Fix Intune Dynamic Group Conflicts Between Windows 10 and Windows 11 Update Rings

---

Troubleshooting Intune Dynamic Group Conflicts for Windows 10 and Windows 11 Update Rings

Managing Windows Update with Intune can be tricky when your environment contains a mix of Windows 10 and Windows 11 devices. Many organizations use Windows Update for Business (WUfB) rings to control upgrades and quality updates, but things get complicated when a device ends up in multiple update rings at the same time.

Recently, an admin raised this issue: despite configuring separate update rings for Windows 10 and Windows 11 with exclusions, some devices were not updating configurations properly. Instead, they remained in both groups, creating conflicts. Let’s unpack why this happens and how to fix it.

---

📌 The Setup

• Windows 10 Update Ring
  • Targeted using a dynamic group with this query: (device.deviceOSVersion -startsWith "10.0")
  • Intention: include only Windows 10 devices.
  • Purpose: keep them patched without upgrading to Windows 11.
• Windows 11 Update Ring
  • Devices are manually added.
  • Purpose: allow these devices to upgrade to Windows 11.
• Exclusions
  • Each group was configured to exclude the other.

Expected outcome: When a device is added to the Windows 11 group, it should automatically be excluded from the Windows 10 group.

Actual outcome: Devices ended up in both groups, creating conflicting update policies.

---

🔎 Why the Conflict Happens

At first glance, it looks like Intune exclusions aren’t working. But the issue lies in OS version reporting:

• Windows 10 devices report versions like:
  • 10.0.1xxxx
• Windows 11 devices report versions like:
  • 10.0.2xxxx

👉 Since both versions start with 10.0, the original dynamic rule device.deviceOSVersion -startsWith "10.0" matches both Windows 10 and Windows 11 devices.

This means:

• When you add a Windows 11 device to the Windows 11 group, it still qualifies for the Windows 10 group because of the broad query.
• The exclusion doesn’t help because the group logic still includes it based on the OS version string.

---

🛠️ Solutions

1. Refine the Dynamic Group Rule

The quickest fix is to adjust the dynamic query so it matches only Windows 10 devices.

Example:

(device.deviceOSVersion -startsWith "10.0.1")

This ensures:

• Windows 10 (10.0.1xxxx) devices are included.
• Windows 11 (10.0.2xxxx) devices are excluded automatically.

You can extend this logic further if you want to target specific builds (e.g., 10.0.19045 for Windows 10 22H2).

---

2. Use Intune Assignment Filters

Instead of relying only on groups, Intune filters give you more precise control over policy targeting.

• Windows 10 Filter Rule: (device.deviceOSVersion -contains "10.0.1")
• Windows 11 Filter Rule: (device.deviceOSVersion -contains "10.0.2")

Apply these filters directly to your update ring assignments:

• Assign both rings to the same larger device group.
• Let the filters determine which device gets which policy.

Advantages of filters:

• Faster evaluation than dynamic group membership.
• Reduces group management overhead.
• More flexible (can filter by OS version, manufacturer, device model, etc.).

---

3. Clean Up Group Memberships

• Use Entra ID Dynamic Group Membership Preview to verify queries and confirm devices match as expected.
• Remove stale or duplicate device objects. Sometimes an old Windows 10 record can linger even after an upgrade.
• Be aware that group membership updates are not instant — evaluation can take a few minutes to hours depending on the environment.

---

⚠️ Common Pitfalls

1. Overlapping Assignments
   • If devices belong to multiple groups without correct filters, Intune will show policy conflicts.
2. Manual Device Targeting
   • Manually adding devices bypasses some of the automation benefits of dynamic groups. If possible, rely on dynamic queries and filters.
3. Group Evaluation Delays
   • Dynamic group changes don’t take effect immediately. Don’t expect instant membership updates when exclusions apply.
4. OS Version Assumptions
   • Since both Windows 10 and 11 start with “10.0,” admins often forget to account for the second digit in the version string.

---

✅ Best Practices

• Prefer Intune Filters for OS-specific policies instead of relying only on dynamic groups.
• Validate group queries using the Entra portal preview before applying them to production policies.
• Target with broad groups + filters rather than managing many small groups. This reduces administrative overhead.
• Test with pilot rings before scaling update policies to the full organization.

---

🚀 Conclusion

This wasn’t a problem with Intune exclusions — it was a problem with how the dynamic group query interpreted OS versions. By refining queries or switching to Intune assignment filters, you can separate Windows 10 and Windows 11 devices cleanly, avoiding policy conflicts.

For admins, the key takeaway is: know your OS version strings and use filters when precision matters.

---