Intune Company Portal Shows Only One Valid Windows Build Range: What Admins Should Do

Intune Company Portal Shows Only One Valid Windows Build Range: What Admins Should Do

A Windows user is marked noncompliant in Company Portal and sees an OS remediation message listing a build range that does not include the version your organization accepts. If the Intune compliance policy contains multiple Valid operating system builds entries, the portal may be showing only the first range. Microsoft documents this as a known issue: the policy is still enforced, even when the message omits the other acceptable ranges.

Do not tell users to install an OS version based only on that incomplete message. First inspect the policy result and the device’s actual build.

Quick triage

1. In Intune, open Devices > Windows > [device] > Device compliance and identify the policy and setting reporting noncompliant.
2. Open the assigned Windows compliance policy and inspect every entry under Valid operating system builds.
3. On the endpoint, run winver or Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber to record the installed version and build.
4. Compare the device’s full major.minor.build.revision version with each configured minimum and maximum range. A device is valid if it falls within an allowed range.
5. If a range matches but Company Portal lists only another range, explain that the message is incomplete; do not change a working policy or force an unnecessary OS upgrade.
6. If no range matches, deploy an approved update that moves the device into one of the policy’s allowed ranges, then allow the device to check in and report compliance again.

What Microsoft documents

Microsoft’s Intune known-issues page marks this behavior active. When multiple ranges are configured with Valid operating system builds, Company Portal displays only the first range in its remediation message. Microsoft states that compliance evaluation continues to enforce the policy correctly despite the missing ranges in the message.

The setting exists for organizations that support specific patch levels across multiple Windows releases. Each entry has a description, a minimum version, and a maximum version in major.minor.build.revision format. That means the portal’s displayed recommendation is not the authoritative list of your permitted versions; the policy configuration and reported policy result are.

Verify the policy result, not just the text

In the Intune admin center, inspect the affected device’s compliance status and the individual policy setting. Compare the result with the policy’s complete list of ranges and the version reported by Windows. Record the policy name, setting, device name, current OS version, and time of the last check-in before escalating.

On the device, this PowerShell command captures useful version fields:

Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

For the revision number, use winver or run Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion, CurrentBuild, UBR. The full version is commonly represented as 10.0.<CurrentBuild>.<UBR>; compare that value to the compliance policy’s configured boundaries.

Allow time for the device to sync and for reporting to refresh after a policy or OS change. If the portal and Intune reports disagree, capture both views and their timestamps rather than repeatedly changing assignments.

Avoid these false fixes

• Do not remove valid build ranges just to make the message clearer. That weakens the intended compliance policy.
• Do not install the first range shown if another configured range already accepts the device. This can create unnecessary downtime or an unsupported upgrade path.
• Do not assume that every noncompliance result is a display bug. The policy is enforced; devices outside all configured ranges remain noncompliant.
• Do not infer a policy defect from the message alone. Confirm the evaluated setting and actual OS version first.

When it is a real compliance failure

If the installed version is outside every configured range, Company Portal is right that the device needs an OS update even if its list of acceptable versions is incomplete. Follow your organization’s servicing policy and choose a supported target that is explicitly included in one of the ranges. After installation and restart if required, initiate a device sync and recheck the policy-level result.

If the installed build is within a listed range but Intune still reports that setting as noncompliant after a fresh check-in, collect the device’s full OS version, the policy’s complete ranges, the setting-level report, and check-in timestamps. That is a separate evaluation/reporting investigation from the known Company Portal message limitation.

Sources

• Known issues with Microsoft Intune — active issue description and statement that enforcement is correct.
• Create a compliance policy in Microsoft Intune for Windows devices — format and purpose of Valid operating system builds ranges.
• Monitor device compliance policies in Microsoft Intune — reviewing compliance reporting.
• Microsoft Intune Customer Success: Remediation message doesn’t list all valid builds — original issue example and behavior.