How to find unsupported Windows versions in Intune

Before you start

Use an account that can read Intune devices and view reports; the built-in Read Only Operator role can do both and change nothing. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

Which versions are supported changes as Microsoft ends each one: check its Windows 11 and Windows 10 release information pages for today's list. Windows 11 feature updates get 24 months of support for Home and Pro editions and 36 months for Enterprise and Education. Only Windows devices enrolled in Intune appear. The examples read and export; they change nothing.

Option 1

Find unsupported Windows versions with PowerShell

Install the modules once, then connect and export the Windows devices whose build, the third part of the OS version, is not in your list.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    # Builds Microsoft still updates for at least 1 edition. Replace from the release pages.
    $inSupport = '28000', '26300', '26200', '26100', '22631'
    $names = @{
        '28000' = 'Windows 11 26H1'; '26300' = 'Windows 11 26H2'; '26200' = 'Windows 11 25H2'
        '26100' = 'Windows 11 24H2'; '22631' = 'Windows 11 23H2'; '22621' = 'Windows 11 22H2'
        '22000' = 'Windows 11 21H2'; '19045' = 'Windows 10 22H2'; '19044' = 'Windows 10 21H2'
    }
    $props = 'id', 'deviceName', 'userPrincipalName', 'operatingSystem', 'osVersion',
        'lastSyncDateTime', 'serialNumber'
    $devices = Get-MgDeviceManagementManagedDevice -All -Property $props
    $windows = @($devices | Where-Object { $_.OperatingSystem -eq 'Windows' })
    $report = @($windows | ForEach-Object {
        $parts = $_.OsVersion -split '\.'
        $build = [string]$parts[2]
        if ($build -notin $inSupport) {
            $version = 'Unknown'
            if ($build) { $version = "Build $build" }
            if ($names.ContainsKey($build)) { $version = $names[$build] }
            [pscustomobject]@{
                DeviceName        = $_.DeviceName
                UserPrincipalName = $_.UserPrincipalName
                WindowsVersion    = $version
                OsVersion         = $_.OsVersion
                LastSyncDateTime  = $_.LastSyncDateTime
                SerialNumber      = $_.SerialNumber
                Id                = $_.Id
            }
        }
    } | Sort-Object WindowsVersion, DeviceName)
    if ($windows.Count -eq 0) {
        Write-Output 'No Windows devices are enrolled in Intune.'
    } elseif ($report.Count -eq 0) {
        Write-Output "All $($windows.Count) Windows devices are on a version in your list."
    } else {
        $report | Export-Csv -Path './unsupported-windows.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($windows.Count) Windows devices are outside your list."
        $report | Group-Object WindowsVersion | Sort-Object Count -Descending |
            Select-Object Count, Name
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The list holds the builds Microsoft's release information pages showed as current on 5 October 2026. Replace it when Microsoft adds or ends a version, and remove a build once the editions you run have ended: on that date Windows 11 23H2 had ended for Home and Pro and ran to 10 November 2026 for Enterprise and Education. LastSyncDateTime is the last successful sync, so an old date means the version may be out of date.

Option 2

Review unsupported versions in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Reports > Windows Updates, open the Reports tab and select Windows Update Distribution Report, then choose 1 or more scope tags to generate it.
3. Select 1 of the quality updates at the top of the list to open the QU distribution per feature version report.
4. Select the device count on the single line for unsupported, insider and unknown versions, where Build Number reads Not applicable, to open the QU device version list.
5. Read OS version, Windows feature version and Last check-in, and use the list's export option to download a CSV file.

The report only reads, and Intune caches it for 3 days: select Generate Again for fresh data. This suits a quick count for 1 tenant, but it puts unsupported, insider and unknown versions on 1 line and does not rate the result.

Common questions

What does Unsupported for Home/Pro mean?

The build's Home and Pro editions have reached end of updates, but its Enterprise and Education editions have a later date that has not passed. Altivane sets the status from the build alone, so Enterprise devices on that build are listed too. Read SKU, then take that edition's date from Windows Version Distribution.

Does Extended Security Updates make Windows 10 supported?

Not in these results. Extended Security Updates is a paid Microsoft subscription that keeps security updates coming to enrolled Windows 10 22H2 PCs after its end of support on 14 October 2025, for up to 3 years for an organisation. The script and Altivane work from the build and do not check enrolment, so a Windows 10 22H2 device is listed either way.

Why does a device I updated still show an old version?

Intune holds the version each device reported at its last check-in, so a device that has not synced since the update still shows the old one. Check LastSyncDateTime or Last Sync, and see how to find stale devices.