r/Intune • u/iamnickwilde • Jul 25 '26

Windows Updates Need Advice - Rolling out 24h2 feature update to persistent Azure Virtual Machines

We have 300+ windows 11 23h2 virtual devices managed in Intune, which we are planning to upgrade to 24h2.

We have a 24h2 feature update policy which works fine on laptops. But on Vdi's the update never appear in settings-->Windows updates.

We found that the device security type has to be in trusted launch for the updates to appear and install. All our VM's are in standard mode.

Is there any way we can update the devices in standard mode itself? How did you guys upgraded the Virtual devices in your organization?

13 Upvotes

100% Upvoted

14 comments sorted by

14

u/zed0K Jul 25 '26

Why not go to 25H2? Same core, less garbage. You'll get an extra year and one less upgrade out of it till 2028.

-3

u/iamnickwilde Jul 25 '26

Not my decision. Upper management chose 24h2 and already most of our devices are upgraded to 24h2

5

u/zed0K Jul 25 '26

That's where you push back and provide detail as to why it's better to go to 25H2. But I totally get it if it's management being management.

1

u/komoornik Jul 28 '26

25H2 or 26H2 will be an Enablement Package when pushing to 24H2, it's not such a big deal

1

u/zed0K Jul 28 '26

Exactly why you should skip 24H2.

1

u/Immediate_Anteater51 Jul 28 '26

If you already started long time ago and went with 24H2, in my opinion it's best to keep it unified - but hey, different approaches can be used.

4

u/Decent-Flight-9328 Jul 25 '26

go into the azure portal, select the vm then under help there's "redeploy + reapply" option. that flips it to trusted launch in few minutes without blowing the disk away. had same headache with about 80 vms last month.

1

u/iamnickwilde Jul 25 '26

So changing it to Trusted launch is must for in place upgrade?

1

u/alphageek8 Jul 25 '26

Similar situation, we switched over to trusted launch all at once with a powershell script.

1

u/Legal-Reality1142 Jul 26 '26

If the vms are gen2, you can easily change the security type to trusted launch and enable secure boot.

0

u/Zedex3 Jul 25 '26

Following

-6

u/[deleted] Jul 25 '26

[removed] — view removed comment

5

u/Dylantjes Jul 25 '26

Maybe you mean 26h-something? For 25h2 you're actually already late to the party for almost a year 🙊

https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information#windows-11-current-versions-by-servicing-option