Endpoint Manager simplifies upgrades to Windows 11
Published Oct 04 2021 01:00 PM 65.1K Views
Microsoft

With the introduction of Windows 11, Microsoft Endpoint Manager is ready for you to manage your device upgrades to Windows 11 and continues to enable you to deliver quality and feature updates with the same tools. In fact, Windows 10 and Windows 11 devices can co-exist in your Windows Update policies so that you don’t have to break them out and manage them separately. This article walks through the steps and things you need to know to upgrade to Windows 11 and manage Windows updates. Another great place to get more background into planning for Windows 11 is this article by Steve Dispensa: Planning for Windows 11: best practices for organizations.

 

Common Themes

 

There are some common themes for upgrading to Windows 11 in both Microsoft Intune and Configuration Manager.  The experience is mostly the same as any other Windows 10 feature update; select the target update and assign to devices. When using Update Rings for Windows, which doesn’t have a way of selecting a target update, it’s also very simple to enable devices to upgrade to Windows 11. More details on that later in this article.    

 

Upgrading managed devices to Windows 11 requires an explicit approval from an administrator and will not upgrade without this approval when scanning for updates from Windows Update. Enterprise and Education editions will not show Windows 11 as an optional update in Windows settings either, so end users won’t be offered the option to upgrade on their own. This article describes the tools Microsoft Endpoint Manager is providing to manage which devices can upgrade to Windows 11 and when.

 

Windows 11 includes a new license agreement, which can be viewed at launch at https://www.microsoft.com/en-us/useterms/.  The license agreement is automatically accepted by an organization by submitting a policy to deploy Windows 11. Endpoint Manager includes a reminder and links to the license agreement when Windows 11 is targeted. End users will not see or need to accept the license agreement, making the upgrade process seamless. Once devices are upgraded to Windows 11, the same policies and tools can be used to keep them up to date with the latest quality updates because Windows 10 and Windows 11 share the same policies on the devices.

 

Windows 11 readiness reporting with Endpoint analytics

 

The first step in preparing for a Windows 11 upgrade is to ensure your devices meet the minimum system requirements for Windows 11. Using Endpoint analytics in Microsoft Endpoint Manager, you can easily determine which of your devices meet the hardware requirements – and if some of your devices do not meet all the requirements, you can see exactly which ones are not met.

 

If you’re already using Endpoint analytics, simply navigate to the Work from anywhere report, and then click on the Windows score category to view aggregate Windows 11 readiness information. For more granular details, go to the Windows tab at the top of the report where you’ll see device-by-device readiness information. Note that these insights require devices to be Intune-managed, co-managed, or have ConfigMgr client version 2107 or newer with your tenant attach enabled.

 

If you’re not yet using Endpoint analytics, it’s easy to get started. We recommend onboarding today as the first step in your Windows 11 deployment.

 

Feature Update Policies in Microsoft Intune

 

To upgrade devices to Windows 11 using Feature update policies in Intune, simply select the Windows 11 build from the Feature update to deploy drop down as shown in the image below.  You can also see the reminder that when a Windows 11 build is selected, submitting this policy is considered an acceptance of the License Agreement terms.

 

Figure 1: Feature update profile in Endpoint Manager for Windows 11Figure 1: Feature update profile in Endpoint Manager for Windows 11

 

 

Reporting for Feature update policies continues to work the same way. The Feature update report provides a summary of success, in-progress, and devices with errors. And the Feature update failures report under Devices -> Monitor provides specific error alerts with recommended remediations.

 

We are working on additional capabilities which will make it easier to manage your Windows 11 rollout. Soon you will have two new scheduling options beyond today’s “Start all devices now” approach. Feature update policies will be able to specify a start date for all devices which gives organizations the ability to create update rings using specific start dates for each policy and their assigned devices. This will replace the deferral options in Update rings and makes it much easier to schedule a rollout versus needing to calculate the required deferral days based on the publish date of the update.

