Find Your Windows 10 Exposure in Intune, Device by Device

Most organizations still running Windows 10 know roughly how many devices are left. Fewer know exactly which ones, why each one hasn't moved, and what should happen to it next. That device-by-device answer is your Windows 10 exposure, and it is what decides what the next ESU year bills, which hardware needs replacing, and how long the exit takes.

If your devices are managed in Microsoft Intune, the data to answer it is already there. This post walks through where to find it, how to read it, and how to turn it into a plan.

Start With the Feature Update Device Readiness Report

Intune includes a Windows feature update device readiness report that checks each device against the version of Windows you plan to deploy. In the Microsoft Intune admin center, go to Reports > Device management > Windows updates, open the Reports tab and select Windows Feature Update Device Readiness Report. Choose the Windows 11 version you intend to roll out as the target OS, pick the scope, and generate the report.

A few things to know before you rely on it:

• It runs on demand. Nothing appears until you set the target OS and scope and select Generate. The results are cached for you only, so colleagues need to generate their own copy.
• It depends on Windows diagnostic data. The tenant setting Enable features that require Windows diagnostic data in processor configuration (Tenant administration > Connectors and tokens > Windows data) must be on, and your tenant must attest that it owns an eligible licence, such as Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5.
• It isn't real time. Devices usually upload diagnostic data once a day, and Microsoft puts the maximum end-to-end delay at about 52 hours.

Read Each Device's Status

Every device gets a readiness status for the target version. Each status points to a different next step:

• Upgraded: already on the target version or later. Nothing to do.
• Low risk: no known compatibility risks. Ready for your first upgrade waves.
• Medium risk: minor, non-blocking risks, such as apps that are removed during the upgrade. Plan to reinstall or replace those apps.
• High risk: blocking risks, such as an app that blocks the upgrade. Fix the app or driver first, then upgrade.
• Replace device: the hardware can't run the target version. The report's system requirement column shows why, for example the processor family, TPM, Secure Boot, RAM or system drive size.
• Unknown: no status could be worked out, usually because the device isn't sending Windows diagnostic data. These devices are the real blind spot, so fix their data collection first.

The companion Windows feature update compatibility risks report turns the same data around. It lists the apps and drivers that put the most devices at risk, so you can fix one application once instead of device by device. One practical tip: if you export either report to CSV, statuses appear as numbers (for example, 3 means Replace device). Microsoft publishes the mapping on the same documentation page.

Decide What Happens to Each Device

With statuses in hand, every remaining Windows 10 device should land in one of four groups:

1. Upgrade in place. Low-risk and remediated high-risk devices. With Intune and an eligible licence, use a feature update deployment that targets Windows 11, rolled out in rings (pilot, early adopters, broad). Note that feature update deferrals alone won't move a device from Windows 10 to Windows 11; you have to set Windows 11 as the target version.
2. Replace. Devices marked Replace device. Budget and schedule them now, because these are the ones most likely to drift into another ESU year.
3. Move to a Cloud PC or virtual desktop. Where a user or legacy app can't move yet, Microsoft includes Windows 10 ESU at no extra cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop. Windows 10 devices that connect to a Windows 365 Cloud PC can also be entitled to ESU, for up to three years, with an active Windows 365 licence. Our comparison of Azure Virtual Desktop and Windows 365 covers the trade-offs.
4. Pay for ESU, with an end date. Only for devices that truly can't move yet. ESU covers Windows 10, version 22H2 only, is bought a year at a time, and is cumulative: joining in Year Two means paying for Year One too. Give each of these devices a named exit date.

Keep Your Own ESU Register

One gap catches people out. Windows 10 devices that claim ESU through Windows 365 have no single device list in Intune. Microsoft's checks are per user (the Windows 10 ESU Commercial licence in the Microsoft 365 admin center) or per device (the Win10CommercialW365ESUEligible registry value, or Event ID 113 in the ClipESU log). The entitlement also has conditions. The user needs a Windows 365 Enterprise licence or a dedicated Windows 365 Flex Cloud PC. The device must be Entra joined or hybrid joined, and the user must sign in to it with the same account at least every 22 days. You also have to deploy the EnableESUSubscriptionCheck policy with Intune. So keep your own records.

So the readiness report is only half of the picture. Keep a simple register alongside it: device, owner, readiness status, chosen route (upgrade, replace, virtualize or ESU), ESU coverage and source, and exit date. Review it monthly. When the count of ESU devices reaches zero, you're done.

Turn the Count Into a Cost

Once you know how many devices sit in the ESU group, you can price the next year. Our post on what ESU Year 2 costs Canadian organizations walks through the arithmetic at Microsoft's published prices. For the wider picture of where Windows 10 stands now, see Windows 10 Support Has Ended: What to Do Before ESU Costs Double.

Check Your Windows 10 Exposure

If you'd like a second pair of eyes on the numbers, we can run through your readiness data with you, sort each remaining device into a route, and leave you with a register and an exit plan your team can work from. Check your Windows 10 exposure.