Windows 11 Migration Plan: 24-Week Roadmap From Inventory to Last Device
9 min read ยท 2026-10-25
A windows 11 migration plan is the schedule that moves every company PC from Windows 10 to Windows 11: which devices can upgrade in place, which need replacing, which apps must be tested, who goes first and how you will track progress to the last device. For an organization with a few thousand endpoints, a common shape is about 24 weeks: inventory and testing first, then a pilot, then rollout in waves.
Windows 10 reached end of support on October 14, 2025. If you still run Windows 10 devices, they no longer get regular security updates unless they are enrolled in Microsoft's Extended Security Updates (ESU) program. Use ESU as a bridge, not a plan. The roadmap below helps you finish the move with owners, checkable milestones, a pilot ring approach and a reporting format leadership can follow. Check hardware requirements, ESU terms and tool features against current Microsoft documentation for your licensing.
The roadmap at a glance
Goal: All in-scope devices running Windows 11 or replaced, critical apps tested and supported, no unsupported Windows 10 devices left on the network, and a closeout report signed by the IT director. Duration: 24 weeks
Inventory and readiness (Weeks 1-3)
Know every device, whether it meets Windows 11 requirements and what runs on it.
- Pull a device inventory from your management tool, such as Microsoft Intune or Configuration Manager: model, age, CPU, RAM, storage, TPM version and Secure Boot status.
- Flag each device as upgrade-ready, upgradable with a firmware or BIOS change, or needing replacement.
- List every installed app and group them into critical, important and other, with a business owner for each critical app.
- Identify special devices: kiosks, shop-floor PCs, lab machines and devices tied to equipment.
Milestone: A readiness report showing device counts by status (ready, fix, replace) and an app list with owners, reviewed by the IT director.
Plan, budget and image (Weeks 3-6)
Decide how each device will move and prepare the standard build.
- Choose the method per device group: in-place upgrade for ready devices, new devices with Windows Autopilot for replacements, or wipe and reload where needed.
- Get approval for replacement purchases and confirm hardware lead times with procurement.
- Build and document the Windows 11 baseline: security settings, policies, drivers and standard apps.
- Decide whether any devices will need ESU as a temporary bridge, and confirm the terms with your licensing contact.
Milestone: Approved migration approach per device group, purchase orders raised for replacements, and the Windows 11 baseline signed off by security.
App testing (Weeks 5-9)
Confirm that critical and important apps work on Windows 11 before users depend on them.
- Set up test devices or virtual machines with the Windows 11 baseline.
- Have each app owner run a short test script for their critical apps and record pass, fix or fail.
- Work with vendors on apps that fail, and find a fix, an update or a replacement.
- Test peripherals and drivers: printers, scanners, docking stations, card readers.
Milestone: Every critical app marked pass or with an agreed fix and date, signed off by its business owner.
Pilot (Weeks 8-11)
Migrate a small, mixed group and find problems before the wide rollout.
- Start with IT staff, then a pilot ring of volunteers from several departments, locations and device models.
- Run the upgrade or replacement exactly as planned for the waves, including user communications.
- Collect feedback after one week with a short survey and track every helpdesk ticket tagged to the migration.
- Measure upgrade success rate, time per device and user downtime.
Milestone: Pilot ring migrated with success rate, time per device and ticket volume reported, and a go decision for the waves.
Rollout in waves (Weeks 12-21)
Move the rest of the organization in planned waves without disrupting critical work.
- Schedule waves by department or site, avoiding busy periods such as month-end close for finance.
- Send communications one week and one day before each wave: what changes, how long it takes, where to get help.
- Run upgrades with your deployment tool, and swap replacement devices with data and settings moved for users.
- Hold a short daily check during each wave to review failures, tickets and blocked devices.
- Update the tracking dashboard daily so leadership sees progress by department.
Milestone: All waves completed with failed or deferred devices listed by name, owner and reason.
Stragglers and closeout (Weeks 21-24)
Finish the last devices, retire old hardware and close the project.
- Chase remaining Windows 10 devices one by one with their users and managers.
- Decide on exceptions with security: isolate, enroll in ESU, or replace for devices that cannot move yet.
- Wipe and dispose of retired devices following your data security and asset policies.
- Write the closeout report and hand ongoing Windows 11 updates to the operations team.
Milestone: No unmanaged Windows 10 devices on the network, every exception documented and approved by security, and the closeout report signed.
Who owns what
A Windows migration looks like an IT task, but it depends on people outside IT: app owners who test, managers who free up time, and procurement who gets hardware on time. Name owners in the kickoff deck and repeat them in every status report.
In a small company, one IT manager may hold most of these roles. The app owner role still matters, because only the people who use an app daily can tell you it works.
- Sponsor (IT director or CIO): approves budget, exceptions and the rollout schedule.
- Migration lead (project manager or endpoint lead): owns the plan, the wave schedule and reporting.
- Endpoint engineers: build the image and policies, run deployments and fix failures.
- App owners: test their apps and sign off.
- Security team: approves the baseline, ESU use and exceptions.
- Service desk: handles user tickets and reports patterns to the migration lead.
- Procurement: orders replacement devices and tracks delivery dates.
- Department leads: pick wave dates and make sure their teams are ready.
Example: a filled-in plan for 2,500 devices
Picture an organization with 2,500 Windows 10 PCs across three offices and remote staff. The inventory shows most devices meet Windows 11 requirements, a group needs a firmware change to enable TPM or Secure Boot, and a few hundred older laptops must be replaced.
