Can we not just check which devices are new enough?

Age is a poor proxy for eligibility, in both directions. A three-year-old device can be ineligible because its processor is one generation below the bar, and a five-year-old device can be eligible with TPM enabled in firmware. The asset register tells you what was bought; it cannot tell you the processor generation with certainty, whether TPM is present and enabled, or whether the device is in legacy boot mode. Those three facts decide eligibility and they only come from the device. Assessments built on purchase records reliably overstate the replace bucket, which inflates the budget and delays the decision.

How long does the assessment take?

The scan itself runs across the fleet in days, because Intune and Endpoint analytics collect most of the hardware readiness data already and the rest is a targeted collection. The sort and the firmware recount take a few more days. What extends the engagement is the exception work: application compatibility testing on a pilot device, and vendor conversations that can take weeks to conclude. We open those during the assessment rather than at the end, so the report is delivered with the conversations in progress rather than waiting on them.

What is the firmware finding you keep mentioning?

A large share of business devices from the last several years shipped with a TPM 2.0 chip that was disabled when the device was imaged, or with the firmware set to legacy boot mode which prevents Secure Boot. Both make the device fail the Windows 11 check while being fully capable of passing it. Enabling TPM is a firmware setting, often possible remotely on business models. Converting legacy boot to UEFI is a defined procedure with a data-loss risk if done carelessly, so it needs testing per model. Together, these routinely move a meaningful share of a fleet from the replace bucket to the upgrade bucket at no hardware cost.

Will our applications work on Windows 11?

Most will without change. The exceptions concentrate in three places: old line-of-business software with kernel-mode components, security and backup agents that hook the operating system at a low level, and anything relying on features Windows 11 removed. The scan inventories installed software across the fleet and matches it against known compatibility data, producing a short list. For each item on that list the answer is a vendor conversation, a test on a pilot device, or a replacement application, and we start the vendor conversations during the assessment because they are the slowest part.

What about printers and other devices?

Peripherals are where compatibility failures surface after a wave, because nobody thought of the label printer in dispatch or the signature pad at the counter. The assessment inventories connected peripherals from the device side and checks Windows 11 driver availability per model, not per manufacturer, since a manufacturer supporting Windows 11 in general says nothing about a specific model from a decade ago. Where a driver does not exist, a replacement peripheral is usually cheaper than a delayed wave, and knowing that before the wave is the point.

Do we need any new tools to run the assessment?

Usually not. Intune and Endpoint analytics report hardware readiness per device and most Indian organisations on Microsoft 365 already hold the entitlement. Where devices are not yet managed by Intune the collection is more manual, and bringing them under management is often worth doing as part of the migration anyway. We check what you already have before proposing anything, and in most assessments the answer is that the reporting is already paid for and simply not being used.

What if a device fails the processor check?

It is a replace candidate, and there is no setting that changes that. Microsoft has confirmed repeatedly that the supported processor list will not be extended downward. There are ways to bypass the check and install Windows 11 on unsupported hardware, and we do not recommend them: the result is unsupported, update behaviour is not guaranteed, and it produces a fleet you cannot describe honestly to an auditor or a customer. The options are replacement, a bridge on ESU with an exit date, or a Windows 365 Cloud PC where the old device becomes a thin client for a supported desktop.

How does the report feed into the migration?

Directly, because it is written as the plan. The upgrade bucket becomes the in-place upgrade waves through Intune. The firmware-fix bucket gets the tested procedure applied and joins the upgrade waves. The replace list, sorted by role and risk, becomes the procurement schedule and the Autopilot provisioning plan. The exception lists carry owners and are worked in parallel. The retire list gets wiped and disposed. The ESU candidates, if any, get exit dates aligned to the procurement schedule. Nothing in the report needs translating into something else before it can be acted on.

Should we assess before or after deciding on ESU?

Before, without question. ESU is priced per device, and enrolling before scanning is how organisations end up paying for a bridge on devices that could have been upgraded with a firmware setting. The assessment sorts the fleet, and the ESU candidates are only the part of the replace bucket that cannot be replaced by the current period end. That list is consistently shorter than expected once the firmware finding is applied, and the money not spent on unnecessary ESU enrolments is available for the replacements that are actually needed.

Can you do this remotely? We are not in Hyderabad.

