Useful roundup, and the compliance myth versus reality section is the most practical part for admins. A few thoughts:
- It is good to see Windows devices detect key security setting changes locally and request a check-in. It would help to publish the exact list of monitored settings, for example whether BitLocker being suspended or turned off is on it, since the intro uses that as its example, and roughly how long the check-in takes in practice.
- Faster reevaluation shortens the time to regain access once the issue is fixed, but the fix itself is a separate step. For a user blocked by Conditional Access, the wait is often the time until a remediation actually runs on the device, not the compliance reevaluation.
- On that side, there are tools that run the fix right away over a live connection and report the result. TFalke is one example (disclosure: I work on it): an AI agent diagnoses the device and fixes it, with the command approved by an operator first. They sit next to Intune, not instead of it.
Also good to see Autopatch separating monthly security updates from non-security ones, since many teams asked for that.
Microsoft