Microsoft Intune Blog articles

What’s new in Microsoft Intune – July

ScottSawyer — Tue, 28 Jul 2026 22:03:17 GMT

Ask an IT admin what a good day looks like, and it usually comes down to one word: control. Control means you push a change and know it landed. It means you have a clear view into your device fleet, from compliance status to sync health. That certainty is what helps IT stay ahead and deliver.

Still, endpoint management gets harder as fleets grow across locations and device types. More devices and policies rarely mean fewer admin hours. This month's updates focus on giving IT clearer visibility and more confident action.

Demystify Windows device sync status

When admins troubleshoot a device, they need visibility into what’s happening. The updated per-device sync experience in the Intune admin center now shows progress, making it easier for admins to confirm actions are running and understand where they are in the process.

The updated sync action also triggers both the mobile device management check-in and the Intune Management Extension (Windows only) check-in. One sync can now pull-down policy, app, and script changes in a single pass. For admins working through a single-device issue, this makes sync more transparent, more complete, and easier to trust as a troubleshooting step. Learn more about sync actions for Windows and how to use them to troubleshoot and validate device state.

Figure 1: The Sync status pane tracks each step live, from notifying the device to calculating compliance.

Want a deeper story about how we delivered this change? Read the blog about how Intune helps IT prioritize time-sensitive actions or catch the recent Microsoft Technical Takeoff video on Intune timing demystified.

Help ensure compliance for macOS

This month, custom compliance settings for macOS became generally available. Admins can use these settings to apply organization-specific requirements that built-in compliance settings don’t cover. This extended coverage helps reduce risk and unblock macOS deployments by aligning compliance and Conditional Access requirements with the Intune security policies organizations need to manage them. To learn more about compliance policies and what they do, see "Use compliance policies to set rules for devices you manage with Intune."

Additionally, using discovery scripts and JSON rules, admins can inspect many macOS device attributes and conditions. Think about installed software, running processes, app versions, or security posture that no Apple built-in setting captures. Now macOS devices report compliance the same way Windows and Linux devices do, giving you one consistent view instead of three different ones. Read more about how to set up the custom compliance settings documentation for Microsoft Intune.

More control over Samsung firmware updates

Keeping firmware current becomes harder as your mobile device fleet grows. For example, a new version may need testing against line-of-business apps before reaching production devices. In a Zero Trust environment, every unpatched device can become a compliance gap waiting to happen.

The Samsung Knox Enterprise Firmware-Over-The-Air (E-FOTA) integration brings precise control over firmware and OS updates across their Galaxy devices into the Microsoft Intune console. Existing Intune device groups determine which devices receive each version. If group membership changes, the firmware assignment follows.

Admins can keep production devices on their current version while testing an update. After validation, they can roll it out gradually during planned maintenance windows. Battery requirements and postponement limits provide more control over installation timing. This helps maintain consistent firmware and compliance across the fleet.

Intune: Myth vs. reality

Myth: Windows Autopilot requires device registration for new PCs.

Reality: Device registration is not required in all Windows Autopilot scenarios. Many IT admins associate Windows Autopilot with device registration because the original Windows Autopilot solution uses registration to identify devices. Today, organizations can choose from multiple Autopilot approaches depending on their deployment needs.

Windows Autopilot helps IT remotely provision devices at scale across a range of deployment scenarios, including existing devices, pre-provisioning, self-deploying deployments, and remote users.

Windows Autopilot device preparation helps streamline Windows 11 provisioning without requiring Windows Autopilot registration. It uses enrollment-time grouping to deliver selected apps and scripts during setup, with near real-time deployment reporting.

How to choose the right Autopilot approach: If you need registration-based deployment scenarios, such as pre-provisioning, self-deploying deployments, or existing device provisioning, use the original Windows Autopilot solution. Use Windows Autopilot device preparation when you want to streamline Windows 11 onboarding without Windows Autopilot registration and deliver selected apps and scripts during setup before users reach the desktop.

Windows Autopilot in action: Watch Microsoft MVP Jonathan Edwards walk through remote, at-scale onboarding with Intune. You will get a step-by-step look at both Windows Autopilot and Autopilot device preparation in action, along with guidance on choosing the right approach for your environment.

Keep the conversation going

Control rarely arrives as one big feature or capability. It shows up in the smaller updates admins lean on daily. A sync they can watch, a compliance rule they can shape, or a firmware update they can run with confidence. Together, these capabilities add more certainty and give time back. That is how modern endpoint management should work.

In that same spirit, staying in control means staying current as threat response speeds up. Read our recent post by Jason Roszak for practical guidance on building a patch strategy with Microsoft. Let us know in the comments what you think of these new capabilities and stay tuned for more next month.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5

jfd — Wed, 01 Jul 2026 16:00:00 GMT

Across industries, customers are already using advanced Microsoft Intune Suite capabilities to solve real endpoint challenges, such as reducing standing privilege, improving IT response times, modernizing certificate management, and preparing for AI-assisted operations.

Now, more Microsoft 365 customers can put these same capabilities to work. The packaging changes announced in December 2025 are now in effect. As of July 1, advanced Intune Suite capabilities are included in Microsoft 365 E5, with select capabilities available in Microsoft 365 E3,¹ as shown below:

The above table highlights how advanced Microsoft Intune capabilities are included across Microsoft 365 E3 and E5.

Why this change matters now

Endpoint management is being redefined as IT and security teams look beyond disconnected tools toward a platform that brings identity, security, compliance, and AI governance together across endpoints.

Microsoft Intune helps organizations move from principle to execution. It gives admins visibility and control across devices, with clear audit trails and consistent policy enforcement, reducing potential risk before attackers can exploit it. Microsoft was recently recognized as a Leader in The Forrester Wave™: Endpoint Management Platforms, Q2 2026. Strengthening endpoint management using Microsoft Intune can help advance Zero Trust through healthier devices, least-privilege access, consistent policies, and trusted data—an essential foundation for AI-era operations.

The customer stories below show what this looks like in practice: protecting endpoints, empowering IT teams, and optimizing IT operations with AI-driven capabilities, including Microsoft Security Copilot in Intune.²

Protect endpoints

Protecting endpoints starts with reducing everyday risks, such as standing admin rights and certificate infrastructure that can be difficult to manage.

Microsoft Intune Endpoint Privilege Management (EPM) removes broad local admin rights while still allowing users to complete approved tasks that require elevation. This supports a Zero Trust approach such as least privilege, without slowing productivity.

Organizations like Hino Motors are applying EPM across both Cloud PCs and physical PCs to maintain a consistent security posture. For Hino Motors, EPM is part of a broader Windows 365 and Intune security model that helps reduce administrative privilege while keeping work moving.

“Intune allows us to manage both Cloud PCs and physical PCs without distinction, and I feel that it is a big plus. With the introduction of Windows 365, we will eliminate administrative privileges as part of our security enhancements, and to do so, we are using Microsoft Intune Endpoint Privilege Management (EPM).”

Masahiro Kimura, Office Head of Communication Infrastructure Office, Hino Computer System Co, Ltd

Traditional Public Key Infrastructure (PKI) solutions can be complex to deploy, costly to maintain, and slow to scale. Microsoft Cloud PKI addresses this with a fully managed, cloud-based service that automates certificate lifecycle management, removing the need for on-premises infrastructure and establishing a path for certificate-based authentication.

Türkiye’s largest integrated industrial group, SOCAR Türkiye, applied advanced Microsoft Cloud PKI features across its devices, helping establish a unified Zero Trust security model that verifies all access explicitly.

“[Cloud PKI] was a very important feature because the devices may be used by executives who have access to highly confidential information. We wanted to ensure that they have streamlined access to do what they need to do while also ensuring security.”

Fırat Bilmiş, IT System Services Supervisor, SOCAR Türkiye

Across industries, the outcome is consistent: stronger security, reduced risk, and a foundation to build on. That foundation enables a faster response and more effective troubleshooting, helping IT teams keep operations running and users productive.

Empower IT

Empowering IT starts by reducing the time between identifying a problem and resolving it. Remote support is no longer just a help desk convenience. It can become a business continuity lever for organizations with distributed operations.

Some remote support tools operate outside an organization’s identity and device management controls. Microsoft Intune Remote Help supports Zero Trust principles through identity, role-based access, and policy controls.

Manufacturing organization Krones AG highlights this impact, demonstrating its importance for global operations and the ability to support users without delay.

“We use Remote Help to support users wherever they are, without needing to be physically in front of their device.”

David Meneses, User and Endpoint Services, Krones AG

Remote Help provides a more secure, auditable way for IT admins to assist users, helping accelerate resolution while maintaining access and compliance controls.

Empowerment also comes from increased visibility. Microsoft Intune Advanced Analytics helps teams move from reactive troubleshooting to proactive endpoint management by surfacing device health, performance issues, and anomalies. Within Advanced Analytics, capabilities like near real-time device query and Multi-Device Query (MDQ) give IT the ability to investigate individual devices or analyze device data at scale, helping teams quickly identify issues, understand their impact, and take action with confidence.

This level of visibility becomes even more important as estates grow beyond PCs to include shared, mobile, and frontline devices. European fashion retailer Lindex demonstrates how scalable access to device data can give IT the oversight needed across a distributed retail environment. By using Intune to manage shared Android devices across stores, Lindex helps employees spend more time with customers and less time addressing device issues.

“With Intune, we can see the health of all the [Android] devices and keep them secure without disrupting store operations. It’s reliable, scalable, and gives us the control we need to support all our stores.”

Niklas Jenslov, Platform Engineer, Lindex

The advanced mobile capabilities that are part of Intune Plan 2 — and now included in Microsoft 365 E3 and E5 — help extend these same controls to Android, iOS, and specialized endpoint scenarios.

This includes purpose-built devices, firmware update management for supported Zebra Android devices, and Microsoft Tunnel for Mobile Application Management (MAM), which also supports Android and iOS/iPadOS. MAM protects corporate data within apps without requiring device enrollment. Microsoft Tunnel for MAM extends this further by enabling secure access to on-premises app resources from unenrolled devices through per-app VPN, helping organizations support BYOD scenarios while maintaining secure access to corporate resources.

Organizations are also simplifying application management with Microsoft Intune Enterprise Application Management (EAM), helping streamline application deployment and keep apps consistently up to date. EAM reduces manual packaging and maintenance effort by automating application deployment and updates, while helping users get faster access to the tools they need to stay productive. Building on the application management capabilities already available in Intune, EAM further simplifies software delivery at scale.

Carlsberg Group demonstrates this impact through less hands-on work for IT and fewer support delays for users.

“With Microsoft Intune, our end-users can install all the permitted applications they need directly to their laptop without waiting for IT on-site support to help them,”

Oleksii Giriiev, Service Owner for Endpoint Management and ServiceNow, Carlsberg Group

With secure remote support, access to scalable device data, and simplified application and mobile management within one solution, IT teams can move faster, act with greater confidence, and give users the support they need—wherever work happens.

Optimize with AI

With endpoints well-managed and IT equipped to act, the next opportunity is putting AI to work in the management workflow—surfacing insights, assessing risk, and guiding action.

Microsoft Security Copilot in Intune brings AI directly into the endpoint management workflow, helping admins use natural language to explore Intune data, gather insights, and take action without leaving the Intune admin center. For EPM, Copilot can help assess applications risks before elevation requests are approved, giving admins more context for least-privilege decisions. In Advanced Analytics, Copilot can also help admins build and refine KQL queries, lowering the barrier to deeper endpoint analysis and helping teams translate complex device data into practical next steps.

The Vulnerability Remediation Agent for Security Copilot in Intune is an example of how AI-assisted endpoint management can work. It uses Defender Vulnerability Management data to identify and prioritize high-risk Common Vulnerabilities and Exposures (CVE) on managed devices, provides recommendations for remediation, and guides admins through the steps they can take within Intune. This brings advanced endpoint management and AI-assisted operations together, helping IT understand what is happening and determining what matters, while leveraging the tools they already use.

PepsiCo’s Intune story points to that next step, helping IT act faster, with better context and stronger controls.

“We’re already working with Microsoft to understand new offerings like Security Copilot and Copilot in Intune, our goal is to eliminate repetitive tasks and provide a seamless, intelligent experience for our workforce.”

Sameer Rane, Director, Global Workplace Services, PepsiCo

As AI becomes part of everyday endpoint operations, advanced Intune capabilities help IT teams build the secure, data-rich foundation they need to adopt these experiences with greater clarity, control, and impact.

Get started with advanced endpoint management

Across these stories, the through-line is consistent: a strong, well-managed endpoint foundation enables stronger security, faster IT response, and trusted AI adoption. With advanced Microsoft Intune Suite capabilities now included in Microsoft 365 E5, and select capabilities in Microsoft 365 E3, more organizations can put these capabilities to work.

Whether reducing standing privilege, modernizing certificate management, streamlining application delivery, or preparing for AI-assisted operations, these capabilities work together to help IT teams manage and secure endpoints from a trusted management solution. Organizations can realize these benefits sooner by adopting the advanced Intune capabilities available through their existing Microsoft 365 plans and subscriptions.

To get started:

Check your Microsoft 365 E3 or E5 eligibility.
Review Message Center notifications to see what is available in your tenant.
Connect with your account team to discuss the right adoption path for your organization.

¹ Feature availability and included capabilities vary by Microsoft 365 subscription plan. Some advanced Microsoft Intune capabilities may require additional licenses. Existing customers will receive a 30-day notice in their Microsoft Admin Center and will have access by August 2026.

² Microsoft Security Copilot and related AI capabilities may require separate licensing, learn more here.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What’s new in Microsoft Intune – June

ScottSawyer — Mon, 06 Jul 2026 16:53:47 GMT

Editor's note (July 2026): This post has been updated since its original publication. Content related to Intune Endpoint Privilege Management capabilities for system-level network configuration has been removed.

AI agents are beginning to act on behalf of users, interact with company data, and even make decisions independently. Trusting AI depends on three endpoint fundamentals: they must be compliant, up to date, and secure from the moment they enroll. This month’s new capabilities for Intune emphasizes these important checkpoints.

Keep applications current and reduce vulnerability exposure

Keeping applications up to date sounds straightforward until you're managing hundreds of endpoints and dozens of application versions. Manual packaging processes lead to version drift and inconsistent application states, which makes vulnerability remediation harder and security posture less predictable. 