Yes, almost entirely. The scan runs through Intune and Endpoint analytics, the sort and the report are desk work, and application testing happens on a pilot device that can be anywhere. The one part that occasionally needs presence is firmware enablement on older models that lack remote configuration, and even that can usually be handled by a local contact following a tested procedure. We are based in Gachibowli, Hyderabad and work with organisations across India. Initial enquiries get a reply within 4 business hours.

Windows 11 readiness, India

The asset register says what you bought. It cannot tell you whether TPM is switched on.

Windows 11 has a fixed hardware bar that Microsoft has confirmed will not move: TPM 2.0, Secure Boot and a supported processor. Whether a given device clears it depends on firmware settings and processor generation, neither of which appears in a purchase record. A readiness assessment scans the fleet from the device side, sorts every machine into upgrade, fix, replace or retire, and finds the application and peripheral exceptions before a rollout wave finds them for you. It is the document the whole migration is built on.

Book a Windows 11 readiness assessment See what the assessment covers

Microsoft

Windows 11

Cloud Solution Partner

Device-sideScanned, not inferred
4 bucketsUpgrade, fix, replace, retire
FirmwareThe cheapest category, most missed
ExceptionsFound before a wave fails

What the assessment covers

Eight checks, and the first three sort the fleet.

A readiness assessment is not a report saying which devices are old. It is a device-level verdict backed by a scan, plus the application and peripheral work that decides whether the verdict can be acted on. These are the checks, in the order they matter.

Processor generation against the supported list

The hardest requirement, because it cannot be fixed with a setting. Intel 8th generation, AMD Ryzen 2000 or later, with a published list that Microsoft has confirmed will not be extended downward. The scan identifies the processor on every device and checks it against the list. Devices below the bar are replace candidates regardless of anything else, and this single check usually sets the size of the budget.

TPM 2.0 presence, version and state

Three separate questions: is a TPM present, is it version 2.0, and is it enabled in firmware. A large share of business devices from the last several years have a capable TPM that was disabled when the machine was imaged. The scan distinguishes absent from disabled, because the first means replacement and the second means a firmware change that costs nothing.

Secure Boot capability and state

Requires UEFI firmware with Secure Boot capable, and again the common finding is capable but disabled, often because a device was set to legacy boot mode years ago. Converting from legacy to UEFI boot is a defined procedure with a risk of data loss if done carelessly, so devices in this state need a tested process rather than a checkbox.

Memory, storage and headroom

Minimums are modest, but the in-place upgrade needs working space and a device at its storage limit will fail mid-upgrade. The scan reports free space per device and flags machines that need cleanup or a storage decision before they are scheduled. Memory below a sensible working level makes a device technically eligible and practically unpleasant, which is worth knowing before a user is moved.

Application compatibility, from inventory not assumption

Most applications run unchanged. The exceptions concentrate in old line-of-business software with kernel-level components, security and backup agents that hook the operating system, and anything relying on features Windows 11 removed. The scan inventories installed software across the fleet, matches it against known compatibility data, and produces a short list of applications needing a vendor conversation or a test.

Peripherals and drivers

Printers, scanners, label printers, signature pads, barcode readers and specialist devices with drivers that were last updated for Windows 7. These are the compatibility failures that surface after a wave, because nobody thought of the label printer in dispatch. The assessment inventories connected peripherals and checks for Windows 11 driver availability per model.

Device assignment and usage

Who uses each device, how recently it was signed into, and what role it serves. This is what turns a hardware verdict into a plan, because a replace-bucket device used daily by a finance manager and one sitting in a cupboard with no sign-in since last year need very different treatment. It also finds the devices that should simply be retired.

The report that becomes the plan

Every device with a verdict and a reason. The application exception list with an owner per item. The peripheral list with driver status. The retire list. The replace list, sorted by role and risk so procurement can be phased. This is not a findings document; it is the input to the migration schedule and the capital request, and it is written to be used that way.

What we find

Eight recurring findings, and what each one means for the plan.

Every fleet is different and the findings are remarkably consistent. These are the eight that appear in almost every assessment, with what each one does to the schedule and the budget.

Capable devices with TPM disabled

The single most common finding and the cheapest to fix. Devices imaged years ago with TPM off in firmware, fully capable of Windows 11 once it is enabled.

