📚🪟💻Compliance - Device Properties - Minimal OS Version
Devices behind on patches lose access to corporate resources after a grace period.
What this policy is about
Microsoft ships Windows updates constantly. Security patches, bug fixes, new features. Users delay them, devices skip them, and suddenly your "managed fleet" is running eight different Windows versions, half of them months out of date.
This is a Device Properties compliance policy that guarantees devices run at least a minimum OS build. Too far behind? Non-compliant. Think of it as version control for Windows itself.
Running outdated Windows isn't just inconvenient, it's risky: missing security patches, unavailable defense features, apps that expect newer builds, and support nightmares when every device sits on a different patch level. Enforce a floor and you get a consistent security posture, predictable policy behavior, and support that starts from a known-good baseline.
How it works
Intune checks the device's OS build number on every compliance evaluation. Below the minimum you set, the device is flagged non-compliant, and from there you can notify the user, block access via Conditional Access, or force an update before access is restored.
Compliance settings
Device properties
| Setting | Value | What it means |
|---|---|---|
| Minimum OS version | 10.0.26100.2161 | Devices must run at least this build to be compliant |
The format is Major.Minor.Build.Revision: 10.0 is Windows 10/11, 26100 is the OS build (24H2), 2161 the patch level. The latest numbers live on Windows release health.
Actions for non-compliance
| Action | Schedule | Recipients |
|---|---|---|
| Send push notification to end user | Immediately | None |
| Mark device non-compliant | After 7 days | None |
A Semi-Annual ring that rolls out slowly, plus a compliance policy demanding a newer build now, is a conflict that locks users out. The 7-day grace gives your rings time to deliver first. Never set the minimum higher than your slowest ring can realistically reach inside the grace window.
Group assignments
- Included:
All Devices - Excluded: 🛡️🪟💻⛓️Group - Autopilot Devices - IoT, kiosks and signage run specialised images on a different cadence
- Excluded: 🛡️🪟💻⛓️Group - Autopilot Devices - W365 Boot, cloud PCs where Microsoft owns the OS updates
Store the minimum build as a SuperVision tag in the golden master. When a new baseline drops you change one value and it rolls out to every managed tenant at once, with drift detection flagging any customer that slips below the floor.