Whether it's Android app deployment, identity setup on macOS, certificate authority renewal, or faster compliance evaluations, the throughline is the same: less friction for the IT admins doing the work.
More control over how admins manage and protect Android devices
A device that never got properly enrolled is still a risk, even if nobody's touched it in months. That's the kind of thing that keeps IT admins up at night. Three Android updates this month each address a different point where that risk shows up: getting devices onto the platform, making sure the right apps land on them, and keeping security policies running once they do.
For enrollment, the Personal Work Profile Android Management API implementation is now generally available. One of the quieter but more effective changes here is that end users no longer have to hunt down the Company Portal app before they start enrollment. Organizations can opt into a web-based enrollment flow where everything begins from a browser, and policies are delivered through the Android Management API from there. That brings personally owned work profile devices onto the same underlying management technology as corporate-owned Android Enterprise scenarios and gives admins a more consistent policy experience across Android.
On the app side, directly managing Android line-of-business (LOB) apps in Intune is now generally available for Android Enterprise fully managed and dedicated devices. Previously, even internally developed apps had to be uploaded and distributed via Managed Google Play. With this update, admins can upload APK files straight to Intune, deploy multiple versions of the same app to different user or device groups, and remove constraints like requiring unique package names. This provides admins more flexibility and control over how internal Android applications are managed and distributed.
Finally, Mobile Threat Defense (MTD) apps can now request enhanced security permissions on Android Enterprise devices, building on the existing MTD connector in Intune. Google is introducing a capability that allows an MTD app to operate with additional security permissions on managed devices. You can use the MTD connector in the Intune admin center to grant those permissions to one MTD app of your choice, such as Microsoft Defender for Endpoint or a supported third-party partner. On Android Enterprise fully managed devices and corporate-owned devices with a work profile, the selected MTD app can be exempted from app suspension, hibernation, and user-initiated restrictions. This helps threat detection and risk evaluation continue running even when the rest of the device is being optimized for battery life or user control.
Platform SSO registration built into macOS setup
Platform SSO with registration during Automated Device Enrollment on macOS is now generally available for macOS devices.
Previously, PSSO registration occurred after enrollment was complete, requiring users to click a notification on their desktop to finish setup. But these notifications are often missed, leading to incomplete SSO configuration, authentication failures in apps like Outlook, and devices that showed as non-compliant in Company Portal. IT teams managing Mac deployments at scale identified this as a consistent friction point.
With this release, PSSO device registration completes automatically during ADE, bootstrapping identity and linking the device to Entra ID before the user ever reaches their desktop. The result is a setup experience where end users arrive at a desktop that is already PSSO-registered, authenticated, and equipped with the identities for accessing resources. This capability is designed for IT teams managing corporate-owned, single-user Mac devices where timing of when identity and enrollment are critical for compliance and productivity. To learn more, read our documentation about configuring PSSO during ADE.
Cloud PKI provides more control over certification authority (CA) renewal
Microsoft Intune now supports renewing an existing Cloud PKI issuing certification authority (CA) directly, helping administrators maintain uninterrupted certificate issuance as a CA approaches expiration. Previously, renewing a CA required creating a new issuing CA and manually updating all dependent Simple Certificate Enrollment Protocol (SCEP) certificate profiles. With this update, eligible Cloud PKI issuing CAs can be renewed in place, generating a new CA certificate and key pair to reduce operational overhead and lower the risk of configuration errors.
This capability helps provide continued certificate-based access for scenarios such as Wi-Fi, VPN, and email without requiring changes to existing SCEP profiles or device assignments. As part of the renewal process, Intune automatically creates a staged CA with a temporary SCEP endpoint, enabling admins to validate issuance and compatibility across their environment in a safe, controlled manner before activation. This staged validation model helps organizations complete renewal with minimal disruption and without taking services offline. To learn more about prerequisites and implementation details, visit the Microsoft Learn page.
Intune: Myth vs. Reality
We hope you enjoyed last month’s Myth vs. Reality entry on latency. This month, the focus is on application management in Intune.
- Myth: App migration to Intune is all-or-nothing. You must move all apps at once or not at all.
- Reality: App management in Intune supports phased adoption. With co-management, you can migrate apps gradually while Configuration Manager continues deploying apps that have not moved yet. Moving the apps workload to Intune enables cloud-native app delivery—apps reach devices anywhere over the Internet, with no distribution points or on-prem infrastructure to maintain. And you manage Windows app deployment in the same place as your macOS, iOS, and Android apps.
- How: Move the Client apps workload when you're ready by starting with a pilot collection, then expand by app type or persona as confidence grows. When migrating by app type, prioritize low-risk and low-complexity categories and apps first to reduce early friction and validate your approach.
For example, start with Microsoft Store apps or apps delivered through Intune Enterprise Application Management, as these often do not require repackaging or customization, then move to simple Win32 applications with minimal dependencies before addressing more complex scenarios. In parallel, or as a follow-on motion, migrate by persona. Start with user groups that have predictable, standardized requirements, such as knowledge workers who primarily use Microsoft 365 apps, a browser, and a small set of common utilities. This helps validate end-to-end deployment, user experience, and support readiness before you expand to more complex roles. From there, you can expand confidently to developers and engineers with customized tool chains.
Start exploring co-management workloads in Configuration Manager and take the first step toward a more flexible, phased migration to Intune. To accelerate your migration, our partners Rimo3 and Robopack are offering a time-limited app migration service to all Intune customers who are looking to move from Configuration Manager to Intune1. To learn more, visit aka.ms/IntuneAppMigration.
This month's features and the Myth vs. Reality section are making the same point: you do not need to solve everything at once. Enroll the predictable users first. Migrate the simple apps before the complex ones. Renew your CA without rebuilding your profiles. Start there, build confidence, and expand. Let us know what you think.
Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.
Microsoft
