What is Zero Trust and is it the Future of Cybersecurity?
Zero Trust is a security architecture that assumes the network is already infiltrated and implements multi-factor authentication, least privilege access, and real-time monitoring and analytics to secure digital assets. The Zero Trust model goes beyond the traditional perimeter-based security method and focuses on protecting identities, endpoints, applications, data, infrastructure, and networks. By using a Zero Trust model, organizations can better protect themselves from cyber-attacks and data breaches while still making sure they are compliant and staying productive. Zero Trust is the future of cybersecurity because it focuses on visibility, automation, and orchestration. It is also the key to securing your digital estate.Speed where it matters: How Microsoft Intune helps IT prioritize time-sensitive actions
By: Albert Cabello Serrano | Principal Product Manager - Microsoft Intune A closer look at how Intune delivers updates to devices and the investments we’re making to help important changes move faster and more predictably. A common concern we hear from IT admins is, “How quickly will this change actually reach my device?” In many cases, the answer is much faster than expected. Today, 90% of policy updates, app deployments, and device actions in Intune are completed in under an hour. So where does the idea of “8-hour latency” come from? That number reflects a routine maintenance check-in used when devices are idle - not how Intune processes meaningful changes. Intune uses notification-based, priority-driven processing so that high-impact actions, like security policy changes or remediation steps, are handled promptly and reliably as possible. In this context, latency isn’t about making every action instant - it’s about providing predictable, prioritized delivery at global scale. The sections below break down how Intune prioritizes different types of updates and recent investments that are helping time-sensitive changes complete more consistently. How Intune delivers changes to devices Cloud-based device management is designed for real-world conditions; devices are not always online, fully charged, or on stable networks. Intune uses an eventual consistency model so devices can continue to be productive while converging to the desired state over time, without management actions unnecessarily disrupting users or workflows. Because devices operate in different conditions, not all device activity is handled the same way. To manage change reliably at scale, Intune uses different types of device check-ins depending on what needs to happen. Types of device check-ins in Intune Device check-ins generally fall into several categories, each triggered by a different type of action: Single‑device check‑ins: Occurs when an admin or user initiates an action on a specific device, such as starting a device action or installing an app from the Intune Company Portal. Change‑based check‑ins: Push‑triggered check‑ins used to deliver meaningful changes to devices as soon as possible. Client‑initiated check‑ins: Background activity that helps keep devices healthy, such as when a user signs in to a device or when malware status changes. Maintenance check-ins: Scheduled syncs that occur at predetermined intervals and can be client or service-initiated, depending on the platform. These typically occur approximately every 8 hours. Regardless of what triggers a check-in, any pending changes will be applied to the device when it occurs. What happens when an admin makes a change When an admin makes a change in Intune, such as updating a device compliance policy, deploying an app, or setting a configuration, Intune identifies the devices impacted by that change and initiates a change‑based check‑in for affected devices. For online devices, Intune sends a push notification prompting the device to establish a management session with the service, apply the change, and report enforcement status back to Intune. If a device is offline or unreachable, the change is applied when the device next checks in through available mechanisms. Four investments that help critical updates move forward faster The following product changes focus on reducing device‑change latency by shortening the time between an admin action in Intune and enforcement on the device, especially during peak or constrained conditions. 1. Check-in prioritization focused on what matters most Not all device activity carries the same urgency. Routine background check-ins can compete for service resources with devices that have important pending changes, such as compliance updates, remediation actions, or administrator-initiated configuration changes. Intune evaluates the potential impact of delaying a device check-in on security posture, compliance state or user productivity, and dynamically prioritizes processing accordingly. This real-time prioritization model ensures that high-impact actions move forward without being delayed by lower‑impact background activity. Prioritization adapts as conditions change, helping important updates reach devices more quickly and predictably without being delayed by lower-impact background activity. 