Windows 11 23H2 Support Ends November 10: What to Do in Intune

Windows 11, version 23H2 reaches end of servicing for Enterprise and Education editions on November 10, 2026. After that date, devices still on 23H2 stop getting monthly security and quality updates. For most teams this is a scheduling job, not an emergency, as long as you know which devices are affected and have a feature update policy ready.

Which devices are affected

Microsoft publishes the dates on its lifecycle pages, and they differ by edition:

• Windows 11 Enterprise and Education, version 23H2: servicing ends November 10, 2026.
• Windows 11 Home and Pro, version 24H2: servicing already ended in October 2026. Pro devices that were held on 24H2 are now past their end date.
• Windows 11 Enterprise and Education, version 24H2: supported until October 2027.
• Windows 11, version 25H2: supported until October 2027 for Home and Pro, and October 2028 for Enterprise and Education.

Mixed fleets are where this gets missed. A device's edition decides its date, so a Pro laptop and an Enterprise desktop on the same version can be on very different timelines.

Step 1: Find your 23H2 and 24H2 devices

Start with an inventory by Windows version and edition. In Intune you can filter devices by OS version and export the list, the same way we described in finding your Windows 10 exposure in Intune, device by device. Note devices that haven't checked in recently, since they're the ones most likely to be left behind.

Step 2: Set a feature update policy

Intune feature update policies let you move devices to a specific Windows version and keep them from going past it. Point the policy at 24H2, 25H2 or 26H2, depending on what your apps have been tested on. Newer versions give you a longer runway: 25H2 Enterprise and Education is supported until October 2028. A few prerequisites from Microsoft's documentation are worth checking first:

• Devices are managed by Intune and are Microsoft Entra joined or hybrid joined.
• Device telemetry is set to at least Required (and your tenant allows Intune to use Windows diagnostic data for reporting).
• The Microsoft Account Sign-In Assistant service (wlidsvc) is running.
• You have Intune Plan 1 and a Windows license that includes the Autopatch entitlement.
• Enterprise LTSC isn't supported by feature update policies. Use update rings for those devices instead.

Step 3: Check your update rings

If a device gets both a feature update policy and an update ring, the ring can quietly delay the upgrade. Microsoft recommends setting the ring's feature update deferral period to 0 and making sure feature updates aren't paused. Restart behavior, deadlines and active hours still come from the update ring, so review those settings too.

Step 4: Roll out in waves

Feature update policies support scheduled and gradual rollouts. Start with a pilot group that covers your main line-of-business apps, confirm they work, then widen the rollout. If you use Windows Autopatch, it coordinates this phasing through the same feature update policies.

Plan the next one now

Once devices are on a current version, the same policy and reports make the next upgrade routine. A short checklist of version dates by edition, reviewed each quarter, keeps end-of-servicing dates from catching you by surprise.

If you'd like a second set of eyes on your Windows 11 version mix or your Intune update policies, talk to our team.

Sources: Microsoft Learn: Windows 11 Enterprise and Education lifecycle; Windows 11 Home and Pro lifecycle; Manage Windows feature updates in Microsoft Intune.