 

Figure 2: Option to make update available on a specific dateFigure 2: Option to make update available on a specific date

 

In addition, a gradual rollout option will be available which distributes when the update is made available to the assigned devices over the specified start and end dates. This will make it easier to distribute resource loads, such as network bandwidth or even helpdesk calls. We also plan to enable you to set the number of days between new groups of devices being made available.  For example, if 100 devices are assigned to the policy, and a start date of Jan 1st is selected, and an end date of Jan 29th is selected, with 7 days between new groups of devices, then new groups will be offered each week with a total of 5 available dates. This means that every 7 days 20 more devices will receive the update on their next regular Windows Update scan.

 

One valuable point to remember is that these dates aren't necessarily the dates a device will receive the update. The update will download and install after the system approves the update in Windows Update and the next time the device scans for updates. This can vary by device based on usage, connectivity, and so on.

 

Figure 3: Gradual rollout settingsFigure 3: Gradual rollout settings

 

By default, the distribution of devices is random.  An “intelligent” distribution can be enabled by enabling the AllowWUfBCloudProcessing policy. This policy gives Microsoft processor permission under GDPR to collect device telemetry and analyze it to create a distribution plan that optimizes the rollout in order to discover potential issues as early as possible. To do this, devices are selected that maximize the variations with the fewest set of devices and places those devices early in the deployment. As the deployment continues past the first few available dates, confidence increases that the rest of the rollout will be smooth and successful.  To set the AllowWUfBCloudProcessing policy, create a Configuration profile in Endpoint Manager. Then, using the Settings catalog Profile Type, search for AllowWUfBCloudProcessing and enable that policy. Assign the same devices assigned to the Feature update policy and submit. Note that it can take 1-2 days to collect and analyze the data to intelligently optimize the device available dates, so setting this up in advance is recommended.  

 

Whether using the default or the intelligent gradual rollout, the Feature update reports will have a field available for the predicted date the update will be available to each device. This can change due to service recalculations.

 

Another feature that will make your updates to Windows 11 easier to track and manage is the addition of Safeguard holds to the Feature update failures report. Microsoft occasionally places Safeguard holds when a component (software or driver) that causes a poor experience post upgrade is detected on the device, until that issue is resolved. Safeguard holds are added as a new Alert in the Feature update failures report, and the Deployment Error Code is the Safeguard hold ID. By going to http://aka.ms/WindowsReleaseHealth, more details can be found about the issue and resolution ETA for most Safeguard Holds. By understanding which devices are prevented from receiving the feature update, and why, organizations can better understand and manage their feature update rollouts. Read more about Safeguard holds here: Safeguard holds - Windows Deployment | Microsoft Docs.

 

Using gradual rollout along with pilot, early adopter, and broad deployment rings, (http://aka.ms/WUfBDeploymentRings ) is a powerful way to configure a full organizational rollout that you can set and then monitor, and only make adjustments if issues arise that need more time to investigate before the next ring starts deployment.

 

For more information and details, please read the documentation here: https://docs.microsoft.com/en-us/mem/intune/protect/windows-10-feature-updates

 

Update Rings for Windows 

 

Coming soon to Endpoint Manager is support for updating devices to Windows 11 with Update Rings. Using Update rings is as easy as enabling the setting to Upgrade Windows 10 devices to Latest Windows 11 release, as shown below:

 

Figure 4: Update to Windows 11 setting in Update RingsFigure 4: Update to Windows 11 setting in Update Rings

 

The Upgrade to Windows 11 toggle was added to make managing the upgrade very easy.

 

One consequence of making this easy and avoiding unexpected results, is that when using Update rings devices can upgrade to only the latest Windows 11 release.  For example, if the next feature update for Windows 11 were released and named 22H2, then devices on Windows 10 assigned to this policy will be updated to Windows 11 22H2, rather than Windows 11 21H2. To specifically control which Windows 11 build a device receives, Feature update policies are recommended.

 

Similar to Feature update profiles, when the Upgrade to Windows 11 toggle is enabled, a reminder about accepting License Terms is displayed, with a link to those terms. Saving the policy settings is an acceptance of the license terms.

 

Whether the Upgrade to Windows 11 setting is enabled or not, Windows 10 and Windows 11 devices can coexist in the same policy, controlling deadline, user experience, and quality update settings, as well as future Feature update deferrals. Organizations can continue to use their existing configurations and policies to manage Windows updates without having to build out an entire new set of device or user groups and policies.

