As organizations approach the end of support for Windows 10, transitioning to Windows 11 becomes imperative to maintain security and functionality. Microsoft has provided a comprehensive guide detailing how enterprises can leverage Microsoft Intune to facilitate this upgrade, particularly for domain-joined or co-managed Windows 10 devices.
Preparation Steps:
- Hardware Compatibility Check: Ensure all devices meet Windows 11 requirements, including TPM 2.0, Secure Boot, compatible CPU, sufficient RAM, and storage. Tools like Microsoft Configuration Manager or Endpoint Analytics in Intune can assist in this assessment.
- Update Existing Windows 10 Devices: Before upgrading, confirm that all Windows 10 devices are updated to the latest version, specifically Windows 10, version 22H2. Utilize tools such as Windows Autopatch, Configuration Manager, or Windows Server Update Services (WSUS) for this purpose.
- Identity Synchronization: Install and configure Microsoft Entra Connect to synchronize users and devices from Active Directory to Microsoft Entra ID.
- Configure Hybrid Join: Use Group Policy to enable automatic hybrid join for existing devices, ensuring they are properly integrated with Microsoft Entra ID.
- Prepare Intune Environment: Verify that the Intune environment is set up with the necessary licenses and administrative roles. Ensure devices meet the minimum requirements for onboarding to Microsoft Entra ID and Intune via Windows Autopilot.
- Confirm Co-Management: Ensure devices report a healthy status in both Configuration Manager and Intune. Gradually move workloads such as Windows update policies, device configuration, and Office Click-to-Run apps to Intune for targeted groups.
- Inventory and Rationalize GPOs: Utilize Group Policy analytics in the Intune portal to assess existing Group Policy Objects (GPOs). This helps identify which policies can be migrated to Intune and which are redundant or obsolete.
- Move Workloads to Intune: Shift compliance and device configuration workloads to Intune for targeted groups. Ensure there are no conflicts between Group Policy and Intune policies by carefully managing targeting constructs.
- Consolidate and Manage from the Cloud: Replace redundant policies with Intune configuration profiles, PowerShell scripts, or supported alternatives.
- Adopt a Phased Deployment: Assign new Intune policies to pilot groups, validate results, and then scale deployment organization-wide.
- Utilize Windows Autopatch: Create and manage Windows Autopatch groups in the Intune admin center. Define deployment rings for a phased rollout and leverage default schedules for staggered upgrades.
- Monitor Progress: Use Windows Autopatch reports in Intune to track update compliance, device health, and rollout status. Export data for further analysis and integration with existing dashboards as needed.
- Assess Current Applications: Export a list of all deployed applications, including versions, dependencies, and target collections. Evaluate each application's compatibility for Intune deployment and retire obsolete software.
- Package and Test Applications: Use the Microsoft Win32 Content Prep Tool to wrap application installers for deployment via Intune. Document installation and uninstallation commands, detection methods, and test deployments on pilot devices.
- Publish and Assign Applications: Upload packages to Intune, monitor deployment status, and assign them to appropriate user or device groups. Expand deployments in phases based on feedback.
- Decommission in Configuration Manager: Remove old deployments, back up, and decommission the Configuration Manager environment.
- Update Internal Processes and Documentation: After completing the migration, update existing processes and documentation to reflect the new management approach.
- Protect User Data: Use OneDrive Known Folder Move to automatically back up desktop, documents, and pictures folders to OneDrive for Business.
- Monitor Sync Health: Utilize the OneDrive sync health report to ensure all devices are syncing successfully and address issues proactively.
- Migrate Devices: Consider a device refresh as the most cost-effective and least disruptive approach to migrate to Microsoft Entra ID. Alternative methods include issuing pre-configured Windows 11 devices joined to Microsoft Entra ID or reimaging existing hardware to Windows 11 and joining it to Microsoft Entra ID.
- Coordinate Business Processes: Plan asset management and communicate migration steps. Ensure all critical apps and data are present on new devices before handover.
- Centralized Management: Intune streamlines device lifecycle management across the organization.
- Enhanced Security: Windows 11 introduces advanced features like TPM 2.0 and Secure Boot, integrated with Microsoft security solutions.
- Optimized User Experience: Deliver faster performance and modern features tailored for hybrid work.
- Future-Ready Operations: Align the organization with cloud-first strategies and reduce on-premises infrastructure dependencies.
- Reduced Overhead: Decrease reliance on legacy infrastructure and manual processes.
- Copilot-Powered Productivity: Enable Microsoft 365 Copilot in Windows 11 to automate tasks, provide real-time insights, and offer proactive recommendations, enhancing efficiency and security in the workplace.
Source: Neowin Microsoft explains how organizations can use Intune to upgrade from Windows 10 to Windows 11