Usually a meaningful share of what looked like the replace bucket
Remote firmware configuration works on most business models
Test the procedure per model before applying it fleet-wide

Legacy boot mode on UEFI-capable hardware

Secure Boot requires UEFI, and a device set to legacy boot cannot enable it without a conversion. The conversion is routine and carries data-loss risk if done without care.

A defined procedure, not a setting toggle
Back up before converting, and test on a spare first
Often paired with the TPM finding on the same devices

Processors one generation below the bar

Devices that feel new and are not eligible, because the processor is Intel 7th generation or an early Ryzen. Users find this hard to accept and the requirement is not negotiable.

Replace, or bridge on ESU with an exit date
Bypassing the check produces an unsupported install we do not recommend
This category drives most of the capital conversation

One or two applications with kernel-mode components

An old accounting package, a specialist engineering tool, a legacy security agent. Usually a short list, and each item needs a vendor answer that can take weeks.

Start the vendor conversations at assessment, not at rollout
Test on a pilot device rather than trusting a compatibility claim
A replacement application is sometimes cheaper than waiting

A peripheral nobody listed

The label printer, the signature pad, the cheque scanner. Not on any inventory, essential to one team, and running a driver last updated a decade ago.

Inventory connected peripherals from the device side
Check driver availability per model, not per manufacturer
Replacement peripherals are usually cheaper than delayed waves

Devices at their storage limit

Eligible on every other measure and unable to complete the upgrade because there is no working space. Found after the failure unless the scan reports free space.

Cleanup or a storage decision before scheduling
Often correlates with the oldest eligible devices
A small finding that causes a disproportionate number of failed upgrades

Devices with no user and no recent sign-in

Spares, forgotten loaners, machines from departed staff. They need neither upgrade nor ESU, only wiping and disposal, and removing them shrinks every other number.

Usually more than anybody expected
Take them out of the fleet before counting anything else
Wipe to an evidenced standard, since they often hold old data

A department with the same device bought in one tranche

Twenty identical laptops bought together three years ago, all one generation below the processor bar. The finding is stark and the phasing is simple, because they age and fail together.

Whole-tranche findings make the replace list easy to sequence
Budget the tranche as one line, not twenty
The same tranche often shares the same firmware setting, so test once

A security agent that hooks the kernel

Endpoint protection, backup or monitoring software from a vendor who has not yet certified it on Windows 11, or whose version on your devices is several releases behind the one that is.

Check the installed version against the vendor compatibility statement, not the product name
Updating the agent is usually the fix, and it needs doing before the upgrade wave
This is the exception most likely to fail an in-place upgrade silently

Special-purpose machines needing individual decisions

Kiosks, shop-floor terminals, reception PCs, meeting room devices. A fleet rule does not fit them, and each needs its own answer.

Vendor support for the software decides, not the hardware
Cloud PC or a thin client is sometimes the right replacement
Isolate on the network anything that has to stay on Windows 10

Why bring us in

We scan from the device, and we write the report to be used.

Device-side evidence, not inference

Processor, TPM state, Secure Boot state, storage headroom, installed applications and connected peripherals, all read from each machine through Intune and Endpoint analytics rather than inferred from a purchase record. The difference between the two is usually the difference between an accurate budget and an inflated one.

Microsoft Partner, working in these tenants daily

The reporting that makes a readiness assessment fast is built into Intune and Endpoint analytics, and most Indian organisations on Microsoft 365 already hold the entitlement. We use what you have, and we know which reports are reliable and which need verifying against the device.

We write the report as the plan

Every device has a verdict and a reason. Every exception has an owner. The replace list is sorted so procurement can be phased. The output is the input to the migration schedule and the capital request, not a findings document that somebody then has to turn into one.

We start the vendor conversations rather than listing them

Application exceptions are usually few and the vendor answers usually slow. We open those conversations during the assessment rather than handing you a list, because a wave delayed by a vendor who took six weeks to reply is the most avoidable schedule problem in the programme.

What the assessment finds

The dominant finding, by sector.

GCCs and technology

Newest hardware, mostly eligible, and the finding is usually a security agent or a development tool with a kernel component. The work is the exception list rather than the fleet.

Manufacturing

A bimodal fleet: eligible office devices and a shop floor full of special-purpose machines needing individual decisions, with peripherals nobody listed and vendor constraints on every one.