2. Built-in resilience when multiple changes occur in quick succession Change activity often happens in bursts, with several related updates occurring in rapid succession. These periods of activity may be driven by operational needs or background processes, and can involve adjusting assignments, updating multiple policies, or rolling out configuration changes across the same set of devices. Intune dynamically coordinates notifications, so that each change requiring action triggers a corresponding device notification, even during high-activity periods. This helps improve consistency when applying multiple updates and reduces delays across consecutive changes on devices. Over the next several months, these improvements will extend to additional payloads delivered through the Intune Management Extension (IME), including scripts, Win32 apps, and custom compliance across both Windows and macOS platforms. 3. More timely notifications on Windows Intune notifies devices to check-in when changes require action. If the device is offline, on an unstable network, or low on battery, notifications may be delayed. This can cause missed check-ins or delayed actions. When notification services are delayed, blocked, or unavailable, devices may fall back to scheduled maintenance check‑ins to apply changes. For timely delivery, required notification service endpoints need to remain accessible so devices can receive management signals when updates occur. On Windows devices, Intune complements the Windows Notification Service (WNS) with the same notification protocol that powers Microsoft Teams via the Intune Management Extension. This helps increase the likelihood that devices receive management notifications when they’re online and reachable, improving visibility into whether policy updates or device actions have reached their destination. For more information, see the network endpoints for Intune documentation. 4. Optimized maintenance check-ins for iOS devices Background check-ins are still important to keep devices healthy when nothing else is going on. Unlike Windows devices, iOS devices don’t have client scheduled check‑ins and depend on service‑initiated maintenance check‑ins to ensure device health and compliance. During peak usage periods, these maintenance check‑ins can account for a significant portion of overall traffic, which can compete with devices that require immediate updates. Intune considers device activity in the scheduling of maintenance check‑ins during peak activity, making room for higher‑impact updates, while continuing to ensure devices check in regularly. This helps manage traffic and improves responsiveness when applying policies or remediation actions. What this means for you For IT admins: No additional configuration or workflow changes are required to benefit from Intune’s built-in notification system. When bidirectional communication with notification service endpoints is open, devices can receive and act on updates as they become available. For security teams: Faster delivery of device changes helps shorten the time between a policy update, a tightened Conditional Access rule, an updated compliance baseline, and a remediation action. For Zero Trust frameworks, where posture signals drive access decisions, this helps narrow the window during which a device could be out of compliance or vulnerable. Together, these improvements reflect how Intune is evolving into a more intelligent, priority-aware system. Rather than making every action instant, the focus is on prioritizing high-impact updates so they are delivered without unnecessary delays. This approach is expanding across a number of scenarios to provide a more consistent and predictable experience, helping reduce delays for key updates. Resources to learn more For another perspective on this topic, read an MVP’s take on demystifying the “8-hour” timing myth in this LinkedIn post. You can also watch the recent Tech Takeoff about this same topic to learn more about these improvements. Also, in the April edition of the What's New in Intune blog, we introduced a new segment called Myth vs. Reality. This post is part of that series. To stay current on new capabilities and updates as they ship, follow the What's New in Microsoft Intune blog. What myth should we debunk next? Leave a comment below or reach out to us on X @IntuneSuppTeam or @MSIntune.Microsoft Security Copilot in Intune - Pt. 2: Vulnerability Remediation Agent in limited preview
By: Julia Idaewor - Product Manager 2 | Microsoft Intune The threat landscape continues to evolve rapidly, with attackers constantly advancing their techniques to exploit zero-day vulnerabilities—leaving organizations at greater risk. In 2024, more than 40,000 vulnerabilities were disclosed, marking a 38% increase from 2023. For IT and security teams, evaluating the impact of thousands of vulnerabilities and deciding which to address first is a complex and resource-intensive task. It often involves manual analysis, siloed tools, and competing priorities. Microsoft Intune is bringing the power of AI directly to IT teams with the introduction of Security Copilot agents. The new Vulnerability Remediation Agent for Security Copilot is now in limited public preview. The agent helps reduce the burden of managing an ever-growing list of vulnerabilities by leveraging rich data from Microsoft Defender Vulnerability Management to detect and prioritize vulnerabilities across managed devices. It also delivers a comprehensive Copilot-assisted impact analysis, and step-by-step remediation guidance directly in the Intune admin center along with a comprehensive list of exposed devices that can be exported for actionable responses, enabling faster, more confident action. As part of the upcoming