Microsoft Intune Enterprise Application Management (EAM) helps organizations move away from fragmented workflows toward a more unified, cloud-native approach, with deployments, updates, and policy configuration in one place. EAM auto-updates is now generally available and automatically helps keep managed applications on the latest incremental release, such as 4.1 to 4.2, without manual packaging or admin intervention. This helps limit exposure to known vulnerabilities between full version upgrade cycles.

Figure 1: View of the Intune admin center showing how to apply auto-updates for application management.

But even with EAM auto-updates helping shrink the vulnerability window, new risks may still arise between update cycles. That's where the Vulnerability Remediation Agent comes in. Operating within Microsoft Security Copilot and now in public preview, the agent draws on Microsoft Defender Vulnerability Management to prioritize Common Vulnerabilities and Exposures (CVEs) across your Intune-managed Windows devices and apps.

When the agent runs, it ranks what matters most so you are not starting from a blank CVE list. Recommendations are prioritized by Common Vulnerability Scoring System (CVSS) score, exposure impact, affected device count, and appear directly in the Intune admin center on both the Agents page and the Endpoint security page. When IT admins examine any recommendation, they will see the related CVE count, a summary of the impact assisted by Copilot, suggested actions, the systems affected, the devices exposed, and detailed guidance on how to fix the issues. After taking action, administrators can mark the recommendation as completed.

The Vulnerability Remediation Agent also operates under a dedicated Microsoft Entra agentic identity, provisioned during setup, rather than under a human user account. Admins delegate the required read permissions to that identity in the Intune and Defender admin centers before the first run. This keeps the agent's scope clearly bound and gives admins a clean audit trail of what it accessed and when. For more information, read our latest blog on Triage vulnerabilities faster with the Vulnerability Remediation Agent.

Extend least-privilege controls to shared devices

Keeping apps current and staying ahead of known vulnerabilities reduces the attack surface. But risk does not only come from unpatched software; it also comes from who has access and how that access gets granted in the moment. This month, we’ve made support approval requests for non-primary users generally available in Intune Endpoint Privilege Management. This capability helps address how elevations work in environments that do not follow a single-user-per-device model.

Support approval requests for non-primary users extends file elevation requests to any user on a device rather than just the primary enrollee. For example, in organizations running shared workstations across rotating shifts, elevation requests from non-primary users can push IT to create workarounds that can erode a secure least-privilege posture over time. The new capability for support approval requests changes that by routing elevation requests through an auditable workflow regardless of who has signed in, keeping IT in control of every elevation decision.

Faster, more complete enrollment across all platforms

In the June release of Intune, iOS/iPadOS and macOS automated device enrollment (ADE) profiles will move to a new infrastructure that enables Intune to speed up the delivery of new features. This update rebuilds the enrollment policies experience for Apple ADE devices, reorganizing authentication and removing outdated settings to share more granular policy controls.

The new experience completes Intune support of enrollment time grouping (ETG) across all platforms with the addition of iOS/iPadOS and macOS corporate device enrollment with ADE. ETG allows policies and apps targeted to a static group to apply at enrollment time for supported enrollment methods, so critical configurations (i.e., policies and apps targeted to the specific static group) are already in place when a user reaches the home screen. Devices arrive more secure, and users can be productive right away without waiting for policies to catch up. For a full walkthrough of the new experience, see the New iOS/iPadOS, visionOS, tvOS and macOS ADE enrollment policies experience blog on Microsoft Tech Community.

Intune: Myth vs. Reality

We hope you enjoyed last month’s reality check on app migration. This month, we’re continuing the conversation on applications with a myth focused on app refresh data.

Myth: Intune takes seven days for Discovered apps to refresh app inventory data.

Reality: That seven-day figure was an oversimplification that stuck. No one refresh number existed for every app on every platform, and that seven-day calculation did not apply to the apps an organization’s workforce uses most. Win32 apps listed in Add/Remove Programs collect data every 24 hours, while Windows store apps and apps on non-Windows platforms can have refresh cycles of up to seven days. And now it's getting even better. The new app inventory experience in the All Apps page refreshes its data multiple times per day for active devices, including both Win32 and Windows store apps. This report also shows details that the earlier report did not capture, including install location, app size, and uninstall commands for each app.

How: Intune continues to enhance its underlying platform infrastructure, resulting in a fresher, more detailed app inventory. This comes from sustained improvements across three fronts: a reconfigured data platform that collects app data; reduced latency that moves data faster; and reporting updates that brings it into the console.

To learn more, take a closer look at the investments we’re making to support faster, more predictable delivery to devices. You can also see how app data is collected and refreshed in the enhanced app inventory experience. Follow the What's New in Microsoft Intune blog each month to read how these improvements are reflected in the console.

The work behind each capability update is the same whether it shows up in a CVE list, an elevation workflow, or an enrollment screen. AI agents can only move as fast as the foundations beneath them allow. EPM and EAM are now part of Microsoft 365 E5 from July 1. If you missed the December announcement on what that means for your organization, it is worth a read before these capabilities land in your tenant.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn  or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

IT experts weigh in: Advanced Intune capabilities coming to Microsoft 365 E3 and E5

Lior_Bela — Thu, 18 Jun 2026 16:00:00 GMT

Back on December 4th, we shared that advanced capabilities from the Microsoft Intune Suite were coming to Microsoft 365 E3 and Microsoft 365 E5. These packaging changes become effective on July 1st, with existing eligible customers expected to receive the capabilities in their tenants by August¹. So you can understand how these capabilities will help your organization, we’ve pulled together a select set of guides and reviews from IT experts who have earned Microsoft “Most Valuable Professionals” (MVP) status. These MVPs from across segments and industries have real-world experience and lots of hands-on time with Intune.

So, whether you're a security admin sizing up Endpoint Privilege Management, an IT pro curious what Advanced Analytics reveals about your fleet, a help desk lead rethinking Remote Help, or someone just getting started with Intune, there's something here for you. This roundup is packed with practical, honest, in-practice perspectives from the people who know these capabilities best.²

The focus now is on the practical details: what each capability does, where it fits, and what to consider before deployment. The MVP resources below help answer those questions with implementation guidance, technical context, and comparisons that can help teams evaluate the right approach for their environment.

Here’s a quick refresher on the Microsoft 365 plan changes related to Microsoft Intune:

Microsoft 365 plan²

Newly included Intune capabilities 

EMS E3  
(Included in Microsoft 365 E3) 

Intune Remote Help  
Intune Advanced Analytics  
Intune Plan 2 

Microsoft 365 E5 

All the above plus

Intune Endpoint Privilege Management  
Microsoft Cloud PKI   
Intune Enterprise App Management 
Microsoft Security Copilot 

One place to manage it all

Customers have been clear that they want to make full use of the capabilities already included in their licenses and manage them from a more centralized platform. They also want to understand the tradeoffs: how consolidation changes day-to-day operations, how these capabilities work with Cloud PCs, and what it means to reduce reliance on multiple vendors, contracts, and support models.

The Microsoft MVP resources below tackle those questions directly such as what's included in your license and how integrated endpoint management plays out in practice.

Microsoft Intune Suite in E3 vs E5: What's Included from July 2026 – Dean Ellerby
Intune Suite: Not an Add-on but a part of your Microsoft 365 Suite – Johan Adreaan (Arno) van Dijk
One Console, Every Endpoint: Why 2026’s Microsoft 365 Update Actually Matters for Your Cloud PCs – Jon Jarvis
Windows 365 x Intune Suite: Looking Beyond the Feature List – Jeroen Burgerhout

Our MVPs have also taken deep dives into the individual capabilities that are coming to E3 and E5 (and are still available to other license holders as an add-on).

Advanced Analytics

Advanced Analytics gives IT teams a clearer view of endpoint health and performance, with capabilities like device query, anomaly detection, and battery health reporting that build on endpoint analytics. For Microsoft 365 E3 and E5 customers, troubleshooting and fleet-wide visibility are now part of the plan. See the official documentation here.

Get Ready for Advanced Analytics in M365 E3 and E5 – Florian Salzmann & Jannik Reinhard
Microsoft Intune Advanced Analytics more than Endpoint Analytics – Sander Rozemuller
Using Intune Suite Advanced Analytics to Solve Issues Faster – Panu Saukko
Intune Advanced Analytics: How It Compares to Other Tools – Jannik Reinhard

Remote Help

Remote Help is a cloud-based solution that enables secure, role-based help desk connections to managed devices, with support for unattended scenarios and compliance with Intune's RBAC model. See the official documentation here.

How to Implement Intune Remote Help – Thant Zin Phyo
You have Intune Remote Help already, you might as well use it – Gerry Hampson
Microsoft Intune Remote Help: My Overview – Nicklas Ahlberg

Endpoint Privilege Management

Endpoint Privilege Management (EPM) lets organizations elevate permissions for specific, IT-approved tasks on a just-in-time basis, avoiding the need to create users with ‘admin’ privileges for routine activities, directly supporting a Zero Trust, least-privilege posture. See the official documentation here.

Microsoft Intune Endpoint Privilege Management Overview – Jorgen Nilsson
The end of local admin - How Intune Endpoint Privilege Management solves a problem IT has lived with for decades – Mattias Melkersen Kalvåg & Simon Skotheimsvik
When Intune Endpoint Privilege Management Wins, and When It Does Not – Florian Salzman

Just getting started with Intune?

If all this is new to you, you don’t need to absorb every advanced capability at once. A great place to begin is Albin Klinaku's guide, which walks through what these E3 and E5 changes mean for someone getting started and breaks down the fundamentals in an approachable way. From there, the official Microsoft Intune overview on Microsoft Learn provides tutorials. Start there, explore at your own pace, and you'll be ready to make the most of everything coming to your tenant.

A special thanks to our contributors

None of this guidance would exist without the community behind it, which brings me to the people who made this roundup possible. A big thank you to the MVPs who took the time to share their perspectives on this important news:

Your expertise, generosity, and willingness to share continue to elevate the entire Intune community. Thank you for everything you do. Stay secure, stay innovative, and be well.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What’s new in Microsoft Intune – May

ScottSawyer — Thu, 28 May 2026 21:58:33 GMT

Whether it's Android app deployment, identity setup on macOS, certificate authority renewal, or faster compliance evaluations, the throughline is the same: less friction for the IT admins doing the work.

More control over how admins manage and protect Android devices

A device that never got properly enrolled is still a risk, even if nobody's touched it in months. That's the kind of thing that keeps IT admins up at night. Three Android updates this month each address a different point where that risk shows up: getting devices onto the platform, making sure the right apps land on them, and keeping security policies running once they do.

For enrollment, the Personal Work Profile Android Management API implementation is now generally available. One of the quieter but more effective changes here is that end users no longer have to hunt down the Company Portal app before they start enrollment. Organizations can opt into a web-based enrollment flow where everything begins from a browser, and policies are delivered through the Android Management API from there. That brings personally owned work profile devices onto the same underlying management technology as corporate-owned Android Enterprise scenarios and gives admins a more consistent policy experience across Android.

On the app side, directly managing Android line-of-business (LOB) apps in Intune is now generally available for Android Enterprise fully managed and dedicated devices. Previously, even internally developed apps had to be uploaded and distributed via Managed Google Play. With this update, admins can upload APK files straight to Intune, deploy multiple versions of the same app to different user or device groups, and remove constraints like requiring unique package names. This provides admins more flexibility and control over how internal Android applications are managed and distributed.

Finally, Mobile Threat Defense (MTD) apps can now request enhanced security permissions on Android Enterprise devices, building on the existing MTD connector in Intune. Google is introducing a capability that allows an MTD app to operate with additional security permissions on managed devices. You can use the MTD connector in the Intune admin center to grant those permissions to one MTD app of your choice, such as Microsoft Defender for Endpoint or a supported third-party partner. On Android Enterprise fully managed devices and corporate-owned devices with a work profile, the selected MTD app can be exempted from app suspension, hibernation, and user-initiated restrictions. This helps threat detection and risk evaluation continue running even when the rest of the device is being optimized for battery life or user control.

Platform SSO registration built into macOS setup

Platform SSO with registration during Automated Device Enrollment on macOS is now generally available for macOS devices.

Previously, PSSO registration occurred after enrollment was complete, requiring users to click a notification on their desktop to finish setup. But these notifications are often missed, leading to incomplete SSO configuration, authentication failures in apps like Outlook, and devices that showed as non-compliant in Company Portal. IT teams managing Mac deployments at scale identified this as a consistent friction point.

With this release, PSSO device registration completes automatically during ADE, bootstrapping identity and linking the device to Entra ID before the user ever reaches their desktop. The result is a setup experience where end users arrive at a desktop that is already PSSO-registered, authenticated, and equipped with the identities for accessing resources. This capability is designed for IT teams managing corporate-owned, single-user Mac devices where timing of when identity and enrollment are critical for compliance and productivity. To learn more, read our documentation about configuring PSSO during ADE.

Cloud PKI provides more control over certification authority (CA) renewal

Microsoft Intune now supports renewing an existing Cloud PKI issuing certification authority (CA) directly, helping administrators maintain uninterrupted certificate issuance as a CA approaches expiration. Previously, renewing a CA required creating a new issuing CA and manually updating all dependent Simple Certificate Enrollment Protocol (SCEP) certificate profiles. With this update, eligible Cloud PKI issuing CAs can be renewed in place, generating a new CA certificate and key pair to reduce operational overhead and lower the risk of configuration errors.

This capability helps provide continued certificate-based access for scenarios such as Wi-Fi, VPN, and email without requiring changes to existing SCEP profiles or device assignments. As part of the renewal process, Intune automatically creates a staged CA with a temporary SCEP endpoint, enabling admins to validate issuance and compatibility across their environment in a safe, controlled manner before activation. This staged validation model helps organizations complete renewal with minimal disruption and without taking services offline. To learn more about prerequisites and implementation details, visit the Microsoft Learn page.

Intune: Myth vs. Reality

We hope you enjoyed last month’s Myth vs. Reality entry on latency. This month, the focus is on application management in Intune.

Myth: App migration to Intune is all-or-nothing. You must move all apps at once or not at all.

Reality: App management in Intune supports phased adoption. With co-management, you can migrate apps gradually while Configuration Manager continues deploying apps that have not moved yet. Moving the apps workload to Intune enables cloud-native app delivery—apps reach devices anywhere over the Internet, with no distribution points or on-prem infrastructure to maintain. And you manage Windows app deployment in the same place as your macOS, iOS, and Android apps.