BFSI

Usually well-documented fleets and a long list of specialist peripherals: cheque scanners, signature pads, token readers. Driver availability per model is the whole assessment.

Healthcare

Clinical and diagnostic workstations with vendor-certified software, where the vendor roadmap for Windows 11 decides the schedule and the assessment is largely a vendor conversation.

Education

Large fleets bought in bulk several years apart, so the processor generation finding is stark: whole tranches are eligible or not together, which makes the replace list large and the phasing simple.

Retail and distributed sites

Point-of-sale and back-office devices across many locations with no local IT and no reliable inventory. The scan is frequently the first accurate fleet count the organisation has had.

The requirements

What Windows 11 requires, how the scan checks it, and what a fail means.

The requirements are published and fixed. What matters is how each is verified on a real device and what the remediation is when a device fails, because the remediation ranges from free to a full replacement.

	Requirement	How it is checked
Supported 64-bit processor	Processor model read from the device and matched against the published list	Replace. This cannot be fixed with a setting, and Microsoft has confirmed the list will not be extended downward.
TPM 2.0	Presence, version and enabled state read from the device	If absent, replace. If present but disabled, enable in firmware, which is free and usually possible remotely.
Secure Boot capable UEFI	Firmware mode and Secure Boot state read from the device	If in legacy boot mode on UEFI-capable hardware, convert with a tested procedure. If the firmware is not UEFI, replace.
Memory	Installed memory read per device	Below the minimum is rare on business hardware. Below a sensible working level makes the upgrade technically eligible and practically slow; consider a memory upgrade or replacement.
Storage and free space	Total and free storage read per device	Below the minimum, replace or upgrade the drive. At the limit with no working space, clean up before scheduling or the upgrade fails midway.
Applications and peripherals	Installed software and connected devices inventoried, matched against compatibility data	A short exception list with an owner per item. Vendor conversation, test on a pilot device, or replace the application or peripheral.

Two ways to assess

Working from the asset register against scanning the device.

Both produce a list. One is a guess dressed as a plan; the other is what the capital request and the wave schedule can actually be built on.

Feature	Dimension	From the asset register
Processor eligibility	Inferred from model name and purchase date	Read from the device and matched to the list
TPM state	Unknown, assumed present on newer devices	Present, absent, or disabled, per device
Secure Boot	Unknown	Enabled, disabled, or legacy boot mode, per device
The firmware-fix bucket	Does not exist, so those devices are counted as replacements	Identified, and moved to the upgrade bucket
Applications	Whatever somebody remembers	Inventoried and matched against compatibility data
Peripherals	Not considered	Inventoried from the device side, driver status per model
Unused devices	Still on the register, still counted	Identified by sign-in history and removed from the count
The replace list	Larger than reality, so the budget is wrong	Accurate, so the budget can be defended

The firmware finding usually changes the budget more than anything else.

In most assessments we run, a meaningful share of the devices that the asset register suggested were replace candidates turn out to be capable hardware with TPM or Secure Boot disabled in firmware. Enabling them costs nothing beyond a tested procedure, and it moves those devices from the replace bucket to the upgrade bucket. That single finding routinely reduces the capital request by more than any negotiation with a hardware vendor would, and it is invisible to any assessment that works from purchase records rather than from the device.

Distinguish absent from disabled, since they lead to opposite decisions
Test the firmware procedure per model before applying it fleet-wide
Legacy boot conversion carries data-loss risk if done without care
Recount the replace bucket after the firmware pass, then budget

The engagement

Four stages, and the scan takes days.

1
Scan the fleet from the device side
Hardware readiness, firmware state, storage headroom, installed applications, connected peripherals and sign-in history collected per device through Intune and Endpoint analytics, with verification against the device where the reporting is uncertain. This runs across the whole estate and takes days rather than weeks.
2
Sort, and recount after the firmware pass
Every device into upgrade, fix, replace or retire. The firmware-fix procedure tested per model, and the replace bucket recounted once those devices move to upgrade. This recount is where the budget usually changes, and it happens before anybody sees a number.
3
Work the exceptions
Application exceptions matched against compatibility data and tested on a pilot device where the data is uncertain, with vendor conversations opened rather than listed. Peripherals checked for driver availability per model. Special-purpose machines given individual decisions with the team that uses them.
4
Deliver the report as the plan
The sorted fleet, the exception lists with owners, the replace list phased by role and risk, ESU candidates with proposed exit dates, and a one-page summary for the budget owner. Reviewed with department heads so the verdicts are agreed, then handed into the migration programme.

