What this check looks at
Lists devices running an operating system release that no longer receives security updates from its vendor, including devices whose hardware cannot move to a supported release.
Every operating system release has a date after which its vendor stops publishing security updates. Windows 10 ended on 14 October 2025 (Extended Security Updates aside); each Windows 11 annual release is supported for 24 months on Home and Pro and 36 months on Enterprise and Education; Apple patches the latest iOS and macOS releases fully and older macOS releases only partly; Android support depends on the manufacturer. Some hardware cannot move to a supported release at all.
This check matches each physical device’s operating system and release against the vendor’s support dates and lists devices whose release is past end of support, including those whose hardware cannot run a supported release. The check fails when any device runs an unsupported operating system. The evidence says for each device whether it only needs an update or must be replaced.
An unsupported operating system never gets another security fix, so every vulnerability published after its end date, including those already being exploited, stays open on that device for good. Attackers scan for and target unpatched systems, and one unsupported laptop used for email and SharePoint is a foothold into everything its user can reach.
Why it matters
A device on an unsupported operating system gets no security fixes, so every newly published vulnerability stays open on it for good. Cyber Essentials requires such devices to be updated, replaced or removed from scope, and insurers increasingly ask the same.
A typical case: a 40-person builders’ merchant keeps six Windows 10 PCs at the trade counter after October 2025 because they still work. A Windows privilege-escalation flaw that is being exploited in the wild is fixed for Windows 11 but not for those PCs; one is infected through an email attachment, the attacker uses the flaw to take full control and harvests saved credentials, and the Microsoft 365 tenant follows. The firm also fails its Cyber Essentials renewal, which its insurer and two public-sector customers require.
Cyber Essentials requires all software in scope to be supported by its vendor, with high and critical security updates applied within 14 days; unsupported devices must be replaced, removed or segregated out of scope. Cyber insurance proposals increasingly ask the same question.
CIS Controls v8 safeguards 2.2 (authorised software is supported) and 7.3 (automated operating system patch management), ISO 27001 A.8.8, the NCSC 10 Steps on vulnerability management and the NCSC CAF vulnerability management outcome all require it. NIST CSF ID.AM-08 and the Essential Eight “patch operating systems” strategy, which expects unsupported operating systems to be replaced, say the same.
How to fix it
Where: Intune admin centre → Devices → Windows updates / Update policies
Before you start
- Check whether each device can take the current release (Windows 11 needs TPM 2.0 and a supported processor).
- For devices that cannot, budget their replacement.
Step by step
- Split the list into update and replace. Take the device list from the evidence: devices marked Update operating system can move to a supported release; devices marked Replace now cannot (for example Windows 10 PCs without TPM 2.0 or a supported processor, or phones the manufacturer no longer updates).
- Confirm Windows 11 eligibility. For Windows devices, check eligibility in the Microsoft Intune admin centre under Reports > Endpoint analytics > Work from anywhere (Windows tab), or in the Windows feature update device readiness report under Reports > Windows updates. Move ineligible devices to the replace list.
- Deploy the supported Windows release. Go to Devices > Windows updates (under Manage updates) > Feature updates > Create profile, select the current Windows 11 release, and assign it to a group containing the devices to update. Check the update ring assigned to them (Update rings tab) does not pause or defer feature updates indefinitely, and follow progress in Reports > Windows updates.
- Update Apple and Android devices. For Macs, iPhones and iPads, create an update policy under Devices > Apple updates, or use the declarative software update settings in the settings catalogue, that installs the latest release by a deadline. Android phones the manufacturer no longer updates cannot be fixed by Intune; plan their replacement.
- Keep unsupported devices away from company data meanwhile. Set a minimum OS version in each platform’s compliance policy (Devices > Compliance > Policies) to the oldest supported release. Devices below it become not compliant, and a Conditional Access policy that requires a compliant device then blocks them from Microsoft 365 until they are updated or replaced. Tell users first.
- Replace what cannot be updated. Raise the purchase for devices that cannot run a supported release, using the replacement plan in the device end-of-life finding. When the new devices are issued, wipe, retire and delete the old ones in Intune and remove their Entra ID records.
- Confirm every device is supported. In Devices > All devices, filter or sort on OS version: every remaining device should report a supported release. The finding clears at the next assessment.
What users will notice
Users have their device upgraded or replaced.
How to confirm it worked
The listed devices report a supported release in Intune at the next check-in.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Security update management |
| Cyber Essentials Plus | Patching test: supported software with security updates appliedSecurity update management |
| NCSC CAF | B4.d Vulnerability management |
| DSPT | Standard 8: Unsupported systems |
| DORA | Art. 9(4)(f) Patches and updates |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | PV-6 Rapidly and automatically remediate vulnerabilities |
| Zero Trust | Endpoints |
| SOC 2 | CC7.1 Detecting configuration changes and vulnerabilities |
| PCI DSS 4.0.1 | 6.3.3 Known vulnerabilities are patched12.3.4 Hardware and software technologies are reviewed every 12 months |
| NIST SP 800-171 | 3.14.1 Identify, report and correct system flaws in a timely manner |
| CMMC Level 2 | SI.L2-3.14.1 Flaw Remediation |
| ISO 27001:2022 | A.8.8 Management of technical vulnerabilities |
| CIS Controls v8.1 | 2.2 Ensure authorized software is currently supported (IG1)7.3 Perform automated operating system patch management (IG1) |
| NIST CSF 2.0 | ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles |
| NCSC 10 Steps | Vulnerability management |
The framework mappings were last checked against the published standards in October 2026.
Further reading
- Windows release health (Microsoft Learn)
- Cyber Essentials requirements (NCSC) (NCSC)