Windows 11 deployment checklist for UK SMEs

For most SMEs, the move to Windows 11 is not really about new features. It is the moment to clear out years of accumulated exceptions, retire the last handful of Windows 10 laptops, and replace ad-hoc local admin rights with properly managed devices. Done as a copy-the-old-build exercise, it wastes the opportunity. Done deliberately, it is the cheapest security uplift an SME will get all year.

Phase 1 — audit before you migrate

• Inventory every Windows device: model, CPU, TPM version, BIOS version and current OS build. Anything below an 8th-generation Intel / Zen 2 AMD will not pass Windows 11.
• List every line-of-business application and call out the ones still running on Windows 7 or Windows 8 assumptions. These are the projects the migration will uncover.
• Identify the devices you intend to redeploy versus replace. Refresh budget should be planned alongside the migration, not after it.
• Capture the security baseline you want to land on: BitLocker on every disk, Defender with EDR enabled, Intune-enrolled, Standard user accounts as the default.

Phase 2 — choose your deployment method

For most SMEs, Microsoft Intune with Windows Autopilot is the right answer. New devices ship from the supplier to the user, the user signs in with their work account, and Autopilot applies the standard build — apps, policies, BitLocker key escrow, Defender onboarding — without an engineer ever touching the device. Re-deployments of existing in-house devices go through a wiped-and-rebuilt Autopilot flow as well, which guarantees the standard build and removes years of accumulated drift.

Phase 3 — standard build, not bespoke

• A single Intune device configuration profile covering BitLocker, Windows Hello, firewall, SmartScreen and account configuration.
• A single compliance policy that a device must meet before it can sync email or access SharePoint. No compliance, no corporate data.
• A standard user account by default — no local admins except a controlled break-glass group.
• Edge as the default browser, with SmartScreen and the Defender Application Guard enabled.
• Conditional access that blocks sign-ins from non-compliant devices, even with valid credentials.

Phase 4 — pilot then sequence

Pilot with a friendly team — typically IT first, then a small department that does simple work. Catch application compatibility problems before they hit finance or production. Sequence the rest of the business by risk: low-risk users first, customer-facing and regulated roles last. Communicate the sequence with dates, not vague windows. People appreciate knowing when their laptop will be touched.

Phase 5 — decommission the Windows 10 estate

Once a team is on Windows 11, retire the old Windows 10 hardware immediately. Devices that sit on a shelf "just in case" become the next ransomware foothold. Wipe the disks, remove from Intune, recycle through a certified IT asset disposal partner. Capture the asset register update for insurance and accounting.

We help SMEs across Hertfordshire, Bedfordshire and London plan and execute Windows 11 migrations using Intune and Autopilot, typically completing a 50-seat rollout in 6 to 10 weeks including training. If your Windows 10 deadline is approaching and you would like a free audit and costed plan, get in touch.