How to Deploy the Windows 11 25H2 Feature Update via Intune
Microsoft has officially released Windows 11, version 25H2, and many admins are eager to roll it out across their fleets using Intune. But as reported in the Intune community, some admins are running into problems where devices simply don’t receive the update—even though policies appear to be configured correctly.
Here’s a breakdown of the issue, what’s causing it, and how to fix it.
The Problem
- Admins have set up Feature Update policies in Intune to move devices to Windows 11 25H2.
- Most devices are Windows 11 Pro running under Microsoft 365 Business Premium licenses.
- Despite correct-looking settings, devices aren’t getting the update.
Community responses confirm this isn’t an isolated case—multiple organizations are seeing the same behavior.
What’s Causing It?
The main culprit is often the update ring deferral period in Intune.
- If your update ring is set with a feature update deferral period (for example, 120 days), that value overrides the Feature Update policy.
- This means devices will wait for months, even if you’ve configured the Feature Update policy to install 25H2 immediately.
Microsoft’s documentation makes it clear:
👉 For Feature Updates via Intune, set the deferral period to 0 days.
Other Things to Check
Even if you set the deferral to 0, a few more items may prevent deployment:
- Hardware Requirements
- Devices must meet the minimum spec (e.g., 8th-gen Intel CPU or newer, TPM 2.0, Secure Boot).
- Unsupported devices won’t receive 25H2, no matter what your policy says.
- OOBE (Out-of-Box Experience) Updates
- Some admins report devices upgrading unexpectedly during OOBE.
- To prevent this, you can set a Target Release Version through Group Policy (gpedit.msc) or via registry keys/scripts.
- AutoPatch Reliability
- Windows Autopatch is designed to simplify update rollouts but has been inconsistent for some admins when initiating feature updates.
- Conflicting Policies
- Registry entries or GPO settings left behind from other patching tools (WSUS, ConfigMgr, third-party solutions) can block Intune’s update policies.
- Always check for stale registry values and remove conflicts.
Fixes and Workarounds
To ensure 25H2 deployment works smoothly, follow these best practices:
- ✅ Set Feature Update deferral period to 0 days in your update ring.
- ✅ Confirm devices meet hardware requirements before targeting them.
- ✅ Audit for conflicting registry keys or GPOs that may override Intune.
- ✅ Use Group Policy or registry scripts to enforce target release versions during OOBE if needed.
- ✅ If using AutoPatch, monitor closely—be ready with manual policies if it doesn’t trigger as expected.
Final Thoughts
Deploying Windows 11 25H2 via Intune can be smooth if you configure your policies correctly. The key is remembering that update rings still control deferral, even when using Feature Update policies. Setting the deferral period to zero is the most important step for immediate deployment.
If your devices still don’t update, double-check hardware requirements and look for policy conflicts from legacy tools. In some cases, temporary registry or Group Policy settings may help manage rollout timing, especially during OOBE.