How: Move the Client apps workload when you're ready by starting with a pilot collection, then expand by app type or persona as confidence grows. When migrating by app type, prioritize low-risk and low-complexity categories and apps first to reduce early friction and validate your approach.

For example, start with Microsoft Store apps or apps delivered through Intune Enterprise Application Management, as these often do not require repackaging or customization, then move to simple Win32 applications with minimal dependencies before addressing more complex scenarios. In parallel, or as a follow-on motion, migrate by persona. Start with user groups that have predictable, standardized requirements, such as knowledge workers who primarily use Microsoft 365 apps, a browser, and a small set of common utilities. This helps validate end-to-end deployment, user experience, and support readiness before you expand to more complex roles. From there, you can expand confidently to developers and engineers with customized tool chains.

Start exploring co-management workloads in Configuration Manager and take the first step toward a more flexible, phased migration to Intune. To accelerate your migration, our partners Rimo3 and Robopack are offering a time-limited app migration service to all Intune customers who are looking to move from Configuration Manager to Intune¹. To learn more, visit aka.ms/IntuneAppMigration.

This month's features and the Myth vs. Reality section are making the same point: you do not need to solve everything at once. Enroll the predictable users first. Migrate the simple apps before the complex ones. Renew your CA without rebuilding your profiles. Start there, build confidence, and expand. Let us know what you think.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn  or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What’s new in Microsoft Intune – April

ScottSawyer — Thu, 30 Apr 2026 19:21:31 GMT

April's Intune updates focus on three areas administrators have consistently asked us to improve: fresher device data, streamlined identity foundations across platforms, and simpler management for non-traditional endpoints. This month includes advancements in Windows app inventory, Linux single sign-on (SSO), and expanded enrollment and control for Apple devices.

Higher‑frequency app inventory updates for Windows devices

IT administrators monitoring applications often rely on a feature known as Discovered apps. With the general release of enhanced app inventory capabilities in the “All Apps” tab, this function provides more detailed and more frequently refreshed inventory data. Some platforms refresh Discovered apps inventory every seven days. App inventory now updates Windows apps on a more frequent schedule, uploading only changes since the last sync, which can help limit additional network usage. App inventory data is updated across the fleet, with most active, healthy Windows devices refreshed multiple times per day.

Besides more frequent data, the range of properties collected by the inventory agent has expanded. Install paths, install dates, uninstall commands, estimated size, architecture, and per-user install scope are now included. Store-specific identifiers and supported languages, which were not part of the Discovered apps before, are also included here. IT admins also benefit with how inventory collection takes place across all users who have accessed the device and not just the logged-in user, helping reduce issues of applications coming and going as users change.

To take advantage of app inventory, a new device configuration policy should be set up based on Properties Catalog and assigned to corporate-owned Windows 11 devices enrolled in Microsoft Entra ID. Once configured, inventory data will start coming in on subsequent check-ins.

Modernized SSO for Linux endpoints

The new sign-in process offers Linux users a low-friction and phishing-resistant sign-in option similar to Windows and macOS, alongside a smaller footprint and more integrated use of Entra ID technology. This introduces advanced SSO functionality for Linux endpoints, utilizing the Microsoft Identity Broker. This is a modern C++ identity broker that integrates Linux devices with Microsoft Entra ID and replaces the legacy Java broker for Intune. To learn more visit Microsoft single sign-on for Linux.

The Microsoft Identity Broker supports a more integrated trust model between the endpoint and Microsoft Entra ID by using full device join to issue device-bound authentication tokens, going beyond what basic enrollment supports. This way, admins can employ Phishing-Resistant Multi-Factor Authentication (PRMFA ) to authenticate, which includes certificate-based authentication, smart cards, and Personal Identity Verification (PIV) enabled security keys. Additionally, the same SSO flow now works on iOS as it does on Windows and macOS, where Microsoft Authentication Library (MSAL) APIs can provide SSO for non-Microsoft applications. For configuration details about SSO on Linux with Entra ID, read our Device Registration Command Tool for Linux instructions. It's a win for admins and end users alike:

End users receive a Primary Refresh Token (PRT) and see fewer credential prompts, improving the sign-in experience.
IT admins get full Conditional Access and device compliance through Entra ID join, plus a smaller installation package and reduced background authentication tasks now that the Java runtime dependency is gone.

Expanded management capabilities for Apple devices

Microsoft Intune has worked to enhance endpoint management for iOS, iPadOS, macOS, visionOS, and tvOS devices in enterprise environments. In this section, we will look at some of the capabilities released this month to help simplify management of Apple devices at scale and set up end users for success with an identity-ready setup.

visionOS and tvOS enrollment, including government cloud

Expanding Intune Plan 2 specialty devices, automated device enrollment (ADE) for visionOS and tvOS is now available, including Government Community Cloud High, all government cloud tenants, and will be included from July 1 for Microsoft 365 E3 and E5 licenses. Organizations managing large-scale Apple device deployments in unattended and shared-use scenarios can now leverage userless ADE for visionOS and tvOS. This includes devices like Apple TVs in conference rooms, patient rooms, or retail locations, and Vision Pro headsets deployed to training and design teams. These devices can now be enrolled and managed without user affinity or individual sign-in.

After enrollment, visionOS and tvOS devices can be remotely deleted, retired, restarted, renamed, or synced, individually or in bulk. Admins can send down configuration profiles via custom file upload for these devices. They can also restrict enrollment by specifying if these operating systems can enroll into their organization.

With enrollment time grouping within the ADE enrollment policy, administrators will have the ability to group devices at enrollment time within the new ADE enrollment policies experience, helping ensure critically assigned policies, scripts, and apps start installation during Setup Assistant. Read our blog post about the new iOS/iPadOS and macOS ADE enrollment policies experience to learn more.

Figure1Example of how to createvisionOS/tvOS enrollment policy using ADE in the Intune admin center.

Tighter control over Managed Apple Accounts

Rounding out this month's Apple updates, Intune now allows organizations to choose whether Managed Apple Accounts can be used on any Apple device or only on organization-owned devices. In practice, this means corporate identities stay on corporate hardware, and personal Apple Accounts can be blocked from signing in to organization-owned devices entirely. This is especially important in regulated sectors, such as financial services, where organizations need to prevent corporate data from residing on unmanaged, non-organization-owned devices.

Intune: Myth vs. Reality (new segment)

Starting this month, the What’s New in Intune blog includes a new segment, Intune: Myth vs. Reality. This series will address common assumptions about endpoint management and how Intune works in practice.

This month’s topic: Change-based delivery speed and responsiveness

Myth: App and policy changes take 8-hours to apply

Reality: Intune processes 90% of device changes in less than an hour

How: The commonly cited “8‑hour” timing reflects a routine maintenance check‑in — not how Intune delivers meaningful changes today. Most high-impact app deployments, policy updates, and device actions are delivered through prioritized, change‑based delivery paths that typically reach online devices much faster. By distinguishing these time-sensitive changes from routine maintenance activity and handling them differently, Intune helps reduce the likelihood that important changes aren’t unnecessarily delayed.

To go deeper, read our latest blog, which explains how Intune processes updates at scale, including priority‑aware check‑ins, push‑based signaling, and platform‑specific optimizations that improve consistency and responsiveness across devices.

That’s a wrap for April. Whether you were interested in device data improvements, Apple enrollment expansions, or the Myth vs. Reality section, we'd love to hear your thoughts in the comments below.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Microsoft Intune announces Android Enterprise management support for Android XR

Priya_Ravichandran — Tue, 07 Apr 2026 17:29:21 GMT

Microsoft Intune now supports the Android XR platform, including management of the Samsung Galaxy XR headset, which is built on Android XR platform. This means that IT admins can begin evaluating and deploying Android XR devices using familiar Intune management capabilities, building on the Android Enterprise security foundation they already have.

With the April Android XR release, Intune will support core Android Enterprise management scenarios on Android XR devices. This means IT admins can start evaluating and deploying XR devices using existing enrollment, policy, and app management workflows, while planning ahead for more advanced scenarios as the platform matures. This release reflects close collaboration between Microsoft, Google, and Samsung, and extends familiar Intune and Android Enterprise enrollment, policy, and app management capabilities to Android XR, starting with a strong foundational set of features.

Android XR devices will be managed in Intune as specialty devices, consistent with other immersive and purpose-built form factors. This is currently tied to the Intune Plan 2 SKU. Availability within Windows 365 E3 and E5 licenses is planned for later in 2026. You can check the Intune licensing documentation for current details.

What is supported in Intune

With this release, IT admins can now manage their Android XR based devices in Intune with the following capabilities:

Android Enterprise enrollment and baseline management
Devices can enroll using supported Android Enterprise flows for Fully Managed and Dedicated devices and receive policies as expected.
App deployment with Managed Google Play
Admins can distribute and manage approved applications through Managed Google Play.
Security and compliance policies
Core Android Enterprise security and compliance settings will be supported, subject to Android XR platform constraints.
Visibility in the Intune admin center
Android XR devices appear in the Intune console and can be monitored and managed alongside other Android endpoints.

These capabilities enable organizations to begin testing and deploying Android XR for user-assigned and managed scenarios where foundational device and app management are required.

What is not supported

The following capabilities are not supported with this platform release:

Lock task (kiosk) mode
Lock task mode—whether for 2D or 3D apps—will not be supported in Intune with the initial Android XR release. This means kiosk scenarios will not be supported at this time, even though assigning policy is not blocked.
Custom launchers and Managed Home Screen
Custom launcher experiences, including Managed Home Screen, will not be supported.
OEMConfig and OEM‑specific extensions
Android XR devices do not have support for OEMConfig. As a result, OEM-specific management extensions (including Knox‑based APIs) are unavailable.
Intune Remote Help
Intune Remote Help capabilities will not be available for Android XR with this latest release. On Samsung devices, Remote Help relies on Knox APIs, which are not present in Android XR at launch. These exclusions reflect the current state of the Android XR platform. As the platform matures and new capabilities become available, we anticipate opportunities to expand Intune's management coverage accordingly.

Next steps

Android XR is a new platform with an evolving management and validation model. As Android XR matures, Microsoft Intune intends to align with new platform management capabilities as they become available. Updates will be communicated through Intune release notes, documentation, and future blog posts.

For now, you can begin testing enrollment, policy application, and app deployment with Intune, while planning for kiosk, launcher, and remote support scenarios as future platform updates roll out.

We look forward to supporting customers as Android XR evolves and becomes part of the modern endpoint landscape.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Windows 365 + Intune Advanced Endpoint Management Capabilities: Better Together

tanialima — Thu, 02 Apr 2026 16:00:00 GMT

Overview

Windows 365 and Microsoft Intune form a tightly integrated solution for modern endpoint management. With Windows 365 delivering secure Cloud PCs (full Windows desktops hosted in the Microsoft cloud) and Intune’s recently extended advanced endpoint management capabilities, organizations can manage Cloud PCs and physical devices side-by-side in a single view. This “better together” approach helps IT teams enforce consistent security and compliance policies across all endpoints following Zero Trust principles while improving the user experience.

Key technical integration highlights

Before exploring the specific advantages that Intune features bring to Windows 365 Cloud PCs, let’s first outline some of the key overall advantages of the native integration between Windows 365 and Intune.

Unified Endpoint Management: Windows 365 Cloud PCs are managed directly through Microsoft Intune, appearing alongside standard Windows devices in the same cloud-based admin portal. This unified approach eliminates the need for separate Virtual Desktop Infrastructure (VDI) tools or infrastructure; instead, Microsoft hosts and manages the Cloud PC platform so that IT admins can easily provision, configure, and monitor both Cloud and physical PCs in one interface by simply assigning licenses and policies. As a result, device management is streamlined and complexity is reduced.

“Both the allocation and deletion of Windows 365 can be completed in just a few minutes using Microsoft Entra ID and Intune. It was exactly the same when we switched the environment to Windows 365 for employees participating in overseas projects. I did it while sitting in my seat at the office.” Shunsuke Hanano, Assistant Manager, IT Planning Group, Group IT Promotion Department, Avant Group Corporation

Identity & Zero Trust Security: Cloud PCs use Microsoft Entra ID (formerly Azure Active Directory) for authentication, allowing organizations to enforce Intune and Conditional Access policies, including multi-factor authentication and device compliance checks, before granting access to Cloud PCs. This ensures that only verified users on compliant devices can sign-in, supporting a Zero Trust security model. Integration with Microsoft Defender provides Cloud PCs with consistent security baselines, antivirus, and threat monitoring, just like physical endpoints.
Security & Compliance Policies: Intune treats Cloud PCs as equal to physical devices, applying security baselines, compliance policies, and updates consistently. It enforces requirements like up-to-date OS and antivirus, and monitors compliance—restricting access or prompting remediation if standards are not met. Cloud PCs send threat data to Microsoft Defender, integrating with company-wide security monitoring. Device compliance policies, configuration profiles, Windows Update rings, and application deployments are all uniformly managed through Intune, ensuring Cloud PCs meet the same security and update standards as other corporate devices.
Monitoring & Analytics: Through Endpoint Analytics in Intune, admins get deep visibility into Cloud PC performance and reliability. Intune reports can highlight whether a Cloud PC is under-resourced (e.g., frequent CPU or memory spikes) and recommend resizing that Cloud PC for better performance.

Now, let’s focus on each Intune advanced capability and how it can benefit Windows 365 users and admins. Intune Suite add-ons will soon be natively available within the E3/E5 Microsoft 365 offerings. Those add-ons are designed to work natively with Windows 365 too, using the same workflow as for physical devices

Coming to enterprise mobility and security E3 (Included in Microsoft 365 E3)

Remote Help (secure remote support): Allows IT to assist remote Cloud PC users in real time with secure, authenticated screen sharing/control. Both helper and user use corporate Entra ID accounts, preventing impersonation and non-compliant Cloud PCs trigger warnings so that issues are resolved safely. This also expedites troubleshooting and reduces downtime for distributed teams.
Advanced Endpoint Analytics: Provides deep insight into Cloud PC performance and user experience. Advanced Analytics through Intune identifies patterns like high CPU/RAM usage or slow boot times on Cloud PCs and offers recommendations to fix issues (such as resizing a Cloud PC’s resources). Anomaly detection proactively surfaces device health issues like app crashes, hangs, and Stop Error restarts early, preventing user impact and allowing IT admins to spot and proactively resolve problems, as well as compare Cloud PC health across models or against industry benchmarks, resulting in better reliability and happier users.

And coming into Microsoft 365 E5

Endpoint Privilege Management (EPM): Enables Cloud PC users to run with standard user rights (no local admin), improving security by minimizing privileges. Through EPM, specific tasks or apps can be elevated on demand via policy when needed, helping users stay productive (e.g., installing approved software) without permanent admin rights. Admins get full control and auditing of these elevations.

“With the introduction of Windows 365, we will eliminate administrative privileges as part of our security enhancements, and to do so, we are testing Microsoft Intune Endpoint Privilege Management. It will allow us to temporarily grant administrative privileges and install only specific applications.” Masahiro Kimura, Head of the OA and Communication Infrastructure Office, Network and OA Technology Department, Hino Motors

Cloud PKI: Enables an enterprise scale PKI to be deployed fully in the cloud, allowing for secure deployment of certificates to end user devices without the need for an on-premises network connection VPN or a traditional PKI infrastructure. This enables a move to modern management, both for Cloud PC’s and physical enterprise devices.
Enterprise App Management: Streamlines the entire application lifecycle for Windows 365 Cloud PCs. IT admins can use the Microsoft-hosted Enterprise App Catalog to easily deploy, update, and maintain essential Microsoft and third-party Win32 apps—removing the need for manual packaging and updates. This ensures Cloud PCs are provisioned with the necessary applications from the start and remain up to date without extra effort.

Conclusion and administrative benefits

For IT administrators, the “better together” solution of Windows 365 and Intune means simpler operations and more streamlined management. All endpoints, whether physical or Cloud PC, are handled with a common set of tools and processes, reducing the need for specialized expertise. Admins can provision or deprovision Cloud PCs quickly (no need to image devices or to maintain a complex VDI environment), and the unified policies in Intune ensure configuration drift is minimized. This integrated approach also means fewer vendors and agents to deal with: endpoint security, management, and virtualization all come from Microsoft, which improves reliability and support.

Many organizations are seeking to consolidate their security and endpoint tools to eliminate inefficiencies—and the Windows 365 + Intune combination is well-positioned to meet this need. In summary, Windows 365 and Intune provide a competitive edge: they simplify IT administration, strengthen security across all devices, and empower users—all within one holistic, cloud-first solution.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What’s new in Microsoft Intune – March

ScottSawyer — Tue, 31 Mar 2026 18:00:00 GMT

In a typical week, IT admins are enrolling devices, deploying apps, enforcing policies, and making a hundred small decisions that keep their organizations running. This month’s updates focus on improving the experience around daily actions, compliance visibility, and management capabilities for Apple devices and mobile apps.

More timely notifications for Microsoft Intune

Intune sends notifications to devices when changes occur that require devices to check in. When those notifications are delayed, whether from devices being offline or in a particular state (network instability, low battery, etc.), the action can be delayed, and devices can miss the check in. Now, on Windows devices, we're complementing the Windows Notification Service (WNS) with the same notification protocol that powers Microsoft Teams to support more timely notification delivery that gives admins the traceability they need for troubleshooting.

We're introducing this functionality with Remote Help for Windows to help reduce the likelihood of stalled session starts when devices are online and reachable. We recommend updating firewall rules to include this new endpoint: *.trouter.communications.svc.cloud.microsoft. Stay informed about our progress by bookmarking the Intune Management Extension logs documentation and the Remote Help for Windows documentation.

New controls for role assignment, device setup, and update readiness

Scope tags are used by Intune to control resources that an administrator can act on in Microsoft Intune. When an admin holds multiple role assignments with different scope tags, those tags can be combined and grant more access than intended. A new de-union setting lets admins keep these scopes discrete and within the boundaries they define. This prevents a role assignment from expanding based on how they overlap with permissions.

Before enabling the capability, admins can use the new ‘Permissions assessment report’ to review how changes to roles and permission allocation will affect their IT team’s day-to-day operations, giving them the chance to plan and adjust before implementing changes. To get started configuring permissions behaviors, read our learn page on permission behavior across role assignments.

Turning to device setup, having to manually authorize each app before it can run can slow down deployment and create gaps that are hard to track. Managed installer policy helps address this by automatically marking apps deployed through Intune as authorized, removing the need to manually whitelist each app. This month, Managed installer policy now applies during Windows Autopilot device preparation, running during out-of-box experience (OOBE) so that Win32, Microsoft Store, and Enterprise App Catalog apps are trusted and available earlier in the setup experience, before the user reaches the desktop.

Beyond a great setup experience, the next job is keeping devices current. Windows Autopatch update readiness is now generally available to help just that. With four additional experiences that provide visibility of the status across their tenant, device-level details into the quality update process, centralized alerts with remediation guidance, and an Update Readiness Checker, admins gain tools intended to support a more proactive approach to update management. For the full story, the Windows IT Pro Blog has the complete announcement.

Management options to further protect Apple devices and apps

Intune's adoption of Apple's Declarative Device Management (DDM) protocol has moved quickly, from software update reporting and day zero configuration support to our most recent release of assignment filters. This month, DDM extends to line-of-business (LOB) apps on iOS and iPadOS devices. Until now, app install status was only reported once devices check in. With DDM-based LOB apps, devices proactively report installation status back to Intune as it changes.

This change represents progress toward broader DDM support within the apps infrastructure, with additional capabilities under consideration for future releases. To dive deeper into these topics, check out the Tech Takeoff session on iOS management at scale and the iOS line-of-business app documentation.

On Mac, admins previously had no MDM-based way to set a password on the recovery OS, leaving Apple Silicon devices with a potential exposure that could be difficult to address. With macOS Recovery lock, admins can now set that password directly, helping prevent users from booting into recovery mode to bypass security controls, and support both on-demand and scheduled password rotation. The March 2026 Tech Takeoff session on Apple device security best practices covers this in detail. With this improvement, Recovery Lock support in Intune helps organizations progress towards compliance with security baselines such as STIG, preventing users from booting into recovery mode to bypass security controls.

When I think of a month like this, I don't think about any one of those new capabilities in isolation. I think about the IT admins who have greater visibility into whether a device action reached its destination, or the help desk professionals who don't have to wonder whether a policy applied. It's not exactly headline grabbing, but it's exactly this kind of continuous improvement that makes for a strong foundation for our customers. That same idea holds whether we're talking about improvements aimed at supporting more reliable Windows device notifications, tighter permission boundaries, or Apple devices that are protected all the way down to its recovery partition. We'd love to hear what resonated most with you this month, so please leave a comment below.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Secure apps: Where people, data, and AI intersect

Talal_Alqinawi — Fri, 20 Mar 2026 16:00:00 GMT

At RSAC, Microsoft is highlighting a foundational truth: more and more AI interactions—whether through Copilot, an agent, or an automated workflow—ultimately run through an application on a device. As organizations adopt more AI-driven workflows, the application layer is becoming an increasingly important enforcement point in modern security architecture.

Security teams are working to maintain visibility and control as new categories of software are introduced into the environment. When applications are unknown, outdated, over-privileged, or allowed to run without control, organizations may face increased risk of unauthorized access to sensitive data or systems. Maintaining visibility into the application estate and helping ensure that users primarily interact with approved and trusted applications has therefore become an important part of reducing risk.

Moving application management into cloud-native workflows can support cross-platform visibility and help organizations streamline how they manage their application estate. This strategy supports organization's ability to respond to vulnerabilities more quickly and apply security policies more consistently across their environment.

Microsoft Intune’s upcoming releases and recent updates strengthen how organizations secure the application layer across discovery, version control, privilege management, execution control, and data protection.

Upcoming releases include Intune enhanced app inventory, designed to gain visibility into your app estate across devices. Intune Enterprise Application Management auto-updates are designed to help reduce the time between new releases and deployment of business-critical apps. Expanded Endpoint Privilege Management capabilities help to further support least-privilege enforcement with improved approvals and reporting.

Recent releases strengthen both execution control and data protection through App Control for Business with managed installer and expanded app-level protection with Intune Application Protection Policies and Microsoft Edge for Business work profiles. Managed installer support now extends to Windows Autopilot device preparation, helping ensure applications deployed through trusted provisioning workflows are recognized by execution policies. Additionally, application migration partner motions also help organizations modernize and standardize their app estate.

Together, these capabilities help IT and security teams address application-based attack paths and support AI-driven work in a more controlled way, without disrupting productivity. Securing the application layer can benefit from a clearer risk-to-control chain that improves visibility into what’s installed and reduces the time older app versions remain in use. This approach also helps organizations limit unnecessary privileges, support trusted execution, and apply app-level data protection in scenarios when device management isn’t feasible.

The following scenarios demonstrate how Intune can help strengthen application security.

1. Reduce blind spots across the app estate installed on devices

A secure application strategy starts with understanding what is running across their device environment. Without reliable application intelligence, it is difficult to accurately assess exposure, prioritize remediation, or enforce policy consistently. Cloud-native endpoint management with Intune enables organizations to view their app estate across Windows, macOS, iOS, and Android devices, helping teams understand their broader application footprint.

Intune enhanced app inventory, generally available starting in May, is designed to provide richer and more current data for managed and user-installed Windows applications on Intune-enrolled devices. As Intune continues to expand app inventory, additional platforms and capabilities are expected to follow.

The improved app inventory experience is intended to help admins:

Help detect unexpected or risky applications more quickly through improved latency
Target investigations and remediation using added application attributes
Use fine-grained controls to choose which devices and app attributes are included in inventory
Access richer and more actionable reporting directly in the device blade

With clearer visibility into application presence and state, IT and SecOps teams can better target remediation of unauthorized, unmanaged, or unexpected applications—and in turn, scope policies more precisely, investigate incidents faster, and reduce application-based attack paths.

Figure 1 View from Intune app installer showing a list of installed applications, including version and date.

2. Keep applications current and reduce vulnerability exposure

Keeping applications up to date across devices is an important part of managing application risk. Manual packaging processes often lead to version drift and inconsistent application states, making it harder to remediate vulnerabilities and maintain a predictable security posture. Intune Enterprise Application Management (EAM) helps organizations move away from fragmented workflows to a more unified, cloud-native application lifecycle management approach—bringing deployments, updates, and policy enforcement together.

EAM auto-updates, generally available starting in July, streamline app packaging and keep applications up to date. EAM auto-updates help organizations deploy new application versions faster and shorten the time between updates and deployment. This approach can help reduce version drift and exposure to known vulnerabilities.

Figure 2 View of the Intune admin center showing how to apply auto‑updates for application management.

While auto-updates help shrink the vulnerability window and attack surface, vulnerability-driven remediation is still required to identify new risks. The Vulnerability Remediation Agent (part of Microsoft Security Copilot), in limited public preview, helps connect vulnerability intelligence with remediation actions. When vulnerable application versions are identified through Common Vulnerabilities and Exposures (CVEs), remediation suggestions can be surfaced in Intune and used to drive targeted remediations, helping IT admins respond more quickly when new vulnerabilities are discovered.

Script installer support for Enterprise Application Management and Win32 provides IT admins with greater customization and control over application installs and uninstalls, without relying solely on command-line logic or repackaging apps. By using script installer, admins can more effectively manage deployment complexities such as dependencies, configuration steps, and cleanup actions, while keeping installation logic easy to update as requirements change.

3. Replace standing admin rights with just-in-time elevation

Some applications and support tasks require elevated permissions to complete. When elevation is handled through broad local administrator rights, those permissions can extend beyond the intended task, creating opportunities for unwanted or untrusted processes to run with elevated privileges. These capabilities are intended to help admins manage elevation in complex environments while maintaining least-privilege access.

By June, a set of expanded Endpoint Privilege Management (EPM) capabilities are expected to be available in Intune, helping organizations move from standing administrator rights toward just-in-time elevation with more controlled and auditable workflows.

Recent EPM enhancements help improve how elevations are requested, approved, and reviewed:

Support approvals for non-primary users allows elevation requests on shared devices and helpdesk-managed scenarios without permanently expanding administrator access. Generally available starting in April.
Scope tag support for EPM reporting data allows elevation activity to be segmented across teams and administrative scopes. Generally available starting in June.

4. Enforce trusted application execution

Trusted applications can still be weaponized. Even widely deployed software can be exploited to launch unauthorized tools or run malicious code—which is why controlling what’s allowed to run is as important as controlling what gets installed. Deployment and update controls help standardize the application estate, but execution policies determine which applications can run on managed devices.

App Control for Business in Intune helps enforce trusted application execution on Windows devices by specifying which applications are allowed to run. Applications not permitted by these policies can be blocked, helping maintain a more controlled application environment.

Managed installer support in Intune helps simplify policy management by automatically identifying trusted applications deployed through Intune. Applications installed by Intune are allowed to run without requiring individual rules, helping admins maintain execution policies as the application estate evolves.

The managed installer policy is now also applied during Windows Autopilot device preparation before apps are installed, generally available starting in April. This update helps ensure that apps delivered during Autopilot device preparation are marked as trusted during provisioning. By aligning trusted deployment workflows with execution policy, organizations can support controlled application environments without introducing friction during device onboarding.

Figure 3 Intune's admin center via App Control for Business to begin configuring a policy from the managed installer.

Read moreabout App Control for Business and managed installer to help maintain a more predictable and policy-aligned application environment.

5. Protect corporate data at the app level

Work increasingly takes place on devices that an organization cannot enroll—agency-managed PCs, partner devices, and personal endpoints. In these scenarios, secure access to corporate resources is still required even when device-level controls cannot be applied.

Intune Application Protection Policies (APP) enable organizations to protect corporate data at the application layer without requiring device enrollment. APP helps enforce data protection controls—such as restricting copy and paste—to help maintain data boundaries between corporate and personal work.

New support for Microsoft Edge for Business work profiles on Windows PCs managed by another organization extends APP protection to browser-based work without creating tenant management conflicts. Recent Microsoft Entra sign-in improvements further help guide users into the intended app-protection experience and help prevent unintended device enrollment.

Read moreabout these enhancements and how Intune applies Zero Trust-aligned principles to the browser on externally managed Windows PCs.

Securing the application layer across the full lifecycle

The application layer has long been the center of work, and with the rise of AI, it’s rapidly becoming the center of decision-making as well. As organizations adopt Copilot and agents, it becomes an increasingly important enforcement point—and the place where the next wave of security investments need to land. Securing this layer requires applying consistent controls across visibility, updates, controlled privilege, trusted execution, and app-level data protection.

Intune is designed to help organizations secure the application layer end-to-end, across discovery, deployment, updates, privilege, execution, and data protection. As organizations modernize their app estates, moving them into cloud-native management can provide a foundation for more consistent visibility, streamlined remediation, and stronger security controls across the environment. By applying Zero Trust-aligned principles consistently throughout the application lifecycle, organizations can work to minimize application-related risks while enabling safer and more flexible ways of working.

To support these modernization efforts, application migration partners can work to transition existing applications into cloud-native Intune management by automating assessment, packaging conversion, and remediation. Bringing applications into Intune-managed workflows helps organizations identify potential Shadow IT, help strengthen their security posture, manage updates, apply privilege controls and enforce policies more consistently across the environment.

Here are the next steps to take toward securing the application layer:

Connect with Intune experts at the Microsoft Booth #5744 at RSA Conference, Moscone Center, March 23–26.
Move Windows app packaging and updates into cloud-native management
Learn how to apply Zero Trust principles to data within the applications
Migrate app management to Intune with partner assistance
Learn which Intune advanced solutions will be coming to the M365 E3 and E5 suites

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Announcing three new partners for multi-tenant management with Microsoft Intune

Lior_Bela — Tue, 17 Mar 2026 16:18:31 GMT

The challenge: Scaling Intune across customer environments

Managed service providers (MSPs) of all sizes are under pressure to manage an expanding portfolio of customer environments efficiently, securely, and profitably. Historically, MSPs have had to choose between building custom multi-tenant tooling or relying on third-party platforms that lack deep Microsoft integration. As client expectations rise and competitive pricing pressures intensify, MSPs need solutions that help them deliver more value from the Microsoft 365 investments their customers already have—investments that already include Microsoft Intune—without fragmenting data or security outside Microsoft's ecosystem.

Managing multiple tenants often means duplicating routine processes, reconciling policy inconsistencies, and navigating separate management portals. MSPs need centralized oversight across all tenants without sacrificing security, compliance, or operational efficiency. Microsoft Intune is the answer—and the right partner solutions make it scale.

The solution: Microsoft Intune, extended by validated partners

In September, we announced our collaboration with two leading multi-tenant management providers—inforcer and Nerdio—and the response was remarkable. The program, which we call #IntuneForMSPs, has exceeded our expectations. We heard strong positive feedback from MSPs and enterprises at events around the world and across social media, from organizations that have long needed a better way to manage multiple tenants at scale.

Today, we're excited to announce three additional validated partners joining the #IntuneForMSPs ecosystem. Each has been validated against Microsoft's product and business requirements, enabling MSPs to scale efficiently, standardize operations, and deliver more secure, Intune-aligned experiences to their customers.

Momentum in the MSP market

Over the past year, we've seen strong momentum across the MSP market—through global events, partner sessions, and #IntuneForMSPs meetups. One message has been consistent across all of these conversations:

MSPs want Intune-aligned solutions that respect Microsoft's security model, tenant boundaries, and licensing investments.

At recent in-person and virtual events, the energy around this shift has been clear. MSPs are actively moving away from traditional RMM-centric approaches toward models where Microsoft Intune serves as the control plane for device management, security, and compliance. That shift is what makes today's announcement particularly meaningful.

Welcoming three new #IntuneForMSPs partners

We're pleased to welcome three new validated partners to the #IntuneForMSPs ecosystem. Each offers independent, complementary capabilities built on top of and alongside the Microsoft Intune platform—preserving their unique workflows and features while extending what Intune can do for MSPs at scale. Partners are presented in alphabetical order; the descriptions below were provided by each partner.

We encourage you to learn more about all validated partners at https://aka.ms/IntuneForMSPs.

AvePoint Confidence Platform: Elements Edition

AvePoint is the global leader in data protection, unifying data security, governance, and resilience to provide a trusted foundation for AI. More than 28,000 customers rely on the AvePoint Confidence Platform to secure, govern, and rapidly recover data across multi‑cloud environments.

Through AvePoint Confidence Platform: Elements Edition, AvePoint extends Microsoft Intune with secured multi‑tenant automation, lifecycle management, and centralized visibility—enabling partners to scale Intune delivery profitably and consistently across customers. With a single platform for governance, lifecycle control, and recovery, partners reduce operational overhead, prevent sprawl, and accelerate Copilot readiness.

AvePoint supports a global partner ecosystem of 6,000 MSPs, VARs, and SIs, with solutions available in over 100 cloud marketplaces.

Learn more at: avpt.is/intune

CyberDrain CIPP

CyberDrain CIPP provides MSPs with a centralized, multi-tenant management platform for Microsoft 365. It enables partners to securely manage tenants at scale, automate common administrative tasks, enforce standards across environments, and gain deep visibility into tenant security and configuration.

With built-in automation, governance controls, and extensibility, CIPP reduces reliance on custom scripts and manual processes. MSPs can standardize operations, streamline user and tenant management, monitor security posture, and respond quickly to issues across all customers from a single interface.

CIPP is supported by one of the largest and most active MSP communities in the Microsoft ecosystem, with thousands of partners contributing feedback, automation ideas, and best practices. As one of the most widely adopted platforms for Microsoft 365 multi-tenant management, CyberDrain CIPP continues to evolve rapidly to meet the needs of modern MSPs.

Learn more at: cyberdrain.com/intuneformsps

SoftwareCentral Tenant Manager

SoftwareCentral Tenant Manager helps MSPs run Microsoft Intune across multiple customer tenants with consistency and control. MSP teams can standardize policies, manage applications and devices across environments, monitor configuration drift, and maintain visibility into changes across tenants from a single platform. The platform runs entirely on Microsoft Azure with region-selectable deployment for your data protection requirements. It includes CIS certified security baselines, helping MSPs deliver secure, repeatable Intune services as their customer portfolios grow, even without in-depth Intune knowledge.

Learn more at: tenantmanager.com/intuneformsps/

What’s next for #IntuneForMSPs

Today's announcement reflects our continued and reinvigorated commitment to the MSP market. Going forward, you can expect:

More news about the #IntuneForMSPs ecosystem
Continued monthly meetups and technical sessions for MSPs—open to any MSP interested in learning how Intune can help scale their business
MSP-specific guidance and resources to help MSPs grow with Microsoft

Microsoft Intune MVP Jonathan Edwards (also known as the Bearded365Guy) created a video1 reviewing three of our partner solutions. Watch the video and explore all our validated partners at https://aka.ms/IntuneForMSPs.

Jonathan Edwards reviews Nerdio, inforcer, and CIPP in one video.

If you're an MSP modernizing your management approach—or a partner building on Intune—we invite you to explore these new solutions and stay engaged with the #IntuneForMSPs partner program at our resource page aka.ms/IntuneForMSPs and monthly meetups.

"Jonathan Edwards is a Microsoft Intune MVP. Microsoft's MVP program is an independent recognition program; Jonathan was not compensated by Microsoft for this video."

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What's New in Microsoft Intune – February

ScottSawyer — Thu, 26 Feb 2026 19:00:00 GMT

Every IT environment has workarounds. Policies are duplicated instead of edited because there's no approval process. Apple software updates are pushed to every device because Declarative Device Management (DDM) policies couldn't filter by ownership type.

Workarounds aren't just inconvenient. They can increase risk. Duplicate policies, broad software updates, and unchecked changes expand the attack surface and undermine Zero Trust principles. This month’s Microsoft Intune updates focus on eliminating those workarounds by giving admins greater control, clearer accountability, and more precise targeting. Helping to ensure security policies are enforced the way they were intended, without slowing IT teams down.

Reduce policy risk with greater oversight over compliance and configuration changes

To provide an extra security measure against any unauthorized or accidental changes, additional multi-administrator approval options are now available for device configuration policies created through the settings catalog and device compliance policies (for more information see Compliance settings, and Device cleanup rules). With this control enabled, critical policy changes (creation, alteration, or deletion) will need approval from a second administrator before they can be implemented.

This latest update expands the multi-admin approval capabilities introduced over the past year, which include apps, scripts, device actions like wipe, retire, and delete, RBAC roles, and device categories. The addition of compliance and configuration policies approvals help enable organizations to offer a more comprehensive safety net for their most critical policies. In environments where configuration drift can lead to non-compliance and security risks, this level of oversight is not simply a good practice, but rather a preventive control and governance option integrated into the IT workflow.

Furthermore, since every request, approval, and business justification is documented in the Intune audit logs, this control not only helps prevent potential problems but also documents them.

Find and fix issues faster with updates for multiple device queries

Zero Trust decisions depend on accurate, actionable data, and IT admins need precise queries to identify compliance gaps or missing configurations across their fleet. Advanced Analytics now includes the operator details in multiple device query (MDQ) results, (including join types such as new leftanti and rightsemi operators). This assists in finding the specific settings of missing devices and helps you run fleet-wide queries more accurately, especially if you are managing thousands of devices of all OS types.

Additionally, Advanced Analytics device join syntax in MDQ results are now clickable for faster navigation to device details and improved error messaging. A good example to illustrate this improvement is a query to retrieve all devices with ARM processors, ordered alphabetically. The column for the Device field in the results is now clickable when the Device entity is joined. In addition, admins can now join the results on the Device field without using custom Device syntax.

Figure 1: Device query results showing x64 CPU data joined on Device.

For more detail, please refer to the Microsoft Learn page on device query for multiple devices.

Target Apple updates precisely—without overreaching

When managing Apple devices, targeting matters; not every policy needs to reach every device. But until now, Declarative Device Management (DDM) policies did not account for assignment filters. Admins couldn't target devices by OS version or differentiate between company-owned and personally owned devices.

A common challenge for admins is enforcing software updates on company-owned devices while avoiding personal devices. The enhancements included in this month’s Intune release help resolve this challenge. Now admins can use DDM-based policies with assignment filters in the same way they do for MDM-based policies. For instance, if an organization wants to target devices running iOS 17 or later with software updates, they can use an operating system version filter. To target Automated Device Enrollment (ADE) supervised devices while ignoring personal devices, they can use an enrollment profile name filter.

This capability is becoming more important as Apple has expanded Declarative Device Management across iOS, iPadOS, macOS, Vision OS, and Apple TV. Intune keeps pace with that shift by doing what it has always done: giving admins a consistent way to apply policies across every platform they manage.

Fewer workarounds, stronger Zero Trust across every platform

The capabilities rolling out in our February release all have something in common: multi-admin approval, multi-device queries, and assignment filters for Declarative Device Management collectively eliminate the need for workarounds.

I know that workarounds are part of every IT environment. However, with each workaround there may be concessions: more access, more policies created without proper scrutiny, or updates not intended for particular devices. While this month’s new capabilities will not eliminate all workarounds, they are a step toward managing devices the way Zero Trust requires: precisely, reliably, and with built-in least privilege.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

Protect browser-based work on agency-managed Windows PCs

LiMiller — Tue, 24 Feb 2026 19:41:58 GMT

From SaaS apps and internal web portals to AI-powered tools, the browser is now a major workspace for many employees and contractors alike. This shift has introduced new opportunities for organizations to enable an extended workforce. At the same time, it creates new data protection complexities for IT administrators.

Securing corporate data has traditionally relied on full device management. However, when work occurs on a Windows PC that your organization doesn't own—such as a device already enrolled and managed by a contractor’s home agency—full device enrollment isn't a viable option. Organizations need a flexible way to reduce these data blind spots without taking over the device itself.

To address this, Microsoft continues to expand data protection capabilities across Microsoft Edge for Business, Microsoft Entra, Microsoft Intune, and Microsoft Purview. Recent profile and sign-in updates with Edge for Business and Entra now help organizations to secure browser-based work on Windows PCs managed by another organization. And these updates work alongside inline data loss prevention with Purview and prescriptive deployment guidance from Intune to help administrators apply protections consistently rather than configuring policies in isolation.

Support and protection for agency-managed Windows PCs

Edge for Business now extends Intune app protection policies (APP) to the Edge for Business work profile on Windows PCs managed by another organization. This new capability, currently in public preview, helps organizations to protect work contractors do in the browser, while respecting existing device ownership and management boundaries. This protects corporate data without requiring full device enrollment or creating conflicts with another tenant’s management.

Figure 1 Demo showing Intune app protection policies in action within an Edge for Business work profile on a Windows PC managed by another organization.

Key capabilities include:

Browser-level protection through the Edge work profile: Intune APP policies can be applied directly to Edge for Business user profiles, helping to create a protected boundary for work data. Contractors can securely access corporate resources in an Edge for Business profile without enrolling the device or altering existing management.
Tenant-scoped controls within Edge for Business: Organizations can help protect corporate data within the browser by redirecting downloads to OneDrive for Business, restricting copy and paste, and enforcing data boundaries inside the managed Edge for Business profile.

Learn more: How to get started with agency-managed device support in Edge for Business and apply APP.

Simplified onboarding for APP policies on Windows

Recent Entra improvements to the Edge on Windows sign-in flow enable admins to configure the enrollment screen to create a more predictable setup and enrollment experience. These new sign-in updates help route users into Intune application protection polices, while reducing accidental full device enrollment.

Figure 2 Microsoft Entra updated sign-in experience pop-up window.

These Entra updates include:

Modernized Entra registration page for the user: An updated account registration flow provides clearer guidance during sign-in, helping users understand when they are registering an account versus enrolling a device.
Prevention of unintended device enrollment: Administrators can enable the “Disable MDM enrollment when adding work or school account” setting to block the prompt for devince enrollment during the account registration flow. Users are directed into the intended app-protection experience without unnecessary prompts or management conflicts.

Learn more: Read more about how to apply the updated Entra sign-in flow.

Apply data security across browser-based work

Microsoft Purview Data Loss Prevention (DLP) helps protect sensitive corporate data during browser-based work on Windows PCs that are managed by another organization or not enrolled at all. Purview DLP is built directly into Edge for Business and applies to the user’s work profile, so organizations can detect and control sensitive actions without requiring device onboarding into Purview or taking ownership of the device.

Figure 3 Purview DLP: Displays a pop-up message to indicate organizational protection for a file download.

With Purview DLP in Edge for Business, organizations can:

Apply inline DLP protection in the browser: Support detection and control for sensitive actions, such as uploads, downloads, copy/paste, printing, and across cloud apps accessed in the browser.
Extend coverage to unmanaged cloud apps: Apply DLP policies to enrolled apps and extend protection to unenrolled cloud apps, helping prevent oversharing or unintended data movement during browser activity.
Reduce data leakage without limiting productivity: Detect and prevent risky actions involving sensitive data without blocking site access or disrupting normal workflows.

Learn more: Apply Purview Data Loss Prevention in Edge for Business to protect sensitive data during browser-based work.

Guidance to help secure corporate data in the browser

Microsoft published “Secure Your Corporate Data in Intune with Microsoft Edge for Business” to provide guidance on how administrators can operationalize browser-based protections across platforms. This guidance provides step-by-step configuration paths that align identity, app protection, browser configuration, and device controls into a single, structured deployment model rather than isolated policy setup.

The guide covers:

Three-level security framework: Basic, Enhanced, and High protection tiers mapped to common industry standards such as NIST and DISA STIG, enabling organizations to align browser security posture with risk tolerance and user roles.
Cross-platform policy mapping: Clear guidance on when to use app protection policies, app configuration policies, settings catalog controls, and conditional access across Windows, macOS, iOS, and Android without creating policy conflicts or double-applying browser policies.
Sequenced configuration paths: Ordered implementation steps that show how identity enforcement, app protection, browser configuration, and device-level controls work together to form a cohesive secure enterprise browser strategy.

Learn more: Read more on how to get started with Intune’s configuration guidance to protect browser-based work and align identity, app protection, and browser controls.

Apply additional protections for a more consistent sign-in flow today

Organizations do not need to treat browser-based work as an exception to endpoint protection. By combining identity routing in Entra, app-level boundaries through Intune, workspace separation in Edge for Business, and inline data governance with Purview, organizations can apply consistent controls even on Windows PCs they don’t own or manage.

With this approach, protection moves from the device to the work context itself. Administrators can secure corporate data where work happens, while preserving productivity and respecting existing device ownership and management boundaries.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

What's New in Microsoft Intune – January 2026

ScottSawyer — Thu, 05 Feb 2026 17:00:00 GMT

When trees lose their leaves, you see the structure beneath. The branches you couldn’t see. The shape that was always there.

January is like that for IT admins. You get a fresh view of your endpoint management landscape, such as where elevation can get sharper, where application deployment process can be improved, and where admin tasks could be made more efficient.

The same is true for Intune. January isn’t just about celebrating what we’ve accomplished in the past year, but it’s also about looking forward to what new challenges we will face and new ways we can help IT admins be more productive. In this blog post, I’ll highlight the recent capabilities that I’m personally excited about.

Accelerate deployment with PowerShell script installers for Win32 apps

Today, many organizations customize app deployments outside Intune using PowerShell scripts to handle prerequisite checks, post-install steps, dependencies, and registry updates. Previously, each time the script changed, the entire app binary needed to be repackaged and re-uploaded. That friction often can add hours to deployment cycles and kept critical work outside the admin center.

This month, that changes that. When creating a Win32 app in Intune, admins can now upload a PowerShell script that acts as the app installer, rather than specifying a command line. The script runs natively. Intune packages it with app content and runs it in the same context as the installer. Installation results show in the admin center as 'success' or 'failure' based on return codes, providing visibility into what happened.

So, what does this mean? It means app deployment gets faster, customization gets easier, and teams in highly regulated industries like finance and healthcare can use the script to enforce compliance steps as part of the app installation process. It means system requirements can be checked before anything else runs, and app-specific settings can be configured after the app is installed. It means admins gain even more control.

Endpoint Privilege Management gets sharper

When users need elevated privilege, we are introducing a new Endpoint Privilege Management (EPM) capability to elevate users in a way that preserves their current profile. For example, profile paths, environment variables, and personalized settings.
This matters for installers and tools that depend on the active user’s profile. Before,
EPM isolated virtual accounts. Now, the user’s identity is maintained throughout elevation, meaning your audit trails stay cleaner and compliance records are more accurate.

In addition, the ability to enforce scope tags for elevation scenarios safeguards admins can only view elevation requests for which they have permission. This is critical for compartmentalizing data in regulated environments. Together with 'Elevate as current user,' this enables organizations to easily oversee who is allowed to perform elevated actions, while avoiding the disclosure of excessive context. These two capabilities integrate seamlessly out of the box, with no configuration required.

Admin tasks capability brings your work together

The new year brings clarity. Admins manage privilege elevation, device offboarding, security alerts, and policy approvals. Admin tasks, now generally available (GA) in Microsoft Intune, brings that work into a single, prioritized queue.

Admin tasks centralizes these workflows to help admins focus on high-impact actions that need their attention now. It is under Tenant Administration, where admins can search, filter, and sort across requests, tasks, and approvals. Currently, admin tasks includes Endpoint Privilege Management (EPM) requests, Multi Admin Approval (MAA) tasks, Microsoft Defender for Endpoint (MDE) security tasks, and the Device Offboarding Agent (part of Microsoft Security Copilot) for tasks.

EPM elevation requests help admins quickly approve or deny elevation needs and create reusable rules. Microsoft Defender for Endpoint security tasks enables admins to review recommended remediation actions, take corrective action on security issues, and monitor task status through a consistent Intune workflow. The Device Offboarding Agent helps detect unused or outdated devices that may no longer be needed or may pose a security risk, surfacing these findings as actionable tasks within admin tasks. Multi Admin Approval requests, such as scripts, device wipes, and role changes, are reviewed and approved with this same view. Each approval or rejection is recorded to support audit and compliance requirements. Learn more by taking a deeper dive in this blog on admin tasks in the Intune.

Apple enrollment keeps evolving with new certificate support

The technical foundation for enrollment of Apple devices just got stronger. We're rolling out support for the Automated Certificate Management Environment (ACME) protocol for new iOS, iPadOS, and macOS enrollments.

So, what’s the difference? ACME provides better protection than the previous SCEP approach against unauthorized certificate issuance. It includes improved validation mechanisms and automated processes that reduce errors in certificate management. Now, when new Apple devices enroll, they receive an ACME certificate instead of a SCEP certificate.

There's no change to your enrollment experience or Intune admin center doesn’t change. Its infrastructure works better in the background. This applies to Apple Device Enrollment, Apple Configurator enrollment, and automated device enrollment (ADE) methods. We also added 12 new Setup Assistant screens you can control during ADE. Want to skip the App Store screen? Hide camera settings? Now you can. This gives you more flexibility in how your end-users experience onboarding.

What's ahead

January always feels like a restart. New year, fresh roadmap, the engineering teams recharged and looking at what's next. When I talk with the team building these capabilities, the energy is real. They're already thinking about solving more challenges
IT admins face. The momentum is here with the team at Microsoft Intune.

Stay up to date with Intune, please bookmark the Microsoft Intune Blog, and follow us on LinkedIn or @MSIntune on X.

Admin tasks in Microsoft Intune: Centralized control today, AI-ready for tomorrow

LiMiller — Tue, 03 Feb 2026 17:00:00 GMT

IT admins make daily, quiet decisions that determine whether an organization stays secure, compliant, and productive. They review privilege requests, security remediation actions, and high-impact configuration changes across multiple consoles. Given the growing breadth of their daily responsibilities, scattered decision points could lead to slower response times, increased risks, and make audit readiness harder to maintain.

Microsoft Intune already consolidates endpoint management into one place. And now with the general availability (GA) of admin tasks it aggregates high-impact approvals and remediation workflows, into a single, prioritized queue, giving admins a unified view of what needs action right now. Introduced at Microsoft Ignite, admin tasks brings together three essential decision points: Endpoint Privilege Management (EPM) elevation requests, Microsoft Defender for Endpoint (MDE) security tasks, and Multi Admin Approval (MAA) requests. And now, admin tasks also incorporates actions from the Device Offboarding Agent (part of Microsoft Security Copilot), currently in public preview, extending centralized decision-making to device lifecycle cleanup.

As organizations adopt Zero Trust principles and prepare for AI-assisted operations, IT teams need more automation without sacrificing oversight. As Intune expands automated and AI-assisted capabilities, admin tasks adds an oversight layer that helps ensure AI-driven recommendations remain under administrator control. Over time, additional task types will continually be integrated, consolidating even more high-impact operational decision points into a single experience.

“Admin tasks in Intune is a centralized, prioritized task view that cuts through the noise. The simplified processes boost our team’s ability to respond quickly and confidently to critical requests.” –Michael Meier, IT Workplace Design, Krones AG

Admin tasks is available in the Intune admin center under Tenant administration. The following sections outline what admins can access today.

Four ways to streamline IT operations with admin tasks

Endpoint Privilege Management elevation requests

EPM enables standard users to run approved applications with elevated privileges without granting permanent local admin rights. In admin tasks, elevation requests appear in the same prioritized queue as other high-impact actions, so admins can review and approve requests from a single view.

Key actions to take in admin tasks: Approve or deny elevation requests, create reusable rules based on file details, or add files to reusable settings.

What EPM enables:

Flexible elevation models: Supports automatic, user-confirmed, and support-approved workflows.
Granular controls: Defines elevation rules based on publisher, file hash, or command-line arguments.
Audit and compliance: Logs elevation activity for visibility, reporting, and compliance.
Improved user experience: Helps standard users stay productive, while reducing help desk tickets and security exposure.
Contextual risk analysis*: With EPM and Security Copilot, it enables admin tasks to surface contextual risk signals to help inform elevation approval decisions.

*Note: This capability requires Microsoft Security Copilot, get started here. Security Copilot will be included for Microsoft 365 E5 customers, roll out began for existing Security Copilot users and is continuing in the upcoming months, learn more here. EPM is also coming to M365 E5; learn more about the Intune capabilities coming to both the E3 and E5 bundle here.

Figure 1: View of granular controls for elevation requests in Intune Endpoint Privilege Management within admin tasks.

Defender for Endpoint security tasks

MDE requests for remediation generate security tasks that surface in the Intune admin center, when threats or configuration issues are detected on devices. Admins can track and complete security remediation work from the same queue used for other critical IT decisions.

Key actions to take in admin tasks: Mark tasks as complete or reject them, and review impacted device lists.

What MDE security task in Intune enables:

Unified task management: View and act on security tasks from Defender in a single queue.
Recommended endpoint security profiles: Supports new configurations for Endpoint Detection and Response (EDR) and Antivirus exclusions on Linux devices.
Audit and compliance: Logs all task activities for visibility, reporting, and compliance.
Integrated security settings management: Manage antivirus and EDR settings directly through Defender for Endpoint security settings management in Intune using security tasks recommendations.

Figure 2: View of Microsoft Defender for Endpoint with security tasks surfaced in admin tasks.

The Device Offboarding Agent

Admin tasks now incorporates the Device Offboarding Agent tasks. Admins can review and act on the cleanup of stale devices using the same flow used for other high-impact tasks. The preview supports Intune managed devices running Windows, iOS/iPadOS, macOS, Android, and Linux, and allows admins to disable Microsoft Entra ID objects with guided remediation.

Key actions to take in admin tasks: Download a CSV list of affected devices.

What the Device Offboarding Agent enables*:

Routine reviews: Pre-packaged tasks reduce manual investigation and help make cleanup repeatable.
Automated identification: Detects unused or outdated devices using automated signals across Intune and Microsoft Entra to help reduce the attack surface.
Offboarding insights: Provides actionable recommendations and details requiring approval before offboarding.

*Note The Device Offboarding Agent requires Microsoft Security Copilot, get started here. Security Copilot will be included for all Microsoft 365 E5 customers, roll out began for existing Security Copilot users and is continuing in the upcoming months, learn more here.

Figure 3: View of potential devices identified for removal by the Device Offboarding Agent within admin tasks.

Multi Admin Approval requests

Multi Admin Approval requires a second administrator to approve high-impact actions, such as scripts, remote actions, role changes, and device wipes before they are executed. MAA requests now appear in admin tasks, ensuring sensitive configuration changes follow a consistent, centralized review process.

Key actions to take in admin tasks: Approve or reject a request, complete a change, and add requester and approver notes for audit and compliance.

What MAA enables

Alignment with access policies: Applies to protected configurations that require approvals, such as scripts, roles, settings, and remote actions.
Audit and compliance: Logs all approval, rejection, and completion of activity for visibility, reporting, and compliance.
Protection against compromised accounts: Helps ensure sensitive changes—such as script executions, device wipes, or role permission updates—cannot be performed by a single administrator.
Contextual risk analysis*: The Change Review Agent (part of Microsoft Security Copilot) analyzes MAA script requests in context providing detailed insights on potential impact and clear recommendations.

*Note: The Change Review Agent requires Microsoft Security Copilot, get started here. Security Copilot will be included for all Microsoft 365 E5 customers, roll out began for existing Security Copilot users and is continuing in the upcoming months, learn more here.

Figure 4: View of Multi Admin Approval script requests displayed within admin tasks.

Simplify decisions and prepare for AI-assisted workflows today

Admin tasks in Intune offers a single, prioritized view to act quickly on what matters most—while building the secure foundation organizations need for agentic automation. As Intune continues to expand its AI-driven capabilities, this centralized model gives IT more control and deeper insights across the platform.

Explore admin tasks in Microsoft Intune today and see how the expanded Microsoft 365 E3 and E5 value helps organizations scale securely and confidently.

What's in store for Intune at Microsoft Technical Takeoff 2026

Rachelle_Blanchard — Mon, 02 Feb 2026 17:00:00 GMT

It’s almost time for Microsoft Technical Takeoff, our month‑long digital skilling event designed to help IT admins and technical decision-makers go deeper with Windows, Microsoft Intune, and Windows 365. Every Monday in March, you’ll get fresh technical content, hands‑on guidance, and direct engagement with the engineering teams who build the products you use every day.

This year’s event brings together technical deep dives, Ask Microsoft Anything (AMA) sessions, and feedback‑gathering sessions—all streamed live on the Microsoft Tech Community. Expect deep, scenario‑driven guidance spanning security, automation, cloud management, and cross‑platform device administration. You’ll also be able to engage directly with the product engineering teams with live Q&A during the sessions.

Start your Technical Takeoff experience right

As you explore the full agenda, make sure you tune in to our annual kickoff panel, Let’s Talk Windows & Intune, Monday, March 2 at 7:00 AM PT. Engineering leaders Sangeetha Visweswaran, John Cable, and Bhavya Chopra will share what they’re learning from IT admins around the world, as well as what’s shaping the future of device management, security, and cloud‑powered productivity.

Explore Intune sessions at Technical Takeoff

You can bookmark and watch the full event at https://aka.ms/TechnicalTakeoff. All the sessions are also listed day-by-day below. From each session page, you can:

“Add to Calendar” to save the date.
Click “Attend” to hold your spot and receive reminders.
Post your Q&A questions early for the engineering team. (Of course, you can also post questions live as you learn!)
Tune in live or watch on demand afterward.

See you on Mondays in March!

Whether you’re modernizing your endpoint estate, strengthening security, or looking for practical configuration guidance, Microsoft Technical Takeoff is your chance to get actionable insights straight from engineering.

Can’t attend live? No problem. All sessions are recorded and available on demand shortly after they air. You can also post your Q&A questions in advance or anytime during the week of the session. In addition, although sessions will feature AI-generated captions during the live broadcast, we will update those with human-generated, human-verified captions (and transcripts) by the end of each week.

We hope to see you at Microsoft Technical Takeoff! Grab your seat, customize your agenda, and get answers directly from the experts behind Windows and Intune. Visit https://aka.ms/TechnicalTakeoff to get started and see our sister guide to Windows and Windows 365 at Tech Takeoff.

Save the date: Intune Tech Community Live – January 26

Rachelle_Blanchard — Fri, 30 Jan 2026 17:35:10 GMT

Level up your endpoint management skills at Tech Community Live: Intune Edition.

IT professionals: mark your calendars for Monday, January 26, 2026. If you manage endpoints with Microsoft Intune, this is your chance to connect directly with the experts and get answers to your toughest questions.

This isn’t your typical webinar. It’s an interactive event packed with four Ask Microsoft Anything (AMA) sessions, where you can bring your toughest questions and get real answers from the experts. Here’s what’s on the agenda (all times in PST):

8:00 AM – Secure your endpoints with policy and Microsoft Defender
9:00 AM – Manage apps like a pro with Microsoft Intune
10:00 AM – Best practices for applying Zero Trust using Intune
10:30 AM – Copilot and agentic-centered endpoint management

Why Tech Community Live?

Endpoint management is evolving fast—and so are the challenges. This event gives you direct access to the Microsoft engineering teams creating new features and capabilities in Intune. It’s your chance to:

Get answers to real-world questions straight from the experts.
Learn best practices you can apply immediately.
Influence the future by sharing your feedback with the people who build the product.

Whether you’re looking to strengthen compliance, streamline app deployment, or embrace Zero Trust strategies, you’ll walk away with actionable insights to keep your organization secure and efficient.

How to join the fun

Browse the session topics above.
Hit Add to calendar on the session pages to save them, well, to your calendar.
Sign in to the Tech Community (top right corner of the site) then click Attend to receive event reminders.

Post your questions in the Comments section at the bottom of each session page early and often. We’ll be ready to tackle them live! Don’t miss this opportunity to learn from Microsoft experts and elevate your Intune skills. See you there!

Community matters. Let your network know they get the Intune answers and insights they need on January 26 on the Microsoft Tech Community.

What's new in Microsoft Intune: December 2025

ScottSawyer — Thu, 11 Dec 2025 19:00:00 GMT

Following Microsoft Ignite 2025, I caught up with colleagues and Intune MVPs who made the trip to San Francisco. There was a lot to talk about, but one conversation stood out: When I asked what surprised them most about this year for Microsoft Intune, the answer wasn't a single capability. It was witnessing busy IT admin work disappear by automating work that used to consume hours of admin time.

Microsoft Security Copilot agents in Intune exemplify that shift, but the introduction of additional agents doesn’t address other IT challenges. Throughout 2025, the Intune engineering team has shipped capabilities for cross-platform support, security, and more that has helped to remove many areas of friction from day-to-day operations. For a more complete story about what was delivered and what’s coming soon, watch the on-demand Microsoft Ignite presentation or read the What’s new in Microsoft Intune at Ignite blog.

Today, I'll focus on several recent capabilities worth examining in detail from November and December.

Empowering IT by automating and enhancing workflows

For many of the customers I spoke with this year, context-switching drains productivity. Switching between multiple console nodes to manage security tasks, elevation requests, and admin approvals increases friction and the chance of missing something.

The new Admin tasks node under Tenant Administration in the Intune admin center consolidates this workflow into a single view. Now in public preview, this centralized location surfaces Endpoint Privilege Management (EPM) file elevation requests, Defender for Endpoint security tasks, and
Multi-Admin Approval requests in one place. Administrators can search, filter, and sort across all task types without jumping between console areas. The centralized view reduces time spent hunting for what needs attention and creates a more reliable review process.

This helps centralize admin tasks, but visibility without boundaries can create noise. Until now, administrators with permission to review Endpoint Privilege Management elevation requests could see every request across the organization, regardless of their assigned scope. Scope tag enforcement adds role-based access control to this highly valued capability, aligning EPM with Zero Trust by ensuring admins only access the elevation requests required for their role. This reduces unnecessary visibility into devices and users outside their remit and lowers the risk of accidental or inappropriate actions.

Enhancing visibility and control across platforms

November's updates deliver improvements across three areas: app management, privacy controls, and policy targeting. These areas give IT administrators even more granular control for diverse device fleets running iOS, macOS, and Android.

Android: User experience and app management options

Intune has introduced new capabilities to Managed Home Screen for IT to enhance the end user experience on frontline Android devices: Offline mode and App access without sign-in offers users greater flexibility to access critical applications, while improved volume controls now allow more granular adjustments for call, ring, notifications, alarms, and media.

Additionally, if customizing your managed Google Play app catalog becomes too time consuming, you can use the new “Reset to Basic” mode. This reverts to the default "all approved apps visible" experience instantly, without support tickets or manual collection rebuilds. Taken together, these changes move Android app management away from low-level device plumbing and toward intentional experience design.

Android: Data protection and privacy controls

Beneath the user-facing improvements, the November Intune release tightens Android data protection. This is critical for AI features that may not have been part of the original security model. The Intune Settings Catalog now provides access to Android controls, which include:

“Block assist content sharing with privileged apps", a setting that helps mitigate the emerging risk of AI assistants and screen readers from capturing work profile screenshots and app details. This stops AI services like Circle to Search from ingesting corporate context into external learning datasets while still allowing personal AI features to function.

Work-profile privacy settings that block Bluetooth contact sharing and prevent work contacts from appearing in personal caller ID Control data flows.

New work profile password options (expiration, reuse history, and device wipe on failure).

Android: Policy targeting and security enforcement

To help ensure your most sensitive controls reach only the devices that need them, IT can now use Device Management Type as an assignment filter property in Intune for precision policy targeting. Instead of over-applying rules to all Android devices, you can now differentiate between corporate and personal devices across Android Enterprise and AOSP.

This precision extends into real-time security enforcement. When Microsoft Defender for Endpoint detects a rooted Android device, Microsoft Tunnel immediately blocks VPN access, dropping active connections until the device is remediated. Because Defender's detection works natively within Intune, your existing compliance policies are automatically enforced through Tunnel (across both MDM-managed and MAM scenarios) without manual reconfiguration. Learn more in the following blog on native root detection support for Microsoft Defender on Android.

iOS and macOS: Enrollment experience design

First impressions during enrollment shape user expectations and IT confidence alike.

When an employee unboxes a new device enrolled through your organization, those initial screens become an opportunity to empower users and position IT as an enabler. Finding the right balance has sometimes meant accepting trade-offs. IT admins could streamline the flow, or show every configuration option, but rarely both.

Setup Assistant customization for iOS/iPadOS and macOS automated device enrollment, now generally available, delivers both of these benefits. Administrators can now hide or show specific Setup Assistant screens, enabling fine-grained control over the enrollment experience while preserving flexibility. Want to show App Store and camera configuration on some devices but hide privacy settings on others based on policy? You can do that now. The result is enrollment tailored to your actual requirements, not constrained by platform defaults. For detailed configuration guidance, see Set up automated device enrollment for iOS/iPadOS and Set up automated device enrollment for macOS.

In summary, whether Android users require precise privacy controls or iOS users benefit from a customized enrollment experience, the November Intune release emphasizes that effective, cross-platform management involves respecting each device platform's uniqueness and working to optimize for them.

Improving end-user onboarding experiences

Providing employees with immediate access to devices equipped with necessary applications can enhance employee satisfaction, optimize security measures, and increase overall productivity. Upon logging into a Cloud PC environment, end-users encounter pre-installed applications, enabling them to begin working efficiently without delay.

Windows Autopilot device preparation in automatic mode is now available in public preview for Windows 365 Enterprise, Windows 365 Frontline dedicated mode, and Windows 365 Cloud Apps. IT administrators now can include device preparation policies as part of their Cloud PC provisioning process.

This capability streamlines the Cloud PC provisioning process, improves the end-user experience, and eliminates the need for custom images, while providing visibility into installation progress with both the CPC report and the Autopilot device prep deployment report. This ensures the device is set up with critical apps and scripts when the end-user logs in on day one.

Looking forward to 2026

Cloud-native endpoint management on a trusted platform is the foundation for how organizations will support AI safely across endpoints. The investments throughout 2025 focused on reducing friction at critical points, rather than painting with a broad brush, across every aspect of endpoint management, and showed what's possible when management infrastructure is built for modern threats and modern work.

Whether it's automating tedious admin tasks, respecting platform-specific security needs, or accelerating device readiness, a cloud-powered, AI-driven approach helps move IT from firefighting to strategy. In 2026, we will continue to innovate with this focus and share more updates on Intune's advanced capabilities coming to Microsoft 365 E3 and Microsoft 365 E5, which will expand access to the solutions of the Microsoft Intune Suite to more customers. See you in 2026!

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.

Microsoft 365 adds advanced Microsoft Intune solutions at scale

Talal_Alqinawi — Thu, 18 Jun 2026 22:10:47 GMT

Note: New capabilities will begin to roll out CY26 Q3. Customers will receive a 30‑day notice in Message Center before the update becomes available in their tenant.

In the last three years, Microsoft launched multiple endpoint management solutions with advanced capabilities that enable IT professionals to unify mission critical endpoint management functionality in one cost-effective plan with the Microsoft Intune Suite. These capabilities are essential to accelerate every organization’s journey towards Zero Trust security, improving end user productivity, and empowering IT and security professionals to improve total cost of ownership (TCO).

Today, IT teams face new challenges, as device inventories grow larger, more diverse, and are much more widely distributed and dynamic than just a few years ago. At the same time, they are still expected to keep systems protected, compliant, and operational with limited budgets. To meet evolving security needs and growing demands, organizations need more advanced security and management tools capable of transforming IT operations in ways that can safeguard against AI-enhanced attack vectors and new risks while preserving productivity on every endpoint.

To help organizations make this transition, Microsoft is bringing powerful capabilities of the Microsoft Intune Suite to Microsoft 365 E3 and Microsoft 365 E5. By expanding these offerings, more customers can confidently embrace transformation and stay secure in the age of AI.

“Intune Suite makes managing 10,000 or 40,000 devices effortless through automation and unification. The capacity to scale effortlessly while simplifying processes has led to more efficient updates and quicker incorporation of new assets.” –Roman Kleyn, Head of Workplace Design, Krones AGⁱ

Unifying Endpoint Management: Key capabilities driving customer choice

Microsoft Intune empowers IT to solve issues faster, get proactive with data and secure diverse devices with Intune Remote Help, Intune Advanced Analytics, Microsoft Tunnel for Mobile Application Management, specialty device management and firmware updates. These capabilities will be added to Microsoft Enterprise Mobility and Security E3 (EMS E3) which also extends this value to Microsoft 365 E3. Furthermore, to unify advanced security and device management, Intune Endpoint Privilege Management, Intune Enterprise Application Management and Microsoft Cloud PKI will be added to Microsoft 365 E5.

These changes, alongside the Microsoft Security Copilot and Microsoft 365 updates, will fundamentally expand the availability of Intune integrated, cloud powered capabilities. This expansion will provide seamless access to advanced management and security features as well as agentic, automated workflow capabilities within Microsoft’s most comprehensive commercial products. It will empower IT to help safeguard productivity and strengthen their Zero Trust posture by minimizing risk, maintaining compliance, and ensuring seamless, secure digital employee experiences. Ultimately, this change will enable proactive issue prevention, more secure work, and efficient ways to scale operations.

With the rollout of Microsoft Security Copilot in Intune, we’ve helped organizations enter a new era where AI is increasingly incorporated into their IT operations. Last month at Microsoft Ignite 2025, we announced a significant step that goes even further, putting AI at the core of endpoint management. With the launch of a new wave of Security Copilot agents in Intune and more ways to explore Intune data, IT can ask important questions, take action on the answers, and simplify complex tasks with intelligence and automation.

Here’s a closer look at why organizations are choosing Intune and Security Copilot as their endpoint management solution.

Enhanced security simplifies implementation of Zero Trust principles

In 2025, 79% of ransomware attacks involved remote management tools on endpoints, highlighting the critical need for Zero Trust controls and least-privilege access on every device.ⁱⁱ

Endpoint Privilege Management enables organizations to adopt a least privilege approach, mitigating systemic risks of local admin privileges by providing elevated access only to approved apps or services. Just-in-time elevation helps to maintain productivity without compromising security.
- Copilot in Intune offers assistance by providing valuable insights based on Microsoft Defender threat intelligence that assesses an app’s risk before IT approves an elevation.
Microsoft Tunnel for Mobile Application Management supports Zero Trust principles by providing secure per-app VPN connectivity access to company resources without requiring enrollment, protects corporate data and respects employee privacy.

AI-powered insights and remote assistance powers productivity

“Remote Help closed the gap that we had for remote management. Now we have an enterprise-compatible solution with audit logs, allowing us to see what’s happened, who is connected to whom, etc. These are true benefits from an enterprise solution,” – Michael Meier, Senior System Administrator, Krones AGⁱⁱⁱ

Advanced Analytics offers AI-powered anomaly detection to proactively identify device health and other forms of digital friction and gives IT visibility into areas of focus to keep operations running smoothly and ensure device compliance.
- Copilot in Intune assists admins of all experience levels in performing complex tasks such as writing KQL queries through the simple use of natural language.
Remote Help allows IT teams to safely and remotely support and fix issues more quickly. All interactions are fully auditable and use strong authentication, trusted connections, role-based access control, and device compliance checks.

Streamlined app deployment and automated certificate lifecycle management helps maintain compliance and protection at scale

“Cloud PKI within the Intune Suite allows you to go cloud native in terms of certificate deployment, which means you can provision PKIs with just a few clicks — that’s a blessing for all the IT administrators. With this built-in service, Microsoft hosts everything for you to manage certificates.” Niklas Tinner, Founder/Solution Architect, Oceanleaf GmbH^iv

Enterprise Application Management streamlines app deployment and updates, reduces IT overhead, and improves the digital user experience with a curated catalog of 1000+ of prepackaged applications.
- The Vulnerability Remediation Agent helps reduce the effort of discovering and prioritizing breach or work disruption risks, giving IT insight on what patches to prioritize.
Microsoft Cloud PKI allows IT to streamline the management of the complete certificate lifecycle and reduce the dependency on on-premises infrastructure. It also helps prevent phishing and mitigate other risks with certificate based authentication to Wi-Fi and VPN services.

A unified IT ecosystem for long term value

Including Intune’s advanced capabilities directly into Microsoft 365 is the latest step in our larger vision to create a unified, strategic foundation that enables companies to manage and secure their endpoints. Intune and Security Copilot are built to work seamlessly within Microsoft 365, Windows 11, Windows 365, Entra, Purview and Defender.

“One New Zealand saved $800K by modernizing with Windows 365 and Microsoft Intune, cutting provisioning-related tickets by 80%. Devices that once took four to six hours to provision are now ready in 30 minutes. User assignments take less than 15 seconds, and onboarding time for call center staff dropped almost 95%.^v

In addition to Intune’s upcoming changes within Microsoft 365, the recently announced Windows resiliency and security capabilities will be added to Windows Enterprise E3:

Windows Resiliency Initiative recovery tools now include quick machine recovery (QMR) with enterprise-level controls, point-in-time restore, and cloud rebuild for Windows 11. Through Intune, QMR enables fast restoration of apps, settings, and files, as well as Windows Backup and OneDrive.
Windows Autopatch now includes update readiness, in preview, giving IT teams real-time visibility into device compliance and risks through a pre-built Intune dashboard. Administrators can quickly identify, diagnose, and remediate updates, telemetry and policy issues directly within Autopatch.

What does this mean for your organization?

Microsoft is committed to delivering a unified management and security foundation on a trusted, cloud platform that elevates how organizations operate and defend at scale. Aligning this with AI-powered and agentic automation enables stronger Zero Trust controls to help safeguard productivity, minimizes risks, and improves agility for IT teams and end users.

When you’re ready to learn more, connect with your Microsoft account team to discuss adoption roadmaps and discover how a comprehensive, AI-ready portfolio can help you solve even the most complex IT challenges.

FAQ

1. Which Intune related capabilities are included in each plan?

Here is a summary of the Microsoft 365 plan changes related to Microsoft Intune:

Microsoft 365 plans	Included capabilities
Microsoft Enterprise Mobility and Security E3 (EMS E3) (included in Microsoft 365 E3)	· Intune Remote Help · Intune Advanced Analytics · Intune Plan 2
Microsoft 365 E5	All Microsoft 365 E3 features plus: · Intune Endpoint Privilege Management · Microsoft Cloud PKI · Intune Enterprise App Management
Microsoft 365 E5	· Microsoft Security Copilot
Windows Enterprise E3 (included in Microsoft 365 E3)	· Quick Machine Recovery (QMR) · Cloud rebuild for Windows 11 · Point-in-time restore for desktop · Post-quantum security APIs · Autopatch update readiness
Windows Enterprise per-device license	· Basic resiliency features (QMR, point in time restore) · Software Assurance

2. What is included in Intune Plan 2?

Intune Plan 2 capabilities planned to be included in Microsoft Enterprise Mobility and Security E3 include: Tunnel for Mobile Application Management (MAM) for secure per-app VPN connectivity access to company resources without requiring full device enrollment. Specialty device management covers the protection for devices such as AR/VR headsets, smart screens, and certain meeting room systems for specialized business needs. Firmware over the air (FOTA) updates for supported Zebra devices.

3. When do these changes take effect?

For the 2026 planned product additions to Microsoft 365, a Microsoft 365 admin center notification will be posted for administrators of eligible organizations 30 days in advance of the effective change.

4. Do I need to change my plan to use the Intune Suite capabilities or any of its add-ons?

No action is necessary. All eligible tenants with Microsoft Enterprise Mobility and Security E3 and Microsoft 365 E5 will automatically be provisioned with the Intune Suite capabilities based on the table above. 

^{i Success with Intune Suite streamlines Krones AG global operations | Microsoft Customer Stories}^{ii Microsoft Digital Defense Report 2025 – Safeguarding Trust in the AI Era}^{iii Success with Intune Suite streamlines Krones AG global operations | Microsoft Customer Stories}^{iv Microsoft Cloud PKI—Certificate Management | Microsoft Security}^{v One New Zealand saves $800,000 by modernizing with Windows 365 and Microsoft Intune | Microsoft Customer Stories}

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.

Essential Intune reading list: MVP community content for 2025

Lior_Bela — Thu, 04 Dec 2025 20:04:15 GMT

As we head into the holiday season, I wanted to take a moment to celebrate something truly special: the incredible contributions from our Microsoft Intune MVP community this year. Last year, I released our first Holiday Reading post, which got a lot of traction, and I was asked to do it again this year — so I guess we are starting a new tradition!

Whether you're a security-focused admin exploring Zero Trust architecture, a Windows specialist diving into the latest policy enforcement mechanisms, a Mac admin navigating the evolving Apple ecosystem, or an automation advocate building the next great community tool, there's something here for you.

This collection represents the spirit of our community, packed with real-world lessons, practical insights, and suggested solutions from experts in the field. While this is a select set of collected content, I strongly recommend checking out all of the content created by our MVPs — you can find a list of our active Intune MVPs here (make sure to set the filter for Microsoft Intune under Technology).

Introduction to Intune

Know someone who needs to get up to speed on Intune quickly? Share these resources:

Getting started with Intune – Important hints and tips for Intune beginners — settings you won't want to overlook (Andrew Taylor)

12 reasons why Intune – A comprehensive podcast covering Zero Trust-ready, BYOD-friendly endpoint management (Sucheta Gawade)

Security & compliance

A stronger security posture is at the top of almost every organization’s wish list. Read and watch what MVPs are recommending:

Cloud PKI essentials – A deep dive into what Cloud PKI is, deployment approaches, and where organizations stand today with certificate distribution (Shady Khorshed)

Device-centric Zero Trust with Intune + Defender – Learn how to implement a complete Zero Trust strategy using Intune and Microsoft Defender for Endpoint (Sucheta Gawade)

Windows patching best practices – Common mistakes Intune admins make and how to patch Windows correctly (Pavel Mirochnitchenko)

Advanced conditional access scenarios – Real-world field experience and best practices for complex conditional access setups (Niklas Tinner)

Edge password sync security – How to manage Edge password sync on unmanaged devices when using Microsoft Password Manager (Kenneth van Surksum)

AppLocker automation – Automate your AppLocker configuration directly in Intune with scripts (Niels Kok)

NIS2 compliance with Microsoft 365 – Comprehensive guide to reaching NIS2 compliance using Intune and Azure (Jeroen Burgerhout)

Mobile Application Management (MAM) – Step-by-step setup for iOS and Android MAM with automation scripts (Gannon Novak)

Windows & Windows 365

Master the latest Windows capabilities with this guidance from our top experts:

Windows 11 kiosk multi-app mode – Tackle the XML struggle and get your kiosk devices working with Edge and the Windows App (Joery Van den Bosch)

Multi-admin approval in Intune – Set up Intune's multi-admin approval feature with ease, plus insights on the end-user experience (Joery Van den Bosch)

Windows Backup for Organizations – Introducing Windows Backup with Intune for smooth device upgrades and refreshes (Joery Van den Bosch)

Windows 11 hotpatching – A comprehensive deep-dive into applying critical security updates without reboots using Intune (Sucheta Gawade)

OMA-DM and policy enforcement – Understanding how Intune uses the OMA-DM protocol to manage and enforce policies (Joost Gelijsteen)

Declared configuration – The evolution of Windows policy enforcement with MMP-C and declared configuration (Joost Gelijsteen)

Device query for multiple devices – Extract device data across your fleet using endpoint analytics (Joost Gelijsteen)

Windows shared PCs configuration – Master Windows shared PCs with Intune and understand how it differs from kiosk mode (Jeroen Burgerhout)

Administrator protection in Windows 11 25H2 – Explore the new isolated privilege model replacing traditional admin elevation (Rudy Ooms)

Entra group SID translation – Finally! Translate Entra group SIDs into readable names on your devices (Rudy Ooms)

Intune policy delivery – Debunking the 8-hour sync myth and understanding how policy delivery really works (Rudy Ooms)

Windows 365 Link experience – Best practice configurations and everything you need to know about Windows 365 Link (Niklas Tinner)

Entra ID joined kiosk devices – Deploy fully functional, self-deploying kiosk devices on modern Windows endpoints (Joey Verlinden)

App Control for Business – Solving unsigned WIX .dll issues with App Control for Business (Jörgen Nilsson)

macOS & Apple ecosystem

Apple device management is evolving fast. The Intune community helps keep you up to date:

macOS LAPS configuration – Complete guide to setting up Local Administrator Password Solution for macOS with Intune (Joery Van den Bosch)

JUMP-IN: macOS MDM migration tool – Discover this all-in-one macOS MDM migration tool and learn how it's revolutionizing transitions (Shady Khorshed)

macOS 26 & iOS 26 for enterprises – Apple's biggest shift in enterprise device management in years — key changes and deadlines for IT admins (Somesh Pathak)

macOS migration glow-up – Step-by-step process for switching macOS MDM using the new ABM update (Somesh Pathak)

Introduction to macOS management – Beginner-friendly guide to managing macOS with Intune (Jeroen Burgerhout)

iOS app protection policy features – New features in app protection policies for iOS and what they mean for your setup (Arno Van Dijk)

Updates, patching & device management

Get tips to keep your devices running smoothly and securely:

Driver management in Intune – Compare script-based driver updates vs. Intune's Driver Update Management solution (Pavel Mirochnitchenko)

Enterprise App Management – Explore the Intune Suite's features for simplified app deployment and maintenance (Arno Van Dijk)

Remove Default Windows Store packages – Control Windows 11 built-in apps using the Settings Catalog without scripts (Arno Van Dijk)

IntuneBrew – Application and patch management for macOS apps made easy (Ugur Koc)

Community tools & automation

Supercharge your Intune management with these community-created solutions:

Intune Assistant – Empower yourself with unparalleled efficiency in Intune management through advanced visualization and analysis (Sander Rozemuller)

IntuneStack – Manage Intune policy as code with GitHub Actions, OIDC authentication, and ring-based deployments (Hailey Phillips)

Intune Log Reader for Windows – Real-time analysis and monitoring of Microsoft Intune Management Extension logs on Windows (Somesh Pathak)

Intune Log Reader for macOS – Real-time analysis and monitoring of Microsoft Intune MDM logs on macOS (Somesh Pathak)

ABM API Client – Native macOS client for Apple Business Manager and Apple School Manager APIs with an intuitive GUI (Somesh Pathak)

Fleetly – iOS app for IT administrators to manage and monitor Intune-enrolled devices on the go (Somesh Pathak)

TenuVault – Backup and restore for Intune with full automation (Ugur Koc)

Intune Documentation Generator – Generate PDF reports of all your Intune configurations in minutes (Ugur Koc)

Envoy Lightweight UEM – PowerShell-based User Environment Manager designed for Intune-managed Windows machines (Joey Verlinden)

OpenIntuneBaseline – Community-supported security baseline for Intune with real-world best practices (James Robinson)

IntuneQLinks – Comprehensive catalog of community articles, blogs, videos, and diagrams — your go-to resource library (Andy Jones)

Azure Virtual Desktop PowerShell module – Streamline Azure Virtual Desktop management with this powerful community tool (Sander Rozemuller)

Daily Checks – Get a daily digest of what's happening in your tenant via email with this free service (Andrew Taylor)

Community groups & resources

Microsoft Intune - Android and iOS Admins LinkedIn Group – A focused community for mobile device management with Intune (Andy Jones)

Community Events

Participate in the Intune community in person at these upcoming events

Workplace Ninjas US 2025 – Dallas, Texas, USA – Dec 9–10, 2025
Event page: https://workplaceninjas.us

Experts Live Denmark 2026 – Copenhagen, Denmark – February 24–25, 2026
Event page: https://cloudway.com/calendar-event/experts-live-denmark/

Modern Endpoint Management Summit 2026 EMEA Edition (MEM Summit Paris) – Paris, France – April 22–24, 2026
Event page: https://sessionize.com/MEMSummit2026/

Workplace Ninjas Norway 2026 – Oslo, Norway-May 27, 2026
Event page: https://wpninjas.no/

Workplace Ninja Summit 2026 – Baden, Switzerland – TBD
Event page: https://summit.wpninjas.global/

Intune Community Resources

Get trusted Intune tips and strategies from these blogs, videos, and podcasts from industry experts.

Andrew Taylor Newsletter and blogs - https://andrewstaylor.com/

Lewis Barry - https://conditionalaccess.uk/

MsEndpointmgr- (33) MSEndpointMgr - Jungling the Cloud - YouTube

Peter van der Woude – All about Microsoft Intune - https://petervanderwoude.nl/

Simon Skotheimsvik - https://skotheimsvik.no/

Niklas Tinner - https://www.oceanleaf.ch/

Adam Gross Intune Training - https://www.youtube.com/@IntuneTraining

Jonathan Edwards M365 Training - https://www.youtube.com/@bearded365guy

Steven Weiner - https://www.getrubix.com/

Workplace Ninjas Netherlands Podcast - https://creators.spotify.com/pod/show/wpninjasnl

Workplace Ninja User Group Netherlands Video - https://www.youtube.com/@wpninjasnl

Workplace Ninja User Group India - https://www.meetup.com/workplace-ninja-user-group-india/events/

Microsoft Cloud and Client Management Community Belgium - https://www.linkedin.com/company/mc2mcbe/

A special thanks to our contributors

A heartfelt thank you to all the MVPs who contributed to this year's roundup:

Your expertise, generosity, and passion for sharing knowledge continue to elevate the entire Intune community. Thank you for everything you do. Wishing you a wonderful holiday season and a successful 2026! Stay secure, stay innovative, and be well.

Disclaimer: This content has been created and curated by the community. Readers are encouraged to independently verify technical details and evaluate resources for their specific environments.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.