📱 Recipe · Intune & Device Management
Check Windows Patch Status and Update Compliance for an Intune-Managed Device
Verify whether a user's workstation has received the latest Windows security updates and is running a supported OS version
Complexity
Intermediate
Impact
patch-compliance + vulnerability-management + device-support + end-of-life-os
Context
Why This Matters
Why this recipe matters
When an end user asks "Is my computer patched?" or reports concerns about a recent Patch Tuesday release, IT admins need a fast, reliable way to verify the OS build, last check-in time, and compliance state of a specific Intune-managed device. This recipe walks through the full diagnostic path: identifying the device, reading its current OS build, cross-referencing that build against Microsoft's published Windows release information, and determining whether the device is up to date — or, more critically, whether it's running a version that has reached End of Updates.
When to run this
- A user asks whether their workstation received the latest Patch Tuesday update
- You suspect a device is stuck on an unsupported OS version
- You need to triage compliance failures related to the
Minimum OS versionsetting - Monthly patch-compliance spot checks during vulnerability review
Expected Outcomes
What you'll have when you're done
- The exact OS version and build number running on the target device
- The device's last Intune check-in timestamp
- Its Intune compliance state and any failing compliance settings
- A clear determination: patched, behind on updates, or running an end-of-life OS
- A concrete next-action recommendation (sync the device, deploy a feature update, or escalate for OS upgrade)
Risks & Considerations
Warnings and gotchas
- The
deviceConfigurationStatesendpoint may return an empty array even when update policies are assigned. This happens when the device hasn't reported state back yet or when the tenant uses Windows Update for Business policies (which surface under a different endpoint). - Compliance state can be misleading. A device reporting
compliantcan still be running an unsupported OS if no Minimum OS version compliance rule exists. Always cross-check the rawosVersionagainst Microsoft's release data. - Build numbers alone don't prove patch level. You must compare against the Windows 11 release information page to know which KB a given build corresponds to.
- Do not force a feature update on a device without checking app compatibility and user notification policies first.
- Avoid sharing the user's UPN, device ID, or compliance output in tickets visible to non-IT staff — this is considered device metadata under most data-handling policies.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| DeviceManagementManagedDevices.Read.All | Read managed device inventory, OS version, and last sync timestamp |
| DeviceManagementConfiguration.Read.All | Read configuration and update policy states applied to the device |
| User.Read.All | Resolve the user's UPN to find their assigned devices |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Check patch status via the Intune admin center
Sign in to the Microsoft Intune admin center as a Global Administrator or Intune Administrator.
Navigate to:
Devices → All devices
In the search box, enter the user's name, UPN, or the device name (e.g.
DESKTOP-8ADV83V). Click the device to open its overview blade.On the Overview tab, record these fields:
- OS and OS version (e.g.
Windows 11, 10.0.22000.2538) - Last check-in
- Compliance state
- OS and OS version (e.g.
Open the Hardware tab for full device details including manufacturer/model.
Open the Device compliance tab. Review each assigned compliance policy's state and expand any that show
ErrororNon-compliantto see the failing setting.Cross-reference the OS build against the Windows 11 release information page (or Windows 10 equivalent). Confirm:
- The version (e.g. 23H2, 24H2, 25H2) is still supported
- The build number matches — or exceeds — the most recent Patch Tuesday build for that version
If the build is behind, go to:
Devices → Monitor → Windows Expedited update failures report
or
Reports → Windows updates
to see why the update hasn't installed.
If the OS version has reached End of Updates, plan a feature update: Devices → Windows → Feature updates for Windows 10 and later.
Check patch status via Microsoft Graph
Use these Graph calls in order. All endpoints below use the beta endpoint because several device-management fields are not yet in v1.0.
1. Resolve the device by user
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices
?$filter=userPrincipalName eq '{user_upn}'
&$select=id,deviceName,operatingSystem,osVersion,lastSyncDateTime,complianceState,model,manufacturerResponse shape:
{
"value": [{
"id": "652ccfc3-35b7-4964-88b7-dc488b62a5b9",
"deviceName": "DESKTOP-8ADV83V",
"operatingSystem": "Windows",
"osVersion": "10.0.22000.2538",
"complianceState": "compliant",
"lastSyncDateTime": "2026-02-12T05:14:22Z"
}]
}2. Check compliance policy states
GET /beta/deviceManagement/managedDevices/{device_id}/deviceCompliancePolicyStates3. Check configuration / update policy states
GET /beta/deviceManagement/managedDevices/{device_id}/deviceConfigurationStatesNote: $filter is not supported on this endpoint — you'll get HTTP 501 if you try. Filter client-side.
4. Interpret the OS build
Compare the returned osVersion (e.g. 10.0.22000.2538) against Microsoft's Windows release information. The relevant fields are:
| Build prefix | Windows 11 version | Status |
|---|---|---|
| 22000.x | 21H2 | End of Updates |
| 22621.x / 22631.x | 22H2 / 23H2 | Supported (23H2 current) |
| 26100.x | 24H2 | Supported |
| 26200.x | 25H2 | Supported |
A device is "patched for month N" if its build revision number meets or exceeds the build published on Patch Tuesday for month N.
Check patch status via PowerShell
The script below uses the Microsoft.Graph.DeviceManagement module. Install it once with:
Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUserWhat the script does
- Connects to Graph with the minimum required scopes
- Resolves the target user's managed device(s)
- Pulls the OS version, last sync, and compliance state
- Compares the build against a hard-coded map of current-support Windows 11 versions
- Outputs a verdict: Patched, Behind, or End-of-Life OS
Usage
.\Check-WindowsPatchStatus.ps1 -UserPrincipalName "user@contoso.com"Or run against a specific device:
.\Check-WindowsPatchStatus.ps1 -DeviceName "DESKTOP-8ADV83V"The script writes a structured report to the console and optionally exports CSV with -ExportPath.
Next steps