Trigger a Windows 11 Feature Upgrade for an Intune-Managed Device

Upgrade a device to Windows 11 via Intune Admin Center

1. Locate the device

1. Sign in to the Microsoft Intune admin center.
2. Navigate: Devices → All devices.
3. Search for the device name (e.g. DESKTOP-8ADV83V). Open it.
4. On the device overview, record OS version, Compliance, Primary user, and Ownership.

2. Confirm or create an assignment group

1. Navigate: Groups → All groups → New group (or pick an existing group like Win11-Upgrade-Wave1).
2. Create a Security group, assigned membership, then add the target device.

3. Create the Windows Feature Update profile

1. Navigate: Devices → Windows → Windows updates → Feature updates.
2. Click + Create profile.
3. Name: e.g. Win11 23H2 - Targeted Rollout.
4. Feature update to deploy: choose a supported Windows 11 release (e.g. Windows 11, version 23H2).
5. Rollout options: Make update available as soon as possible for a single-device test, or schedule a gradual rollout for fleets.
6. Click Next.

4. Assign the profile

1. Under Assignments, click + Add groups and select the group containing the device.
2. Review + create.

5. Force a sync and verify

1. Back in Devices → All devices → {device}, click Sync.
2. On the device, open Settings → Windows Update and click Check for updates. The Windows 11 feature update should appear (allow time for Intune evaluation, typically 15–60 minutes).
3. Back in Intune, check Reports → Windows updates → Windows Feature Update Report for rollout state.

Immediate fallback: Installation Assistant

If the user needs the upgrade right now and the device is compatible, have them download and run the Windows 11 Installation Assistant on the device itself. The device stays Intune-managed after upgrade.

Drive the upgrade with Microsoft Graph

There is no “upgrade this device to Windows 11 now” endpoint. The Graph-driven pattern is: find the device → create a Feature Update profile → assign it to a group containing the device → sync.

1. Locate the device

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=deviceName eq 'DESKTOP-8ADV83V'&$select=id,deviceName,userPrincipalName,operatingSystem,osVersion,complianceState,managedDeviceOwnerType

Sample response (trimmed):

{
  "value": [{
    "id": "652ccfc3-35b7-4964-88b7-dc488b62a5b9",
    "deviceName": "DESKTOP-8ADV83V",
    "operatingSystem": "Windows",
    "osVersion": "10.0.22000.2538",
    "complianceState": "compliant"
  }]
}

2. List existing Feature Update profiles

GET https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles?$select=id,displayName,featureUpdateVersion

If the result is empty (@odata.count: 0), you need to create one.

3. Create a Windows 11 Feature Update profile

POST https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.windowsFeatureUpdateProfile",
  "displayName": "Win11 23H2 - Targeted Rollout",
  "description": "Upgrade eligible devices to Windows 11 23H2",
  "featureUpdateVersion": "Windows 11, version 23H2",
  "rolloutSettings": {
    "offerStartDateTimeInUTC": "2025-01-15T00:00:00Z",
    "offerEndDateTimeInUTC": null,
    "offerIntervalInDays": null
  }
}

Capture the returned id — you need it for assignment.

4. Assign the profile to a group

POST https://graph.microsoft.com/beta/deviceManagement/windowsFeatureUpdateProfiles/{profileId}/assign
Content-Type: application/json

{
  "assignments": [{
    "target": {
      "@odata.type": "#microsoft.graph.groupAssignmentTarget",
      "groupId": "{groupId}"
    }
  }]
}

5. Force a device sync

POST https://graph.microsoft.com/beta/deviceManagement/managedDevices/{deviceId}/syncDevice

The device will pull policy on its next check-in. Expect the Windows 11 offer to surface on the device within 15–60 minutes assuming it is compatible and there are no conflicting deferral policies.

Verification

GET https://graph.microsoft.com/beta/deviceManagement/managedDevices/{deviceId}?$select=deviceName,osVersion,lastSyncDateTime

Script the upgrade workflow in PowerShell

The script below uses the Microsoft.Graph SDK to run the full flow: resolve the device, create a Windows 11 Feature Update profile if one does not exist, assign it to a group (created or reused), and trigger a device sync.

Prerequisites

• PowerShell 7+
• Install-Module Microsoft.Graph -Scope CurrentUser
• Role: Intune Administrator (or equivalent)

Usage

.\Start-Win11Upgrade.ps1 -DeviceName "DESKTOP-8ADV83V" -FeatureUpdateVersion "Windows 11, version 23H2" -GroupName "Win11-Upgrade-Wave1"

What it does

1. Connects to Graph with the minimum required scopes.
2. Looks up the device by deviceName and prints current OS version.
3. Finds or creates the assignment group and ensures the device is a member.
4. Finds or creates a Feature Update profile for the requested Windows 11 version.
5. Assigns the profile to the group.
6. Triggers a device sync so the policy is picked up at the next check-in.

Re-run the script safely — every step is idempotent.