enhanced AI experience in Intune, the agent exemplifies how Microsoft is embedding Copilot into its workflows turning raw data into actionable insights and empowering security teams to stay ahead of evolving risks. Getting started You can get the Vulnerability Remediation agent up and running in just a few steps. To set up the agent navigate to the Endpoint security in the Intune admin center, review set up details and start the agent. Microsoft Defender Vulnerability Management to surface a prioritized list of top vulnerabilities based on risk and impact. The agent delivers these insights directly to the Intune admin center, giving admins clear visibility into the most critical threats across their device estate. directly to the Intune admin center, giving admins clear visibility into the most critical threats across their device estate. The Vulnerability Remediation Agent dashboard in the Intune admin center provides a comprehensive view, including an Impact score for each suggestion, number of exposed devices, remediation status, last applied time for tracking actions, and an agent activity log for historical context. By removing silos between IT and security teams and surfacing vulnerability data and actionable insights directly in Intune, the agent helps increase transparency, streamline workflows, and boost operational efficiency across the board. The Vulnerability Remediation agent provides IT pros with actionable insights from Microsoft Defender Vulnerability Management in the form of a prioritized list of suggestions. When admins open a suggestion, they can view a comprehensive, AI-assisted vulnerability impact analysis designed to equip admins with the most critical insights needed to assess high-impact vulnerabilities and the actionable steps to take in Intune to resolve them. Each suggestion highlights the recommended action to take, the most critical vulnerabilities, presence of active exploits, step-by-step recommended remediation steps, affected systems, and organizational exposure. To streamline next steps, the agent also surfaces a comprehensive list of exposed devices, which are easily added to either new or existing Microsoft Entra device groups for remediation. After reviewing and completing the recommended steps, admins can select “Mark as applied” to instantly update the status to “Applied”. This action serves as an attestation that remediation is now completed—providing teams with traceability. The agent does not take any action on the devices, ensuring that full control remains with your IT team. Demo The Vulnerability Remediation Agent empowers IT teams to proactively strengthen their endpoint security posture. By surfacing prioritized insights and delivering clear, actionable guidance within Intune, the agent helps admins quickly assess and remediate high-impact vulnerabilities. From insight to action, it’s never been easier to stay ahead of threats while bridging the traditional gap between IT and security teams. With AI-driven support, organizations can enforce best practices, respond faster, and build resilient, future-ready endpoint security strategies. The new Vulnerability Remediation Agent with Copilot in Intune transforms how IT teams manage vulnerabilities connecting insights from Microsoft Defender directly to action in Intune. Instead of relying on manual escalations across teams, the agent continuously scans for vulnerabilities, prioritizes them based on risk, and recommends remediations aligned with Defender guidance. IT admins can now review and approve these fixes directly within Intune, streamlining the path from detection to deployment. This reduces delays, increases control, and accelerates response - empowering teams to remediate confidently and efficiently. What’s next The launch of the Vulnerability Remediation Agent in preview paves the crucial foundation for our ultimate vision: achieving end-to-end automation for the entire vulnerability remediation lifecycle—dramatically reducing risk exposure and accelerating response times. By combining Copilot-assisted guidance with device ecosystem data, this agent represents a significant leap forward in streamlining operational efficiency and transforming how organizations not only focus on high-impact vulnerabilities but also understanding the right actions to take to protect their endpoints. As we continue to innovate, our commitment is to empower organizations with the tools and insights they need to build resilient, future-ready security infrastructures. The Vulnerability Remediation Agent is currently in a limited public preview and available to only a select group of customers. To learn more about setup and capabilities, be sure to explore our documentation on the Vulnerability Remediation Agent. We look forward to providing further updates as part of the Copilot in Intune blog series. Make sure to check out the previous blog if you missed it: Microsoft Security Copilot in Intune deep dive – Part 1: Features available in public preview. If you have any questions or want to share how you’re using Copilot in Intune, leave a comment below or reach out to us on X @IntuneSuppTeam or @MSIntune. You can also connect with us on LinkedIn.Unpacking Endpoint Management is back - and we’ve got a lot to talk about