 

Microsoft Endpoint Configuration Manager

 

The upgrade process is the same as a Windows 10 to Windows 10 feature update, except now the License Agreement acceptance dialog will be shown. Since Windows 11 is a new product classification, devices will not upgrade to Windows 11 until that product is synced and a Windows 11 build is targeted to devices.

 

Once Windows 11 is published to Windows Server Update Services (WSUS) then the next time the software update synchronization occurs, the Windows 11 product classification should be available.  In the Software Update Point Component Properties, go to the Classifications tab and ensure that Upgrades is checked, and then go to the Products tab and ensure the Windows 11 product is checked.  Once you do this, the next software update synchronization will now pick up the Windows 11 upgrades. 

 

Figure 5: Option to select Windows 11 in Endpoint Configuration ManagerFigure 5: Option to select Windows 11 in Endpoint Configuration Manager

 

When you are ready to deploy the upgrade to devices, go to Software Library / Windows Servicing / All Windows Feature Updates.

 

Figure 6: Configuration Manager options to Upgrade to Windows 11Figure 6: Configuration Manager options to Upgrade to Windows 11

 

Right click the “Upgrade to Windows 11” item you want to deploy and select “Deploy”. This will guide you through the standard deployment workflow including the license agreement, upgrade package download, and settings you’ve used to deploy Windows 10 Feature updates in the past.

 

After the upgrade, all the same tools and policies you used to manage monthly quality updates and also feature updates apply.  For example, if you are using Automatic Deployment Rules or Servicing Plans, you do need to update the Classification and Products included in the rules to include Windows 11 quality and feature updates.

 

Windows 10 and Windows 11 devices can coexist with the same settings, making it easy to keep using the Windows Updates settings you’ve built over the years. As you can see, upgrading devices to Windows 11 using familiar tools helps make deployments easier to manage. Additional capabilities that are coming soon such as new scheduling options in Feature update profiles, will further simplify Windows updates.

 

As always, we want to hear from you! Tweet your feedback using the hashtag #MEMpowered. If you have questions about this article, add a comment below or reach out to @IntuneSuppTeam on Twitter. Feel free to add an idea for a new feature to UserVoice and keep up with ongoing developments on Endpoint Manager by following the Microsoft Endpoint Manager Blog  and @MSIntune on Twitter. 

 

 

24 Comments
Steel Contributor

Any timeframe for this granular control?

Iron Contributor

Hi @David_Guyer great content. QQ: is AllowWUfBCloudProcessing already enabled in Settings Catalog?

Microsoft

@Red Flag   Thank you, and it's not available quite yet, but I'm expecting it to be there when we make the gradual rollout settings available.

Copper Contributor

Thanks for the information! I have tried to create a feature update deployment policy for Windows 11 and assigned the policy to a security group with a few devices in it.

However, nothing happens on the devices. And the feature update report shows nothing as well. All devices are Windows 11 capable according to the report. 

Are delays expected? 

Copper Contributor

Same here, policy has been applied almost 24 hours ago, but test devices are still not offered Windows 11 via Windows Update (they are compatible).

Copper Contributor

Also same here. Created the simple Feature Update policy in Endpoint Manager and deployed it to a machine but nothing happens to it, no matter how many times I click "Check for updates" on it.

Grandis74_0-1633520490876.png

 

Been 24 hours here as well.

 

Devices / Monitor / Feature update failures shows the profile I created with "Devices with errors": 0.

 

Also, Reports / Windows Updates (preview) / Windows Features updates shows the "Update to Windows 11" profile with

0 Success, 0 Error, 0 In Progress, 0 Rollback Initiated, 0 Cancelled and 0 Onhold..

Grandis74_0-1633520337750.png

 

As well as the report at Windows 10 and later feature updates - Microsoft Endpoint Manager admin center

it shows no devices, as if it is not deployed to any machines..

Grandis74_0-1633520271051.png

 

Microsoft

Thank you for the reports on reports.  I am seeing the same thing in my tenant as well and our Engineering team is already taking a look.   I did see the update deliver to my test VM, so I suspect this is primarily a reporting issue, but we will get to the bottom of it either way.  

Copper Contributor

Thanks! 48 hours now and nothing delivered to my machine still. The machine is capable. This is a pure AzureAD joined machine (not hybrid).

