Most changes to a device happen without the admin watching. A user turns off BitLocker to troubleshoot something. Patch Tuesday arrives. An agent starts working on a Cloud PC from an admin-configured pool. October’s new capabilities give admins more say over who can change what, and when updates land.
Strengthen compliance with security baselines
A Cloud PC that an agent may use needs security configurations in place before the first task runs. Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Admins can deploy recommended device settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to set up a consistent security posture for agentic workloads that meet your organization’s compliance needs, then customize only what those workloads need.
For organizations that use Security Technical Implementation Guides (STIGs) as part of their security and compliance requirements, Intune’s STIG baseline is now available in Intune for commercial customers, extending its previous government-cloud availability. This allows organizations to audit supported Windows device configurations against recommendations from the Defense Information Systems Agency (DISA), and help them identify settings that don’t meet those recommendations without changing any device settings. Learn more: Manage security baseline profiles in Microsoft Intune and What is Windows 365 for Agents?.
Enable network changes without granting admin rights
Changing an IP address shouldn’t mean handing out local admin rights. Microsoft Intune Endpoint Privilege Management (EPM) now allows standard users without broad administrator access to change network settings through a dedicated experience in Company Portal. Standard users can make IT-approved network changes without waiting for the help desk, while admins keep broader administrator rights restricted.
With an elevation system settings policy, EPM lets standard users change IPv4, IPv6, and DNS server values on their device's network adapters without broad administrator rights or a separate app deployment. Admins can configure the rule as automatic or user confirmed. For user-confirmed rules, they can require a business justification, Windows authentication, or both before the change applies. Learn more: Manage system settings with Endpoint Privilege Management.
Figure 1: Elevation system setting policy creation example in the Microsoft Intune admin centerPlan quality updates around users’ work
Not every update should follow same rollout schedule. When an update isn’t security-critical, you need room to plan deployment around the people using those devices. Windows Autopatch now extends the approval and scheduling process you already use for driver updates to quality updates. IT admins can approve or auto-approve updates by type, schedule deployments, and pause rollouts when needed. This gives admins more flexibility to plan non-security updates around users’ work while responding to security updates according to their urgency.
Admins can manage monthly security updates, monthly non-security updates, out-of-band security updates, and out-of-band non-security updates independently, so rollout timing can follow testing, compliance, and business readiness. These expanded controls also let admins configure .NET Framework updates and Quick machine recovery controls for boot-critical issues. Learn more by reading Windows quality and .NET Framework updates and Quick machine recovery updates resources.
Set up and configure Apple devices
Any new employee’s first morning should focus on starting their new job, not on configuring the feature settings on their new device. This month, users who are provided a company owned Apple device have greater flexibility to get up and running. Automated Device Enrollment profiles now include a Setup Assistant skip key for the Device features tour on supported devices running iOS 27 and iPadOS 27. It joins the Liquid Glass and Accessibility Appearance skip keys Intune added in August.
The Intune management client on macOS now checks in for configuration right after the user signs into the device for the first time, continues with frequent updates for the next couple of hours, and then follows the standard hourly check in schedule while the device is online. That means that apps, scripts, and related assignments reach devices sooner without admin or user action. For more information, see Questions with policies and profiles in Microsoft Intune.
Those check-ins also deliver more Apple settings. The Settings Catalog now includes options for supported iOS/iPadOS and macOS devices covering app settings, Apple Intelligence, network and web content filtering, and the macOS login window, configured through the same Settings Catalog policy workflow. Check out how to create a policy using settings catalog with this guidance.
The iOS/iPadOS Company Portal now supports declarative Volume Purchase Program (VPP) app downloads from the Apps tab. These apps install with less latency, can update automatically overnight, and show users live installation status. If you don't use declarative VPP apps, nothing changes for admins or users.
Intune will add Apple OS 27 declarative device management (DDM) status data to device inventory, giving admins a clearer view of Apple devices in use. Devices report this data as their status changes. Admins will see system health for supported hardware components, content cache details, enhanced logging, and MDM status. The information available will vary by operating system, hardware, enrollment type, and supported DDM capabilities.
Intune: Myth vs. Reality
Myth: Intune takes hours to reevaluate compliance after a policy or security setting changes on a device.
Reality: When a device falls out of compliance, Conditional Access rules can prevent devices from accessing company resources. Supported Windows devices can detect changes to key security settings locally and request a check-in to reevaluate compliance sooner. That speed matters to users as much as admins. This fast reevaluation allows users to quickly regain access to the resources they need once the device meets compliance requirements again.
How: When you update or assign a compliance policy, Intune uses Fast Lane to notify devices to sync and receive the requirements. You’ve changed what the device needs to meet, so Intune prompts it to check in.
But the policy isn’t always what changes. Supported Windows devices also monitor key security settings, even when their compliance requirements stay the same. For example, if the firewall is turned off, the device detects the change and requests a check-in so compliance can be reevaluated without waiting for the next scheduled one, reducing the vulnerability window.
Faster compliance reevaluation can also help users regain access after a security issue is resolved. When a monitored security state improves. For example, when antivirus returns to a healthy, up-to-date, and active state, the device can detect the change and trigger a check-in. Intune can then reevaluate compliance sooner. For users blocked by Conditional Access policies, this can shorten the time between resolving the issue and regaining access to their work.
Learn more: Create a compliance policy in Microsoft Intune, or watch how Intune timing works in the Microsoft Mechanics video at aka.ms/IntuneTimingDemystified.
See what's next at Microsoft Ignite 2026
Next month, instead of a What’s New blog, we’re having Microsoft Ignite 2026, which is happening November 17-20 in San Francisco and online. To see where Intune is headed, register and watch AI ready endpoints: secure, manage and scale (BRK404) with Jason Roszak, VP of Product Management, and Eugenie Burrage, Director of Product Marketing. The session will share how Intune turns insights into policy and action and verifies that each change keeps devices healthy and secure.
Stay connected at Microsoft Ignite. Join us November 17–20 in San Francisco or online to explore the latest Microsoft Intune innovations, connect with the experts behind them, and go deeper with sessions, demos, and hands-on experiences. Explore Microsoft Ignite and plan your experience. Then, keep the conversation going: follow Microsoft Intune for the latest updates, insights, and best practices.
Microsoft