What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In Microsoft Intune, create a Managed devices assignment filter on the Windows 10 and later platform, then compare device.operatingSystemVersion with the version operator that matches your policy. A documented example is (device.operatingSystemVersion -gt 10.0.22000.1000). Treat that build as an example, not a universal Windows 11 minimum: choose and document the boundary your organization actually intends to target, preview the matching devices, and remember that filter properties are evaluated when devices check in.
What an Intune OS-version filter does
An assignment filter narrows which enrolled devices receive an Intune app, policy, compliance policy, configuration profile, or other assignment. For an operating-system rule, Intune evaluates the version reported by each managed device and includes or excludes the device according to your expression. This lets you target a Windows 11 population by build boundary instead of relying only on broad platform targeting.
As an Amazon Associate I earn from qualifying purchases.
The filter is not a one-time inventory label. Intune evaluates the defined properties when a device checks in. A device can therefore match after an upgrade, stop matching after a rollback, or remain unchanged until its next check-in. The preview you see while creating the filter is a snapshot of enrolled devices that match at that time, not a guarantee that future device state or every later policy outcome will be identical.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use the correct property and version format
Property: device.operatingSystemVersion
For a managed-device assignment filter, use device.operatingSystemVersion. Microsoft marks osVersion as deprecated. Existing filters that use the deprecated property can continue to work, but new filters using it cannot be created. Starting with the current property avoids building a new rule on a field Microsoft no longer recommends.
#1 Best Overall
Windows version values in assignment filters
Microsoft’s assignment-filter examples represent Windows versions as 10.0.<build>, for example 10.0.22000.1000. Keep the prefix and the complete build value together when you write the comparison. Do not copy a version prefix from another Intune feature without checking that feature’s syntax. Microsoft’s Windows compliance-settings documentation discusses an 11.0 prefix before build numbers in that compliance-setting context; that is a separate documented context from assignment-filter examples. For an assignment filter, follow the syntax shown for the assignment-filter property and confirm the result with the preview.
Choose a boundary before writing the rule
There is no organization-wide Windows 11 minimum build implied by the filter feature itself. Your boundary should come from the policy you are implementing, such as a minimum supported build, a named feature release, a pilot ring, or an exclusion for older installations. Record the exact value and whether the boundary itself should be included.
| Intent | Operator pattern | What matches |
|---|---|---|
| Only versions strictly newer than a build | -gt |
Versions greater than the value; the boundary version does not match |
| The boundary build and every newer version | -ge |
Versions greater than or equal to the value |
| Only versions strictly older than a build | -lt |
Versions lower than the value; the boundary does not match |
| The boundary build and every older version | -le |
Versions lower than or equal to the value |
| Exactly one version value | -eq |
Only the specified version |
| Anything except one version value | -ne |
Values other than the specified version |
For example, Microsoft documents the illustrative expression (device.operatingSystemVersion -gt 10.0.22000.1000). It means a version greater than 10.0.22000.1000; it does not establish that this is the right cutoff for your Windows 11 deployment. If that exact build must also be included, change the operator to -ge.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCreate the filter in the Intune admin center
- Open the filter workflow. In the Microsoft Intune admin center, start creating an assignment filter for Managed devices. This is the filter type used for device properties such as the operating-system version.
- Name the filter clearly. Include the purpose and boundary in the name, such as
Windows 11 - minimum build - include boundary. A descriptive name helps administrators understand the rule without opening it. - Select the platform. Choose Windows 10 and later. This is the platform choice used for the Windows assignment-filter workflow; it is not a claim that every device in the platform is running Windows 11.
- Open Rules. Use the visual rule builder for a straightforward comparison, or select the syntax editor when you need to enter the expression directly.
- Enter the managed-device property. Select or type
device.operatingSystemVersion. Check the spelling and the full property path before choosing the operator. - Select the comparison operator. Choose
-gt,-ge,-lt,-le,-eq, or-neaccording to the boundary decision you made earlier. - Enter the version value. Use the assignment-filter version form, such as
10.0.22000.1000, and keep the value tied to the policy or release requirement that motivated it. - Review the expression. A simple rule has the form
([entity].[property] [operation] [value]). Parentheses are supported, and nested parentheses can be used in advanced syntax. Microsoft states that properties, operations, and values are case-insensitive, but consistent casing still makes rules easier to audit. - Preview devices. Select Preview devices and inspect the enrolled devices that currently match. Look for unexpected editions, test machines, or devices whose reported build does not align with your inventory.
- Review and create. If the preview and expression are correct, complete the review page and create the filter. Keep a record of the chosen boundary and the date it was approved.
