports to check every device against the requirements. Typical blockers are older processors, TPM disabled in firmware, or legacy BIOS mode instead of UEFI.

  • Eligible now: schedule for upgrade.
  • Eligible after a firmware change: enable TPM or Secure Boot, then upgrade.
  • Not eligible: replace, prioritizing devices with sensitive data or high-risk users.
  • Specialized devices: check vendor support before upgrading.

Step 2: app and peripheral testing

Most apps that run on Windows 10 run on Windows 11, but test anyway. Focus on line-of-business apps, finance and ERP clients, security agents, VPN clients, printer and scanner drivers, and anything with a kernel driver. Ask vendors for Windows 11 support statements and versions.

Build a pilot group from IT and a few people in each department so real workflows get tested.

Step 3: deployment method

MethodBest for
Intune feature update policyCloud-managed devices; target a specific Windows 11 version with staged rollout
Windows AutopatchOrganizations that want Microsoft-managed rings and reporting
Configuration Manager task sequenceOrganizations already using ConfigMgr, especially on-site
Reset and AutopilotDevices that are also moving to Entra join
New hardware with AutopilotDevices that are not eligible or are due for refresh

Step 4: waves and communication

  • Pilot, then early adopters, then broad waves by department or site.
  • Schedule upgrades outside business hours where possible and allow deferral within a deadline.
  • Tell users what changes: Start menu, taskbar, snap layouts and any new sign-in steps.
  • Watch update compliance reports and help desk tickets after each wave before expanding.
  • Set Windows 11 security settings in Intune during the upgrade: BitLocker, Windows Hello for Business, Defender, LAPS and security baselines.

Keeping up after the upgrade

Windows 11 gets a feature update every year. Set update rings and feature update policies so devices stay on a supported version, and decide how long to lag each release. Treat the upgrade as the start of a steady servicing process, not a one-off project.

How Accred Consulting approaches it

Accred Consulting starts by pulling readiness data from Intune or your existing tools and reviewing your app list and hardware ages. The proposal sets which devices upgrade, which are replaced, the deployment method, waves, a fixed price and a timeline. Our US-based specialists configure feature update policies or Autopatch, fix firmware blockers, run the pilot and broad waves with check-ins, and set Windows 11 security baselines. At handover you get a servicing plan, reporting views and documentation, with optional support for ongoing updates.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

Only for devices that cannot be upgraded or replaced in time, such as PCs tied to a specialized app. ESU gives security fixes only, the cost rises each year, and it ends after a fixed period. Use it as a short bridge with a replacement date.
No. Copilot+ PCs add on-device AI features, but any device that meets the standard Windows 11 requirements can run it. Buy Copilot+ hardware only if those features matter to your users.
For eligible devices managed by Intune, the in-place upgrade itself runs in the background and finishes after a restart. The overall program length depends on device count, app testing and hardware replacement lead times, and is set after discovery.
Not normally. An in-place feature update keeps user files, settings and installed apps. Still, confirm OneDrive Known Folder Move is in place and test critical apps before each wave, so a rare failed upgrade is easy to recover from by reset or rollback within the rollback window.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation