Planning before the first devices receive updates is an important part of managing a rollout. IT admins must regularly decide which devices go first, how quickly a rollout expands, and where to pause when the signals change. The same need for control shows up during device setup and day-to-day troubleshooting.
September’s Intune updates help more government organizations use advanced management capabilities while giving IT teams greater control over change. Admins can stage app and policy rollouts to reduce deployment risk. From a consolidated view, they can investigate devices to resolve issues faster. From setup through retirement, they can streamline Windows and Android endpoint management.
Extend additional advanced capabilities across government environments
Government IT teams need to manage applications, certificates, and device support within their accredited cloud environments. This month, Intune Enterprise Application Management, Microsoft Cloud PKI, and Intune Remote Help will be available in the Government Community Cloud with high security requirements. Enterprise Application Management is also being offered to organizations of the Department of Defense (DoD).
This builds on the July availability of Intune Advanced Analytics and Endpoint Privilege Management, giving government admins more ways to assess device health, strengthen security, manage apps and certificates, and support endpoints through Intune. For an overview of all these capabilities and their availability, check out our public sector blog here.
Plan app and policy rollouts with Microsoft Intune deployments
Controlled rollouts helps IT teams reduce risk before changes reach the entire organization. Microsoft Intune deployments, now in public preview, bring this phased rollout model to support Windows apps and configuration policies so teams can validate change with smaller groups and expand with greater confidence.
Admins can reduce rollout risk by organizing users and devices into rings, controlling when each ring receives an assignment, and applying exclusions that apply across the deployment. They can monitor ring activation in the Intune admin center so teams can respond to changing signals by pausing, resuming, or canceling an active deployment when needed. Existing Intune role-based access controls and scope tags continue to apply, preserving established governance as teams gain more control over rollout timing.
Deployment plans save time by letting admins reuse a proven rollout structure across supported apps and policies. Admins can define the rings, groups, exclusions, and timing once, then reuse the plan across supported apps and policies. When a reusable plan isn’t needed, they can instead configure rings for a one-time deployment.
In public preview, Microsoft Intune deployments support Windows devices and:
- Win32 apps
- Enterprise App Catalog apps
- Settings catalog policies
- Endpoint security policies
To get started, read the Microsoft Intune deployments overview.
Figure 1: Deployments page in the Microsoft Intune admin center showing the status of app and device configuration rollouts across deployment rings.Investigate and act from one device view
The redesigned device page helps admins investigate issues faster by reducing the need to move between separate views. Now the default device view in the Intune admin center brings device details, recent activity, tools, reports, and supported actions together in one place.
From Devices > All devices admins can select a device to check its details and review recent activity, open tools and reports, and run supported actions without leaving the device view. The consistent layout across supported platforms reduces relearning, while actions grouped by purpose makes the next step easier to find. The page displays only actions supported by the device and permitted for the signed-in admin, and all tasks and reports from the previous page remain available. This gives help desk admins one place to understand device status and take appropriate actions.
Figure 2: Microsoft Intune admin center device overview, with an example of a Windows device marked as not compliant and displaying configuration, compliance, app, and Endpoint Analytics status.Manage Android devices from setup through retirement
With Intune bulk device actions, admins can reduce the manual work required to provision, reassign, or retire Android devices. Admins can activate eSIMs on up to 100 supported corporate-owned Android Enterprise devices running Android 15 or later in a single action using one carrier activation server URL, rather than configuring each device separately. This capability supports corporate-owned fully managed devices, dedicated devices, and corporate-owned devices with a work profile.
During a bulk Wipe action, Intune preserves the eSIMs by default. Admins can retain them when devices are reassigned or remove them when devices are taken out of service. For requirements and configuration guidance, see Manage eSIM cellular plans with Microsoft Intune device actions.
Figure 3: Microsoft Intune admin center showing bulk device actions with Wipe selected for Android devices and the option to remove the device’s data plan.Another Android update allows Frontline users on shared devices to answer urgent Microsoft Teams calls without weakening access protections for other work. If an incoming Microsoft Teams call arrives before Managed Home Screen authentication is complete, the user can accept or decline the call directly from the notification. Managed Home Screen asks for the session PIN before the user can move into any other protected app activity.
The Managed Home Screen capability is generally available and applies to MAM-integrated apps that use the Intune App SDK, including non-Microsoft apps. The signed-in user must have an applicable App Protection Policy assigned for the app. Admins do not need to enable a specific setting in that policy.
The two updates address different points in the Android device lifecycle. Bulk eSIM actions reduce device-by-device work during deployment and retirement, while Managed Home Screen protects app access during shared-device sessions.
Intune: Myth vs. Reality
Myth: There are no bandwidth controls for Windows-based content in Intune, and peer sharing through Delivery Optimization is not suitable or effective for enterprise environments.
Reality: Intune gives admins controls to manage bandwidth for supported Windows content. Delivery Optimization also provides optional peer-sharing capabilities designed to source eligible content already in their environment rather than relying only on internet sources.
How: Admins can shape how content moves across the network with Intune by defining peer groups, setting cache limits, controlling foreground and background download bandwidth, and capping monthly uploads to internet peers. Delivery Optimization can combine peers and Microsoft Connected Cache with Microsoft content sources while fallback-delay settings give local content sources more time before an internet download begins.
Results will vary by environment and available content. The Windows Update for Business Delivery Optimization report shows observed bandwidth savings and content sources over the previous 28 days, which admins can use when reviewing their Delivery Optimization configuration.
See how Delivery Optimization peer groups and bandwidth controls work with Microsoft Connected Cache to reduce internet traffic for supported Microsoft content.
September’s updates help IT teams make changes with less risk, resolve device issues with less context switching, and reduce manual work across the Android device lifecycle. By combining staged rollouts, a consolidated device view, and streamlined device actions, Intune gives admins clearer checkpoints and faster ways to respond. We’d like to hear which of these improvements will make the biggest difference for your team.
Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.
Microsoft