Rule-builder versus syntax editor
| Entry method | Best for | Trade-off |
|---|---|---|
| Visual rule builder | A single property comparison that administrators want to assemble from selectable fields and operators | Easier to enter, but offers less control for complex grouped logic |
| Syntax editor | Advanced expressions, nested parentheses, or a rule that must be reviewed as exact text | More control, but a syntax error or unsupported expression can prevent use of the basic builder |
Start with the builder when one operating-system comparison is sufficient. Use the syntax editor when the logic genuinely requires grouping or multiple conditions, and validate the result with the preview before saving.
Build common Windows 11 targeting patterns
Include a minimum build
To include the selected build and anything newer, use the inclusive operator:
(device.operatingSystemVersion -ge 10.0.<your-build>)
Replace <your-build> with the build established by your servicing or security policy. The angle-bracket text is explanatory notation, not a value to paste into Intune.
Rank #3
Target only versions above a pilot baseline
Use a strict comparison when the baseline itself should remain outside the assignment:
Recommended Free Tools
(device.operatingSystemVersion -gt 10.0.22000.1000)
This follows Microsoft’s documented example. It matches versions greater than the stated value and excludes the exact boundary.
Exclude versions at or below a cutoff
When the goal is to keep an assignment away from older builds, use -gt for a strict cutoff or -ge if the cutoff should be included. An exclusion filter is still evaluated at check-in, so an upgrade can change the device’s result.
Combine conditions carefully
Advanced syntax supports parentheses and nested parentheses. Group each condition so the intended precedence is visible. For example, a build comparison can be combined with another supported device property, but every additional condition increases the need for preview testing. If an expression is not supported by the editor, the basic rule builder may be disabled; simplify the logic or use the syntax editor and verify the matching set.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Validate the result before assigning policies
- Confirm the entity. The rule should reference the managed-device entity and
device.operatingSystemVersion, not the deprecatedosVersion. - Check inclusivity. Decide whether the exact boundary matches. A one-character operator change from
-gtto-gechanges the result for that build. - Check the prefix. Assignment-filter examples use the Windows
10.0.<build>form. Do not substitute the11.0notation documented for Windows compliance settings without evidence that the same syntax applies here. - Compare preview results with inventory. Investigate devices missing from the preview and devices you did not expect to see. Differences can reflect stale check-in data or a version value that is not what your inventory report assumes.
- Test a boundary device. Include a device at the exact cutoff and another just above or below it when possible. This exposes an incorrect inclusive or exclusive operator before a production assignment depends on it.
- Remember timing. Preview is current-state information. The filter is reevaluated when devices check in, so later upgrades, rollbacks, enrollment changes, or reporting delays can alter membership.
Troubleshoot rules that do not behave as expected
The filter cannot be created with osVersion
Replace the deprecated property with device.operatingSystemVersion. Existing filters may continue to function with osVersion, but Microsoft does not allow that property for newly created filters.
The preview is empty
Verify that you selected Windows 10 and later, created the filter for managed devices, and entered the version in the assignment-filter format. Then check whether the enrolled devices have checked in recently. A preview only includes devices whose reported properties currently satisfy the expression.
The exact boundary device is missing
Inspect the operator first. -gt excludes the boundary; -ge includes it. Also confirm that the device reports the same complete version value used in the rule. If the device has not checked in after an upgrade, Intune may still be evaluating its earlier reported version.
The rule builder is unavailable after editing syntax
Microsoft notes that unsupported advanced syntax can disable the basic builder. Reopen the expression in the syntax editor, remove unsupported constructs, or reduce the rule to supported property/operator/value combinations. Use preview after every meaningful change.
The rule matches a different Windows population than expected
A platform selection of Windows 10 and later identifies the supported platform category; it does not itself impose a Windows 11 build requirement. The operating-system version comparison supplies that boundary. Review the numeric value, operator, prefix, and check-in timing separately rather than assuming the platform label performed the version filtering.
Operational guidance for maintaining the filter
Store the policy rationale with the filter’s name or administrative documentation: the target population, exact version boundary, whether the boundary is inclusive, and the policy owner. Re-preview after a major Windows servicing change. If the organization adopts a new minimum build, create a clearly named replacement or update the existing filter through change control so assignments do not silently shift.
Use separate filters for materially different populations, such as a pilot ring and a production minimum, instead of embedding multiple unrelated thresholds in one opaque expression. This makes assignment reviews and incident troubleshooting easier. Keep the expression itself focused on device properties; use the assignment’s include and exclude controls for deployment scope that is not an operating-system condition.
Quick Recap
Key takeaways
- For new managed-device rules, use
device.operatingSystemVersion, not deprecatedosVersion. - Create the filter for Windows 10 and later, then define the Windows version comparison in Rules.
- Use the assignment-filter version form shown in Microsoft’s examples, such as
10.0.22000.1000. - Choose
-gtversus-gedeliberately: only the latter includes the exact boundary. - Preview matching devices before creation, and treat the result as a current snapshot.
- Expect membership to be reevaluated when devices check in; upgrades and stale check-ins can change what matches.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
