How to Upgrade to Windows 11 Using Intune During ESP: Best Practices and Common Methods

In-Depth Guide: Upgrading to Windows 11 During ESP in Microsoft Intune

The Enrollment Status Page (ESP) is a crucial phase in Microsoft Intune’s Autopilot provisioning where devices receive apps, policies, and configurations before users can access the desktop. Upgrading to Windows 11 during this phase presents unique challenges and opportunities that IT administrators need to understand.

Understanding ESP and Windows 11 Upgrades

What Is ESP?

The Enrollment Status Page serves as a gate during Autopilot provisioning. It blocks user access until all required tasks complete successfully. This includes:

• Device configuration policies
• Required applications
• Security baselines
• Compliance policies

The Windows 11 Upgrade Challenge

Traditional Windows 11 upgrades happen after ESP completes, but some organizations want to integrate the OS upgrade into the initial provisioning workflow. This approach can streamline deployment but introduces complexity.

Common Deployment Challenges

Timing and Dependencies

Windows 11 upgrades can take 30-90 minutes depending on hardware and network conditions. When combined with ESP, total provisioning time may extend to several hours, creating poor user experiences.

The upgrade process involves multiple reboots, which can interfere with ESP’s status tracking. If ESP loses connection during a reboot, it may fail or restart the entire process.

Policy Application Order

Feature updates typically rely on Windows Update for Business policies or Feature Update policies. These usually don’t trigger until after ESP completes unless specifically configured as required dependencies.

Intune applies policies in a specific order during ESP. If the Windows 11 upgrade policy isn’t prioritized correctly, it may not execute when expected.

User Experience Impact

Extended ESP sessions frustrate end users, especially new employees expecting quick device setup. Long delays can also strain help desk resources with support calls.

Some users may power off devices during lengthy upgrades, corrupting the process and requiring device re-imaging.

Deployment Approaches

Method 1: Post-ESP Upgrade (Recommended)

This traditional approach completes Autopilot provisioning on the existing OS first, then applies the Windows 11 upgrade afterward.

Advantages:

• Shorter ESP duration maintains good user experience
• Reduced risk of ESP failures
• Updates happen in background after user starts working
• Easier troubleshooting when issues occur

Configuration Steps:

1. Configure ESP to exclude Feature Updates from required apps
2. Create Feature Update policy targeting Windows 11
3. Set deployment timeline allowing gradual rollout
4. Monitor update compliance through Intune reporting

Method 2: Pre-Provisioning with Windows 11 Media

Deploy devices with Windows 11 already installed to eliminate in-place upgrades entirely.

Advantages:

• No upgrade delays during ESP
• Consistent user experience across devices
• Eliminates upgrade-related failures

Requirements:

• Updated device imaging process
• Windows 11 licensing verification
• Hardware compatibility validation

Method 3: Custom Win32 App Approach

Package the Windows 11 upgrade as a Win32 application within ESP.

Implementation:

1. Create Win32 app package containing upgrade installer
2. Configure as required application in ESP
3. Set appropriate detection rules and requirements
4. Handle reboot scenarios properly

Challenges:

• Complex packaging requirements
• Difficult status reporting during reboots
• High risk of ESP timeouts
• Limited rollback options if upgrade fails

Technical Considerations

Hardware Compatibility

Before attempting ESP-based upgrades, verify all devices meet Windows 11 requirements:

• TPM 2.0 chip
• UEFI firmware with Secure Boot
• Compatible CPU from Microsoft’s list
• Sufficient RAM and storage

Use Intune’s hardware readiness reports to identify incompatible devices before deployment.

Network and Bandwidth

Windows 11 upgrade files are several gigabytes in size. Consider:

• Available bandwidth at deployment locations
• Network prioritization for upgrade traffic
• Offline media options for remote locations
• Staging servers to reduce internet bandwidth usage

Monitoring and Logging

Implement comprehensive logging to track upgrade progress:

• Windows Update logs for troubleshooting
• ESP status monitoring through Intune
• Custom event logs for Win32 app deployments
• User communication templates for status updates

Best Practices and Recommendations

Pilot Testing

Always test ESP-based upgrades with a small pilot group before broad deployment:

• Test various hardware models and configurations
• Measure actual provisioning times
• Document common failure scenarios
• Gather user feedback on experience

Fallback Strategy

Develop clear procedures for handling failed upgrades:

• Automated rollback mechanisms where possible
• Manual recovery steps for IT support
• Device re-imaging procedures as last resort
• Communication templates for affected users

Policy Sequencing

If proceeding with ESP-based upgrades, carefully sequence policies:

1. Critical security configurations first
2. Windows 11 upgrade before user-specific apps
3. User applications and personalization last
4. Non-critical policies after ESP completion

Communication Planning

Keep users informed throughout extended provisioning:

• Clear messaging about expected wait times
• Progress indicators where possible
• Help desk contact information
• Alternative device options if needed

Alternative Recommendations

For most organizations, the post-ESP upgrade approach provides the best balance of reliability and user experience. Consider ESP-based upgrades only when:

• Devices must have Windows 11 before first use
• Compliance requirements mandate specific OS versions
• Users won’t have consistent network access post-deployment

Organizations with strong technical capabilities and extensive testing resources may find success with custom Win32 app approaches, but this requires significant investment in packaging, testing, and support processes.

The simplest and most reliable approach remains deploying devices with Windows 11 pre-installed, eliminating upgrade complexity entirely while providing optimal user experiences during Autopilot provisioning.