Every new Windows release means a few busy weeks for my customers and me. Windows 11 version 24H2 has been generally available since October 1, 2024. Home and Pro get 24 months of servicing, Enterprise and Education get 36 months. As usual, the date matters less than how well you control the rollout. Device readiness, application compatibility and a dozen other details all play a part, so some process discipline at the start saves a lot of trouble later.

Feature update policies, rings and reports keep the 24H2 rollout under control

In almost every tenant I manage, Intune's feature update policies form the core of a controlled Windows rollout. Under Devices → Windows → Feature updates, I set which devices are eligible for 24H2 and when they get it. With these policies, deployment "rings" are easy to build. I start with IT, then move to a pilot group of business users, and roll out to production after that. Intune's Windows feature update reporting tells me which machines are current and which have stalled. The built-in "safeguard holds" also work well: they pause updates automatically for known issues such as driver conflicts until Microsoft clears them.

This diagram shows how a staged rollout usually looks in practice:

flowchart TD
  Start["Start: New Windows release available"] --> IntunePolicy["Intune feature update policy"]
  IntunePolicy --> TestRing["Test ring (IT)"]
  TestRing --> PilotRing["Pilot ring (business users)"]
  PilotRing --> MainRollout["Main rollout"]
  MainRollout --> Safeguard["Safeguard hold (compatibility)"]
  MainRollout --> Reporting["Feature update reporting"]

Figure: Staged Windows 11 24H2 rollout with Intune and safeguard logic.

When devices get stuck, I go straight to the Windows feature update report in Intune (Reports → Windows updates). It shows why an update failed, whether that's a safeguard hold, too little storage or a device declining the update, and it often includes detailed error messages. There are always a few stragglers. At least I can explain each one.

Practical tip: For each deployment wave, I keep a short log of the compatibility testing we did, particularly for important business apps and hardware. If something breaks, look at the official changelog for 24H2 first. Known issues and workarounds are often listed there, which can save you hours of troubleshooting.

Windows Autopatch handles deployment but doesn't suit every environment

More and more organizations use Windows Autopatch, especially those with Microsoft 365 E3/E5 or Business Premium licenses. Autopatch automates the entire update process. It creates the deployment rings, staggers the rollouts and gives you reporting and release controls. On paper you can set it up and forget about it. In larger or more complex environments, though, I still see admins sticking with manual Intune policies, because they want to decide exactly which devices move when and which app validations happen at each stage. The Autopatch documentation from Microsoft helps you judge whether the approach fits your estate.

Windows 11 24H2 brings a few admin changes that matter

Each Windows release comes with changes for admins, and only some of them make a difference day to day. In 24H2 I'm watching these:

  • Windows LAPS improvements, e.g. tenant registration and recovery options
  • Sudo for Windows: run specific commands with elevation (for local admins)
  • SMB signing now enforced by default on clients (stronger protection against MITM)

I find the Windows LAPS updates the most interesting. If you still haven't moved to LAPS with Intune and Entra ID, this is a good moment to do it. My practical guide walks through the setup: Windows LAPS Intune: Local admin secrets under control. The new default of mandatory SMB signing has already caused legacy problems in some tenants, mostly where very old network storage is still in use.

Compatibility testing remains essential before any rollout

A fast rollout can be tempting, but I always insist on proper compatibility testing for the important apps and hardware first. Niche line-of-business apps, VPN clients and endpoint security agents have a long history of breaking with major updates. As a rule, I run at least one full test cycle covering the core applications and every supported hardware model before anything goes past the IT ring. It also helps a lot to bring in early pilot users from different departments. If a printer driver or a scanner stops working, you hear about it while only a few people are affected.

For me, reporting matters more than speed

Rolling out Windows 11 24H2 with Intune and Autopatch is much less stressful than it was a few versions back. The key is to take your time, use the reporting tools and keep your own process documentation current. I've seen it too often: a few devices sit stuck for months because a compatibility hold or a badly configured ring quietly left them out. Control beats speed every time, and a staged, well-documented rollout with good reporting keeps admins and end users a lot happier.