Intune roadmap

The Intune Policy Configuration Agent will update to use a Microsoft Entra agentic identity instead of a human user identity. This enables the agent to run policy configuration actions securely and independently.

For existing agents, admins will be able to transition to an agentic identity from the agent's Settings tab by selecting Create new identity. After the identity is provisioned, the agent will now run on behalf of the logged-in user and the information will be scoped by the permissions of that account. For new agents, an agentic identity will be auto provisioned at setup.

A new capability for Windows Autopilot device preparation will be available soon: device association. Device association binds a Windows device to your organization and enables advanced functionality such as streamlined out-of-box experience (OOBE) pages, device naming before enrollment, and device-based targeting. It also improves onboarding security by verifying device identity before enrollment through hardware-based attestation and TPM-backed cryptographic validation, helping ensure that only trusted devices can access organizational resources.

You'll be able to configure Microsoft Defender for Endpoint to open automatically during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions, and assign the Defender app as required, you'll enable this experience from Endpoint security > Defender for Endpoint. Intune will open Defender during enrollment so users can complete its initial configuration as part of device setup. If configuration isn't completed, the Intune setup step will remain available so users can open Defender again. This experience will help ensure that Defender is configured before enrollment finishes.

You'll be able to use Microsoft Intune bulk device actions to activate eSIMs on up to 100 supported corporate-owned Android Enterprise devices running Android 15 or later by using a carrier activation server URL. When you bulk wipe supported devices, Intune will preserve eSIM data plans by default, and you'll be able to choose to remove them when needed. These bulk actions will help you deploy or retire devices more efficiently without configuring each device individually. Personally owned Android Enterprise work profile devices won't be supported.

The Certificate Connector for Microsoft Intune will surface new health and status signals in the admin center, so you can spot certificate-issuance problems early. You'll get clear indicators for common failure conditions — such as the connector being unable to reach the certification authority (CA), the connector's service account lacking permission to issue or revoke certificates, or certificate requests being rejected because of a template mismatch with your SCEP or PKCS profile. Each signal includes guidance to help you investigate and remediate before devices relying on certificate-based authentication hit access, sign-in, or compliance issues.

Microsoft Intune will introduce client-driven compliance evaluation for Windows devices to reduce delays in compliance reporting. Supported devices will detect important state changes locally and proactively request a compliance re-evaluation when it matters, instead of waiting for the next scheduled check-in. As an admin, you'll see faster updates for remediation, reporting, and access decisions. This capability will roll out in preview for Windows devices.

Windows Autopatch currently offers limited control over the deployment of quality updates. Today, the expedite mechanism focuses on deploying the latest security update and doesn't let admins select specific quality update releases or apply different deployment schedules, which can limit compliance, validation, and operational planning scenarios.

Soon, Windows Autopatch will let you explicitly approve, auto-approve, reject, and schedule quality updates by update type, using the same approval infrastructure used for driver updates. This unified model helps you control what content is deployed and when, so you can align rollout timing with testing, compliance, and business readiness requirements. You'll be able to independently manage:

• Monthly security updates
• Monthly non-security updates
• Out-of-band security updates
• Out-of-band non-security updates

The iOS/iPadOS Company Portal will support Declarative Volume-Purchased Program (VPP) app downloads from the Apps tab. Declarative VPP apps provide an improved end-user experience by reducing app installation latency, allowing for automatic overnight app updates, and providing the end user with a live status of an app installation. If you choose not to use Declarative VPP apps, there will be no changes to the admin and user experience.

Advanced Analytics will extend device query for multiple devices to cover app inventory data on Windows. Building on the existing multi-device query for hardware inventory, you'll be able to use Kusto Query Language (KQL) to investigate installed applications across your entire Windows fleet—identifying versions, surfacing outdated or unwanted software, and producing detailed reports without targeting devices one at a time. Multi-device app inventory queries will run against collected inventory data, so you get fleet-wide answers for compliance reviews, vulnerability triage, and license-tracking scenarios.

On macOS devices, the Disable MAC address randomization setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices.

When connecting to a network, devices can present a randomized MAC address instead of the physical MAC address. Using randomized MAC addresses is recommended for privacy, as it's harder to track a device by its MAC address. However, randomized MAC addresses break functionality that relies on a static MAC address, including network access control (NAC).

For more information, see:

• Wi-Fi profile settings for Apple devices
• Add and use Wi-Fi settings on your devices in Microsoft Intune

Microsoft Intune will support Apple's Enforce Routes feature in iOS/iPadOS and macOS VPN profiles.

This feature helps prevent situations where VPN traffic accidentally or maliciously goes outside the VPN tunnel, like what happens with de-cloaking risks. It ensures VPN routing aligns with Apple's platform semantics.

