The Windows 11 24H2 end of support deadline is October 13, 2026, for Home, Pro, Pro Education and Pro for Workstations. If those devices are still in your inventory, this patch cycle needs a named upgrade owner and a confirmed restart, not another announcement forwarded to the service desk. Standard 24H2 Enterprise and Education remain supported until October 12, 2027. Keep those machines on their normal patch plan; LTSC has a separate lifecycle.
A separate October Intune documentation change belongs in the network change queue. It replaces regional trouter entries with an all-region wildcard, not the entire Intune endpoint list. The Windows deadline does not justify rushing that firewall change.
Close the upgrade exceptions
We covered the release mechanics and policy risks in the September 26H2 GA post. This time, I would work the remaining device list. An assigned feature update policy is not proof that a laptop has upgraded.
- Export edition, feature version and last check-in. Split affected 24H2 Home/Pro-family devices from supported Enterprise/Education. Include machines outside Intune in the inventory; a missing management record is not evidence that a device is current.
- Choose the client’s approved target. Both 25H2 and 26H2 have documented enablement-package paths from 24H2 with a single restart. 26H2 became generally available September 29, but that is not a mandate to abandon an already validated 25H2 plan.
- Check prerequisites for that target. KB5054156 requires KB5064081 or a later cumulative update for 25H2. KB5121794 requires KB5124010 or a later cumulative update for 26H2. Check installed updates before scheduling the feature update. Do not bypass compatibility safeguards to beat the date.
- Track download, installation and restart separately. Arrange a restart window with the user, then verify the actual edition and feature version on the device and reconcile the management report. A queued deployment or stale last check-in leaves the upgrade unconfirmed.
- Give each remaining exception an owner. For affected devices still on 24H2 after the cutoff, record the blocker, next action and restart window. Report that unfinished work separately from the supported Enterprise fleet.
Update the Intune allowlist without dropping the CDN
The October 7 documentation diff records removal of the go-amer, go-eu and go-apac trouter entries. The live Microsoft Intune endpoints page, checked October 12, agrees: it lists *.trouter.communications.svc.cloud.microsoft on TCP 443 in the Remote Help requirements and the all-region row of the Scripts and Win32 apps table.
The regional imeswda-afd-*, imeswdb-afd-* and imeswdc-afd-* CDN entries remain in that table. Keep the entries required for your tenant region, plus the other documented endpoints. This is a trouter-rule change, not permission to delete regional CDN rules.
My change sequence would be: confirm how the firewall handles wildcard FQDN rules, add or verify the outbound TCP 443 allowance, and test Remote Help plus Win32 app and script retrieval from a client behind the actual proxy/firewall. Inspect connection and deny logs. A successful DNS lookup or port probe alone does not prove those workflows work.
Only after validation would I retire redundant regional trouter exceptions under change control, with rollback available. We have verified the documentation, not run those network tests in your environment. Close the affected Windows upgrade list and validate the Intune rule change as separate jobs.
Sources
- Windows 11 release information (Endpoint Management)
- KB5121794: Windows 11 26H2 enablement package (Endpoint Management)
- KB5054156: Windows 11 25H2 enablement package (Endpoint Management)
- Network endpoints for Microsoft Intune (Endpoint Management)
- October 7 Intune endpoint documentation diff (Endpoint Management)