 

Grandis74_0-1633589504542.png

 

Copper Contributor

Just to update you all, for my tenant, the Win11 update started to install on targeted machines late afternoon yesterday. Maybe there are some big delays in the roll out.

Copper Contributor

Same for us as what Marcus is reporting - we started receiving the update yesterday on the devices. Reporting is still empty, but I know there's a delay there anyway.

Microsoft

Glad that the rollout is starting for nearly everyone.   We did get a huge spike in new policies, so we are looking into whether that caused delays and how we can prevent that in the future.  We did find an issue in reporting events, and a fix is on the way.  Once the fix is deployed, you should see normal reports performance and they should be updated within 4 to 8 hours of when events are sent from the service and devices.

 

Again, thank you for the reports, it just helps us make the service better and better!

 

-David

Copper Contributor

great

Copper Contributor

Still nothing on my 2 devices. I guess I'll give it another day or two and then raise a case if it still does not work.

Thanks!

Microsoft

@Grandis74 , let's not wait to investigate this.  I reached out to you with a direct message to get some of your info so we can start investigating why devices haven't started updating yet.  I also gave a couple things that you can check to see if something can be easily fixed on your side.  Hope that helps.

 

-David

Iron Contributor

@David_Guyer Same here, created the feature update on the 5th, my two test device have not received Windows 11 update. 

 

JimmyWork_0-1633732605436.png

 

Copper Contributor

This is really strange.

I had the same problem in our tenent.

 

Ended up in deleating the policy and recreate it. Now the Pilot Devices are Upgrading :smile:

 

Hope this helps.

Iron Contributor

@Henrik Mai I tried this and one of my two test devices instantly got the update, but could not be installed due to old CPU (It was excepted not work for the device with the old CPU) But the test device that is new is not getting the Windows 11 update. 

 

Not sure if anyone here knows how I can move forward or if I should create a case with Microsoft, it's only one test device. Any registry files I can check?

 

JimmyWork_0-1633861674806.png

 

Iron Contributor

Not sure what to make of this.

Both devices same group, one device is getting it and that's the device with unsupported CPU, the device with everything supported is not getting it.

 

I'm logged into the the pilot devices with the same account not sure if that's causing an issue. 

 

JimmyWork_0-1633861512840.png

 

Brass Contributor

Do you know when the Upgrade Windows 10 devices to Latest Windows 11 toggle will be available for the Update Rings?

Microsoft

@JimmyWork ,

 

For the device that is compatible, please check that it is included in a policy that enable the Windows Update scope for Windows Health Monitoring (WHM), as described in the article above.  Otherwise, once the server has made it available and it reaches OfferReady, the client telemetry that indicates downloading, installing, success and errors is not sent or processed.  That is a common reason for not seeing progress.

 

If WHM is enabled, please reach out to me in a direct message, and I can collect some info to allow us to investigate further.

 

For the device that is not compatible with Windows 11, the deployment service doesn't know which devices are compatible, so it will attempt to offer to the the device, and that is what you are seeing with the OfferReady state.

 

HTH,

-David

Microsoft

@Rodawing ,

 

Thank you for the question.  Our expectation is to release Windows 11 support in Update Ring policies before the end of the year.  We are doing final validations now.  I do know it wasn't quite ready for the Intune 2110 release.

 

HTH,

-David

Copper Contributor

@David_Guyer

An update for the thread. Both machines in my test group got the update to Windows 11 yesterday and today. 1 week delay but here we are =)

I did not delete and recreate the policy as some others suggested. Just waited.

 

Endpoint Manager / Reports / Windows Updates (preview) also shows 2 devices in progress (bit slow. One finished Win11 fine yesterday).

 

Thank you for your support David!

 

Grandis74_0-1634104481819.png

 

Copper Contributor

@David_Guyer  beside the AllowWUfBCloudProcessing policy, does the telemetry needs to be set as well

Brass Contributor

An issue with this is delay in the Reports, where it states Scan Time... what scan is that? Upgraded machines have run multiple Windows Update scans and OMA scans but the report is still more than 24 hour out of date. It's very difficult to make use of the Reports for Feature Update rings when the data is incorrect.

Co-Authors
Version history
Last update:
‎Oct 05 2021 01:12 PM
Updated by: