Windows 11 isn’t respecting Intune blocks as it rolls out to ineligible PCs

It’s been a tough several weeks for Microsoft in the enterprise space recently. In the past few days, we have reported multiple issues in this domain, including typing in classic Outlook spiking CPU usage up to 50%, users experiencing difficulties while sharing files in Teams, and Microsoft completely breaking the option to roll back from the new version of Outlook to the old one. Now, a new bug is causing Windows 11 to become available to ineligible devices, increasing headaches for IT admins.

Windows 11 for the masses

Although Microsoft wants as many customers as possible on Windows 11, it probably doesn’t want ineligible devices to receive the update, as has been made very clear over the past few years through its strict hardware requirements for the operating system. IT admins sometimes have similarly stringent policies for updates rolling out to their tenant accounts, but many were caught by surprise after finding out that the Redmond firm itself had been rolling out the update to unsupported PCs despite Intune blocks in place.

As spotted by Bleeping Computer, Microsoft has published an advisory in the Microsoft 365 admin center which states that Windows 11 has been accidentally made available to ineligible devices since April 12. This is apparently happening because of a “latent code issue” where Intune is not respecting certain policies concerning rollout blocks. It is important to note that the presence of this bug does not imply that Windows 11 is being pushed to unsupported Windows 10 devices. Rather, it means that it’s being released on “ineligible” Windows 10 desktop devices which have been blocked by IT admins from receiving the latest version of the OS, for one reason or the other.

A targeted fix is on the way

Credit: Resume Genius (unsplash) / XDA

Fortunately, Microsoft is currently deploying a targeted code fix to resolve the issue before it impacts more organizations. For the time being, it has requested IT admins to pause Windows feature updates until they have fully tested and deployed the Intune code fix themselves. Additionally, it has recommended IT personnel to manually roll back impacted devices to the correct version of Windows 10.

It’s currently unknown how many companies are affected by this bug, but Microsoft has tagged the incident ticket as an advisory, which means that the scope of impact is relatively limited. The manual rollback to Windows 10 may cause further headaches for IT admins over the next few days, and it’s unfortunate that there’s no script or Intune functionality that can automate this process.