If you've been missing real, candid conversations about endpoint management, good news! Unpacking Endpoint Management is officially back. This series is all about what actually works. No fluff, just practical tips, proven strategies, and honest discussions to help you optimize and simplify the way you manage and secure endpoints today (and prepare for what's next). We're bringing together people from across Microsoft Intune, Security, and Customer Experience engineering and product teams, along with guest practitioners, to share what's worked, what hasn't, and what we've learned along the way. And yes…we're absolutely here for the tough questions. A quick update on the hosts Danny Guillory, a familiar face to the community and a Product Manager for Intune and Configuration Manager, will continue to host the series. He's joined this season by Rachelle Blanchard as co‑host, bringing a strong community and discovery lens to the series. Rachelle focuses on surfacing real customer questions and guiding conversations toward practical outcomes, helping ensure each episode reflects how endpoint management works in the real world. Up next June 30, 2026 – 9:00 a.m. PDT Topic TBD - What should we cover? Drop ideas below in the comments. July 30, 2026 - 9:00 a.m. PDT Topic TBD Sign in to the Tech Community and follow this post for the latest updates on upcoming episodes. Catch up on demand You may have missed them, but you don't have to miss out on the learnings. Watch and learn when it's convenient for you. Device security with Microsoft Intune Trends in endpoint management (live from Tech Takeoff 2026) Not sure where to start? Watch our most recent episode, Policy: from hybrid to cloud-native, now on demand! What's the format? This web series is streamed live on Tech Community, LinkedIn, YouTube, and X. In addition to open discussion, we answer your questions so sign in (or sign up for) the Tech Community and RSVP to submit questions early and throughout the live show. How do I join? There's no call or meeting to join. Simply head to aka.ms/JoinUEM. Show up at start time, watch live, and jump into the discussion with us. Help shape the series This series is for you - so tell us what you want to hear. Drop a comment below with: Topics you'd like us to cover Tough questions you want answered Speakers you'd love to hear from We can't wait to get started - and even more excited to hear from you along the way. Join the Community to get early insight into what's coming for Intune, connect with experts, and share real-world feedback that helps shape the product. 👉 aka.ms/JoinIntuneCommunity
Unsanctioned cloud apps generates constant alerts
When I mark a cloud app as unsanctioned it created a URL based indicator to block the site. However, it also by default enables the Generate Alert option on the indictor. This causes my SOC to bet inundated with garbage alerts. Now normally if I'm just unsanctioning one Cloud App a could go and turn of the alert. However, I use cloud app policy that will identify any new Cloud Apps in an entire category and then unsanction it. But it enables Generate Alert on the URL indicator. Then if someone accesses that new one the generate alert kicks off. I don't want to have to go into every new app and untick generate alert manually that's just too time consuming. Is there a way to change the default behaviour when adding an indicator to not enable the generate alert? Of is there some other way to do this? I could consider using power automate or something but I'd rather the default behaviour be the fix as automation can break. I don't have time to babysit it.I no longer have an edit button for assignments on one EndpointSec>DiskEncrypt>Bitlocker profiles
I have two Intune>Endpoint Security>Disk Encryption>Bitlocker policies. One is the 2+ year old deprecated policy everyone is currently on, and the other is a new policy I made two months ago. I am in the process of testing to move the company from old to new. Old policy no longer has an "Edit" button for group assignments and exclusions, much like when you don't have permissions. However, I am still able to edit the actual policy. Has anyone seen this or can help with this? Attached picture. I am using Intune Administrator permissions, and again, it's not a permissions issue as I can edit the actual policy. I have tried different browsers. I have tried another computer. The policy is scoped to default. I was last able to edit group assignments 10/25/25 Solution right now will just be to delete the old profile and move to new with no more testing. Thank you in advance, -ZP
Configure Bitlocker on TCG Opal 2 SSD
Is it possible to configure Windows 10 Pro BitLocker to use the hardware encryption built into a TCG Opal 2.0 SSD and a startup PIN? I have previously setup software BitLocker with a startup PIN and hardware BitLocker without a PIN. To configure the two together I installed a new 870 Evo SSD in a separate computer, used Samsung Magician to set SSD security to "security ready to be enabled", moved the SSD to the target computer and performed a fresh Windows 10 pro installation. I then enabled the local computer policy BitLocker setting "Configure use of hardware-based encryption for operating system drives" to prevent software-based encryption and enabled the setting "Require additional authentication at startup" to allow TPM + PIN. However, on beginning BitLocker, an error message appeared stating software encryption is not available because of the registry setting. After reversing the BitLocker hardware setting, software BitLocker with TPM and PIN proceeded as usual. Is it possible to have BitLocker hardware encryption with a PIN?