The team puts finance in the last office wave to avoid month-end, and sends replacement devices to remote staff with Autopilot so they can set up at home.
- Weeks 1-3, inventory: device data pulled from Intune, apps grouped, 40 critical apps with owners. Owner: endpoint lead.
- Weeks 3-6, plan: in-place upgrade for ready devices, Autopilot for replacements, baseline approved. Owner: migration lead with security.
- Weeks 5-9, app testing: 40 critical apps tested, three needing vendor updates. Owner: app owners.
- Weeks 8-11, pilot: IT team plus a pilot ring from each office. Owner: migration lead.
- Weeks 12-21, waves: five waves by office and department, remote staff in parallel. Owner: endpoint engineers with department leads.
- Weeks 21-24, closeout: last devices chased, a small number of lab PCs isolated with an approved exception, old devices wiped. Owner: migration lead.
How to plan pilot rings and waves
Rings let you find problems while they affect few people. The first ring is IT, because they can describe problems clearly. The second is a pilot group that represents the whole company: every department, location, device model and critical app. Then come the waves, sized so the service desk can handle the tickets.
Set clear criteria to move from one ring to the next, such as upgrade success rate and no open critical issues. Write them in the plan before the pilot starts, so the go decision is based on facts, not on pressure from the calendar.
- Ring 0: IT and the migration team.
- Ring 1: pilot volunteers from every department and device model.
- Waves 1 to N: departments or sites, largest risk last.
- Special devices: handled as their own small project.
Metrics to track and report
Leadership will ask one question every week: how many devices are left? Build a dashboard that answers it by department and site, with the trend over time. Your device management tool usually reports the operating system version per device, which is the source of truth.
Add a few quality measures, so speed does not hide problems. A wave that finishes on time but floods the service desk is not a success.
- Devices migrated: count and share of in-scope devices on Windows 11, by department and site.
- Upgrade success rate: successful upgrades divided by attempts, per wave.
- Devices remaining: split into ready, blocked by app, blocked by hardware, awaiting replacement.
- Migration tickets: service desk tickets tagged to the migration per wave.
- User downtime: average time a user cannot work during the upgrade or swap.
- Exceptions: devices on ESU or isolated, with an end date for each.
How to present it to leadership
Start with the risk in one line: unsupported devices are a security exposure, and the plan removes them by a set date. Then show a one-slide timeline with the six phases, the pilot and wave dates, and the replacement purchases.
In later updates, lead with the device count chart and the list of blockers that need a decision, such as an app with no Windows 11 support or a replacement order that is late. Leave out driver details and per-device lists. Keep exceptions visible, with an owner and an end date for each, so they do not become permanent.
Risks and dependencies
Most migration delays come from three places: apps, hardware supply and user availability. Keep a risk log with an owner and a fallback for each, and review it in the weekly project meeting.
Dependencies on other projects matter too. If another team plans a VPN change or a new security tool during your waves, agree on the order early so troubleshooting stays simple.
- Critical app fails on Windows 11: owner is the app owner. Fallback: vendor update, virtualized delivery, or a documented exception with isolation.
- Replacement devices arrive late: owner is procurement. Fallback: migrate ready devices first and move replacement waves to the end.
- Upgrade failures on a device model: owner is the endpoint engineer. Fallback: pause that model, update drivers or firmware, then resume.
- Users unavailable during their wave: owner is the department lead. Fallback: a catch-up slot at the end of each wave.
- Service desk overloaded: owner is the service desk manager. Fallback: smaller waves and extra floor support on wave days.
Common mistakes to avoid
- Starting upgrades before the inventory is complete leads to surprises on wave day, so finish the hardware and app inventory first.
- Testing apps only in IT misses how people really use them, so have business app owners test with their own scripts and sign off.
- Treating ESU as the plan delays the real work and extends risk, so use it only as a short bridge with an end date per device.
- Choosing a pilot group of only IT staff hides problems in other departments, so include every department, site and device model in the pilot ring.
- Scheduling waves without asking departments causes clashes with busy periods, so agree on wave dates with each department lead.
- Reporting only the percentage migrated hides the hard cases, so report remaining devices by blocker with an owner for each.
Frequently asked questions
How long does a Windows 11 migration take?
It depends on device count, how many devices need replacing and how many critical apps you must test. Small companies can finish in a few weeks, while large organizations often take several months. The inventory and pilot give you a realistic timeline.
What are the hardware requirements for Windows 11?
Windows 11 requires a supported 64-bit processor, TPM 2.0, UEFI with Secure Boot capability, and minimum memory and storage levels. Some devices only need TPM or Secure Boot turned on in firmware. Check the current requirements and supported processor lists in Microsoft's documentation.
Should we upgrade in place or reimage devices?
In-place upgrades keep apps, data and settings, and usually cause the least downtime for devices that meet requirements. Wipe and reload gives a clean build but needs more preparation and user data handling. Many organizations upgrade compatible devices in place and use Windows Autopilot for new devices.
What happens to Windows 10 devices after end of support?
They keep working, but they no longer receive regular security updates or technical support from Microsoft. Organizations can enroll eligible devices in the Extended Security Updates program for a limited time. Confirm ESU terms for your licensing with Microsoft or your reseller.
Who should be in a Windows 11 pilot group?
Start with IT staff, then add volunteers from every department, office and device model, including people who use critical apps daily. The pilot should look like a small version of the whole company. That way the problems you find are the ones the waves would hit.