What you receive

Twelve things the assessment report contains.

The report is written to be used as the migration plan, not filed as a finding. If you cannot start scheduling waves from it, it has not done its job.

The fleet

Every device with a verdict: upgrade, fix, replace or retire
With the reason, per device
The firmware-fix list, by model, with the tested procedure
The cheapest category, ready to action
The replace list, sorted by role and risk
This becomes the capital request
The retire list
Wipe and dispose, no other action needed

The exceptions

Application exception list with an owner per item
Vendor conversations started, not deferred
Peripheral list with driver availability per model
Including the ones nobody listed
Devices needing storage cleanup before scheduling
So upgrades do not fail midway
Special-purpose machines with an individual decision each
Kiosks, shop floor, reception

The plan

A proposed wave sequence by department and risk
Not by who asked first
ESU candidates, if any, with proposed exit dates
Only devices that cannot move by the boundary
The Intune and Autopilot readiness position
What the platform needs before the first wave
A one-page summary for whoever owns the budget
Counts, categories, and the number that matters

Questions we get asked

Windows 11 readiness, answered plainly.

What the assessment feeds

Where the report goes next.

Windows 11 migration

The programme the assessment is the first stage of: upgrades, the refresh, Autopilot provisioning and the security posture.

Learn more

Device refresh planning

What happens to the replace list: standardisation, phasing, procurement and the disposal of the outgoing fleet.

Learn more

Windows 10 end of support

What actually changed in October 2025 for every device the scan finds still on Windows 10, and why it is a compliance matter.

Learn more

Next step

Get the real replace number before you budget.

The scan takes days, it runs on reporting you probably already hold, and the firmware recount routinely changes the capital request more than any vendor negotiation would. Tell us roughly how many devices you have and whether they are in Intune. Remote-first from Hyderabad, serving all of India.

Book a Windows 11 readiness assessment See the full migration programme

Related Services

Explore more solutions that work great with this service

The asset register says what you bought. It cannot tell you whether TPM is switched on.

Eight checks, and the first three sort the fleet.

Processor generation against the supported list

TPM 2.0 presence, version and state

Secure Boot capability and state

Memory, storage and headroom

Application compatibility, from inventory not assumption

Peripherals and drivers

Device assignment and usage

The report that becomes the plan

Eight recurring findings, and what each one means for the plan.

Capable devices with TPM disabled

Legacy boot mode on UEFI-capable hardware

Processors one generation below the bar

One or two applications with kernel-mode components

A peripheral nobody listed

Devices at their storage limit

Devices with no user and no recent sign-in

A department with the same device bought in one tranche

A security agent that hooks the kernel

Special-purpose machines needing individual decisions

We scan from the device, and we write the report to be used.

Device-side evidence, not inference

Microsoft Partner, working in these tenants daily

We write the report as the plan

We start the vendor conversations rather than listing them

The dominant finding, by sector.

GCCs and technology

Manufacturing

BFSI

Healthcare

Education

Retail and distributed sites

What Windows 11 requires, how the scan checks it, and what a fail means.

Working from the asset register against scanning the device.

The firmware finding usually changes the budget more than anything else.

Four stages, and the scan takes days.

Scan the fleet from the device side

Sort, and recount after the firmware pass

Work the exceptions

Deliver the report as the plan

Twelve things the assessment report contains.

The fleet

The exceptions

The plan

Windows 11 readiness, answered plainly.

Can we not just check which devices are new enough?

How long does the assessment take?

What is the firmware finding you keep mentioning?

Will our applications work on Windows 11?

What about printers and other devices?

Do we need any new tools to run the assessment?

What if a device fails the processor check?

How does the report feed into the migration?

Should we assess before or after deciding on ESU?

Can you do this remotely? We are not in Hyderabad.

Where the report goes next.

Windows 11 migration

Device refresh planning

Windows 10 end of support

Get the real replace number before you budget.

Related Services

Windows 11 Migration

Device Refresh Planning

Windows 10 ESU

Microsoft Intune