Empowering Self-Service Windows 11 Upgrades with Intune + BI for Intune

Enterprises face a tough balancing act when it comes to OS upgrades. Force the upgrade and risk disrupting end users — delay it and risk falling behind on supportability, security, and compliance. We’ve developed a practical middle path using Intune, PowerShell, and custom BI for Intune reporting.

A Smarter Way to Upgrade

We are deploying a PowerShell script as an available Win32 app from Intune, allowing users to kick off their Windows 11 upgrade on their own schedule — typically at the end of their workday when it will not impact productivity. The total upgrade downtime is typically around 15 minutes.

The script does more than just launch the upgrade — it actively fixes known blockers and ensures a reliable, consistent experience.

What the Script Does:

• Checks for TPM 2.0, Secure Boot, and UEFI logs the results, skips the upgrade if device is incompatible.

• Resolves common upgrade blockers such as:

  • Verifies and updates WinRE partition configuration for GPT and MBR partition styles.
  • Resizes the recovery partition if necessary.
  • Updates the WinRE image to meet Windows 10 or Windows 11 version requirements.
  • Deletes fonts and unnecessary language folders from the system reserved partition, preserving only “en-US” (modify if using a different locale).
  • Detects and removes unsigned Microsoft printer drivers that may block upgrades.
  • Clears compatibility “red reasons” from the registry and re-runs the compatibility appraiser.
  • Runs Disk Cleanup to free up space if required.

• Downloads and silently launches the Windows 11 Upgrade Assistant using serviceui.exe.

• Automatically logs all activities for troubleshooting and reporting purposes.

This method provides flexibility to users while ensuring that IT maintains full control and oversight.

👉 Get the Windows Upgrade Script
Deploy it today as an available app in Intune and empower users to upgrade on their schedule.

Why Not Just Use Update Rings?

Although Update Rings in Intune are useful for scheduled deployments, timing is highly unpredictable, particularly when trying to trigger upgrades by moving users or devices into ring-assigned groups.

In our testing:

Adding a device to a ring-assigned group could take 24 to 48 hours before the upgrade process even starts.

This delay can frustrate users and complicate project timelines. Worse, there is no guaranteed notification or tracking of exactly when the upgrade will begin.

The self-service method solves this problem by offering users an immediate installation option through the Company Portal — eliminating uncertainty and giving IT full visibility into the process.

Why Use an “Available” App Instead of “Required”?

Marking the app as available in Intune offers several advantages:

• Users initiate the upgrade when it is convenient for them.

• It avoids disrupting active work sessions and reduces unexpected reboots.

• It ensures predictable behavior compared to relying on policy timing.

• It provides a clean, transparent user experience with minimal impact to daily operations.

Custom Reporting with BI for Intune

To fully support this upgrade model, we developed a new set of reports within BI for Intune designed specifically for Windows 11 migrations.

👉 Get the BI for Intune Upgrade Reports
Track every step of your Windows 11 migration with readiness, status, office rollups, and daily progress reporting.

Key Reporting Capabilities:

Upgrade Readiness Report
View TPM, Secure Boot, CPU, and RAM compliance across all managed devices.