What this check looks at
Estimates the age of every device from its model and enrolment date, checks its operating system against the vendor support window, and identifies devices that are at or approaching end of life.
Every device has two clocks running: the hardware’s useful life, and the vendor’s support for the operating system it can run. This assessment uses refresh cycles of four years for Windows laptops, iPhones and Android tablets, five for Windows desktops, Mac laptops and iPads, six for Mac desktops and three for Android phones, unless the workspace has set its own. A device is at end of life when either clock runs out: worn-out hardware, or an operating system release that no longer receives security updates and cannot be upgraded on that hardware.
This check estimates each physical device’s age from its model and enrolment date, checks its operating system against vendor support dates, and sorts devices into replace now, plan replacement (end of life within the next 12 months), update the operating system, or no action, with an indicative replacement budget. The check fails when 10 per cent or more of physical devices need replacing now; it warns when any device is at or within 12 months of end of life but fewer than 10 per cent need replacing now.
Old devices fail more often, run slowly and take helpdesk time. More importantly, a device that cannot run a supported operating system stops receiving security fixes, so every vulnerability published after that date stays open on it. Windows 10 reached end of support on 14 October 2025, and Windows 10 PCs that cannot run Windows 11 are the largest group of these in most UK small businesses.
Why it matters
Devices past their refresh cycle fail more often and slow people down, and devices that can no longer run a supported operating system stop receiving security fixes altogether. Finding them a year ahead turns an emergency purchase into a budgeted one.
A typical case: a 35-person accountancy discovers in March that eleven laptops cannot run Windows 11 and four more are seven years old. With nothing budgeted, it pays for Extended Security Updates on some and buys the rest in a rush at full price, and its Cyber Essentials renewal waits until the old machines are gone. Had the list been in the previous autumn’s budget, the replacement would have been planned and staged.
A forecast by device and year turns hardware refresh into a predictable cost, lets the MSP order in batches and schedule rebuilds, and ends the pattern of replacing devices only when they fail. Devices that only need a newer operating system can usually be updated at no hardware cost.
ISO 27001 A.8.8 (management of technical vulnerabilities) and A.5.9, CIS Controls v8 safeguard 1.1 (asset inventory), the NCSC 10 Steps on asset and vulnerability management and the NCSC CAF vulnerability management outcome expect devices to be tracked through their life and kept on supported software. NIST CSF ID.AM-08 and the Essential Eight “patch operating systems” strategy say the same.
How to fix it
Where: Intune admin centre → Devices → All devices; Reports → Windows 11 readiness
Before you start
- Share the replacement list with the client and agree a budget and order; the evidence groups devices by action and year.
Step by step
- Export the replacement plan. Take the device list from the evidence: each device’s model, operating system, estimated age, action (Replace now, Plan replacement, Update operating system) and reason, with indicative budgets at each tier. Cross-check the counts in the Microsoft Intune admin centre, Devices > All devices > Export, including model, OS version and enrolment date.
- Check Windows 11 readiness. For Windows 10 devices of uncertain eligibility, open Reports > Endpoint analytics > Work from anywhere, Windows tab, in the Intune admin centre (Endpoint analytics must be connected under its Settings), or the Windows feature update device readiness report under Reports > Windows updates. Capable devices can be upgraded; those without TPM 2.0 or a supported processor need replacing.
- Update devices that only need a newer release. For devices marked Update operating system, go to Devices > Windows updates (under Manage updates) > Feature updates > Create profile, choose the current Windows 11 release and assign it to a group containing those devices. For Macs, iPhones and iPads, use an Apple update policy under Devices > Apple updates or the declarative software update settings in the settings catalogue.
- Agree the replacement budget. Share the replacement plan with the client: devices marked Replace now, and those to budget over the next 12 months, by device class. Choose a budget tier for each class and agree an order date. Prefer models that will run the current operating system for their whole refresh cycle.
- Bridge devices that cannot be replaced at once. For Windows 10 devices that must stay in use for a few months, buy Extended Security Updates for them, or keep them away from company data by setting a minimum OS version in the compliance policy. Do not leave them both unsupported and unrestricted.
- Retire replaced devices properly. When a replacement is issued, open the old device in Intune and run Wipe (or Retire for a personal device), then Delete. If the hardware is leaving the organisation, also remove it from the Windows Autopilot devices list (Devices > Enrolment > Windows) and delete its Entra ID device record, so it stops counting in compliance and lifecycle reports.
- Confirm the plan is working. At the next assessment the number of devices under Replace now should have fallen, and the devices you updated should report a supported release under Devices > All devices in Intune.
What users will notice
Users receive replacement devices, or are asked to install an operating system update.
How to confirm it worked
The device end-of-life summary shows fewer devices under "Replace now" at the next assessment.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Patching test: supported software with security updates applied |
| NCSC CAF | B4.d Vulnerability management |
| DSPT | Standard 8: Unsupported systems |
| DORA | Art. 8 Identification of ICT assets and information |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | AM-1 Track asset inventory and their risks |
| Zero Trust | Endpoints |
| SOC 2 | CC7.1 Detecting configuration changes and vulnerabilities |
| PCI DSS 4.0.1 | 12.3.4 Hardware and software technologies are reviewed every 12 months |
| NIST SP 800-171 | 3.14.1 Identify, report and correct system flaws in a timely manner |
| CMMC Level 2 | SI.L2-3.14.1 Flaw Remediation |
| ISO 27001:2022 | A.8.8 Management of technical vulnerabilitiesA.5.9 Inventory of information and other associated assets |
| CIS Controls v8.1 | 1.1 Establish and maintain a detailed enterprise asset inventory (IG1) |
| NIST CSF 2.0 | ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles |
| NCSC 10 Steps | Asset managementVulnerability management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Windows 11 release information (Microsoft Learn)
- Windows 10 end of support (Microsoft Learn)
- Intune Windows 11 readiness report (Microsoft Learn)