What’s new in Microsoft Intune: March 2025

I travel frequently for work, and I've figured out my process pretty well—except when it comes to emptying my pockets. At home I have a system for where I put my keys, badge, earbuds, and wallet. But when I'm in a hotel room, these essentials scatter themselves across various spaces. I find myself spending more time collecting myself each day, and it reminds me how much I value having everything in one place.

I think about that value when we're planning what to add to Microsoft Intune. We want to be truly unified, because those extra moments spent switching tasks or tools add up to real losses for companies large and small. In that spirit, this month I'm highlighting new capabilities added to an ever-widening list of endpoints.

Automate Apple software policy updates

If you haven't been keeping up with the advances in our macOS management capabilities, don't worry. There's been a lot of exciting news, so much so that we've recapped it all in a dedicated blog. This month, management gets even better. Apple's declarative device management (DDM) protocol introduces new controls for iOS/iPadOS and macOS device management, and Intune continues to keep pace with these expanding capabilities.

The arrival of an update to Apple device software used to mean IT admins would have to make updates to policies specifying a new target OS version and manually update devices to enforce time delays. With this update to Intune, you can now create a policy that keeps all your Apple devices (or just the ones you select) on the most recent OS version available. You'll also be able to use groups and the time delays capabilities to make deployments progressive—releasing to a small set of devices and making sure there are no issues before releasing to a larger group. We covered this topic in-depth in a recent Technical Takeoff session, and I recommend this walk-through and the documentation.

Enhanced configuration of Windows 365 Frontline shared Cloud PCs (preview)

Windows 365 Frontline is an edition of Windows 365 designed for organizations whose users need part-time or temporary access to Cloud PCs (read more about the details in the documentation). Windows 365 Frontline recently released the new “shared mode,” which allows organizations to provide multiple users access to one Cloud PC with a non-personalized desktop experience. These shared Cloud PCs are more accessible, flexible, and economical for many scenarios. However, the provisioning process couldn't always guarantee that device configurations would be delivered before users were signed in. Releasing in early April, we have a public preview of Windows Autopilot device preparation provisioning specifically for Windows 365 Frontline Cloud PCs in shared mode. This capability takes advantage of “automatic mode” in Intune for device preparation policies so that required apps and scripts are delivered to the shared instance before users sign in. The workflow is as follows:

1. Create a device group.
2. Assign apps and/or scripts to the group.
3. Create a device preparation profile in automatic mode.
4. Create a Windows 365 Frontline Cloud PC provisioning policy with shared mode, and assign the device preparation profile.

The Cloud PC report and the Windows Autopilot device preparation deployment reports in Intune will each provide status on deployments. Admins will be able to see granular status per app and script in the Windows Autopilot device preparation report and an overall success or failure status in the Cloud PC report.

New scenario for Microsoft Intune Remote Help

Microsoft Intune Remote Help gives support technicians and users seeking assistance confidence by establishing a secure connection and verifying user identity and device compliance. This is especially useful as cyberattacks become increasingly sophisticated. We're pleased to announce that Remote Help is now coming to Azure Virtual Desktop virtual machines (VMs) that are configured for multisession use. These cost-effective, multisession VMs now have access to the more secure support experience of Remote Help, which will streamline support operations and empower multisession users. Consolidated reporting and monitoring should make security teams happier, too. There's no additional configuration required to enable this support. If you have Remote Help, this update will allow connections from multisession Azure Virtual Desktop VM users just like any other. Read more Intune news and details about Remote Help.

Samsung Knox Mobile Enrollment

We've partnered with Samsung to bring unique capabilities and enhanced security to Samsung Knox devices. The latest is the ability to use the Samsung Knox Mobile Enrollment tool to bulk enroll Android Enterprise devices as:

• Dedicated devices.
• Fully managed devices.
• Corporate-owned devices with a work profile.

This process can be facilitated by a reseller or set up by your IT department, and it helps end users get productive right away. The feature also allows administrators to specify applications to block or allow. For Samsung Galaxy devices, security is enhanced even further with a robust hardware-backed attestation feature. The documentation shows just how simple it is to get started, and we look forward to more collaborations like this in the future.

Valuing unified endpoint management

I no longer take for granted the benefits of having everything I need in one place when I'm walking out the door. The soft costs—including the searching and the lost time—apply to endpoint management, too. That's why we continue to enhance the scenarios, capabilities, and endpoints Intune can handle. Help us determine what you need to be productive. What are the newest endpoint scenarios you're adding to your estate? Let us know about your management wish list in the comments.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.