When you configure this feature in Intune, routing behavior is defined using Include all networks and Exclude local networks settings. Intune automatically derives the appropriate Enforce Routes configuration based on these selections to ensure consistent and predictable device behavior.

To learn more about VPN profiles in Intune, see:

• Create VPN profiles to connect to VPN servers in Intune
• Add VPN settings to Apple devices in Microsoft Intune

Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is detected, the device reports as noncompliant and Conditional Access takes effect. The device returns to a compliant state once the agent is removed.

Microsoft Intune will add new Apple settings for supported iOS/iPadOS and macOS devices. You'll be able to configure the new options by using Settings Catalog profiles in the Microsoft Intune admin center. These settings will expand the device management controls available through Intune and help you manage Apple devices with a consistent policy workflow. To see these settings, go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.

We're adding a new Microsoft Defender Updates template for Linux endpoint security antivirus policies. This template will include four new settings for managing Microsoft Defender for Endpoint agent auto-update behavior on Linux devices attached via MDE attach. You will be able to configure update channels and scheduling for Defender engine, platform, and security intelligence updates.

You'll be able to use Remote Help in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff will be able to establish Remote Help sessions with end users on GCCH-enrolled devices, providing real-time troubleshooting with role-based access controls through Intune. Both helpers and sharers must sign in with their organization's Microsoft Entra ID accounts.

For Android Enterprise dedicated devices using Managed Home Screen (MHS) with Microsoft Entra shared device mode, Intune will allow admins to requiring users to complete MHS authentication state before allowing protected activities in MAM-integrated apps. When MHS requires sign-in or session PIN authentication, users will still be able to complete limited actions, such as accepting or declining incoming calls. If a user tries to open another protected activity, the app will return them to MHS to authenticate. After authentication, protected app activities will become available normally. This behavior will help prevent users from bypassing the MHS session PIN while preserving critical communication actions.

We're fixing how scope tags work with Endpoint Privilege Management (EPM) reports. With this change, EPM reports will respect the report viewer's assigned scope and display the details for only the users and devices that the report user is scoped to view.

The Scoped permissions setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each role assignment's permissions apply only within its own scope tag context, giving admins exactly the access you intended.

When this feature reaches general availability, Scoped permissions will become the default behavior for all tenants.

If you haven't enabled Scoped permissions yet, use the Permissions Assessment Report at Tenant administration > Roles > Settings to preview how permissions will change before opting in.

For more information, see Permission behavior across role assignments.

Deployments and Deployments plans will give you a new way to roll out apps and configuration policies in Intune. Instead of assigning to all targeted groups at once, you'll be able to stage a rollout across multiple rings, control the timing of each ring, and monitor progress from a new Deployments experience in the Intune admin center. Plans provide reusable templates that define standardized rollout patterns for delivering a payload across devices in controlled stages, or rings. Deployments integrate with Multiple Admin Approval for change control. This helps you reduce risk when introducing changes to large device fleets.

You'll be able to use the endpoint security policy for Device control (Attack surface reduction policy) from Microsoft Intune with the devices you manage through the Microsoft Defender for Endpoint security settings management capability.

• Device control policies are part of endpoint security Attack surface reduction policy.

Applies to the following when you use the Windows platform:

• Windows 10
• Windows 11

When this change takes effect, devices that are assigned this policy while managed by Defender for Endpoint but not enrolled with Intune, will now apply the settings from the policy. Check your policy to make sure only the devices you intend to receive this policy will get it.

Microsoft Intune will update its minimum supported operating-system version after Apple releases iOS and iPadOS 27. Intune device management, the Company Portal, and app protection policies will require iOS/iPadOS 18 or later for standard supported scenarios. You'll be able to use Intune reports to identify affected devices and users and plan operating-system upgrades before the change. Userless devices enrolled through Automated Device Enrollment have a separate support statement and should be evaluated using the applicable guidance.

Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will remain enrolled, but new devices on those versions won't be able to enroll. You'll be able to use Intune reporting to identify affected devices and plan upgrades. Devices enrolled without user affinity have a separate support statement.

Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view, select the device, then select Activate eSIM and enter the carrier activation code. Intune sends the request without first blocking it based on reported eSIM slot capacity and surfaces errors returned by Google. Personally owned work profile devices aren't supported.

The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit, the antivirus engine detects threats in real time but doesn't automatically remediate them. Malware detections are reported as alerts in the Microsoft Defender portal through real-time scanning, without quarantining the malicious files. Audit mode gives you visibility into the threat landscape before you turn on full protection.

The Microsoft Defender Antivirus template for Linux is supported for devices managed by Intune, and for devices managed only by Defender through the Microsoft Defender for Endpoint security settings management scenario (MDE attach).

Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view, select the device, then select Wipe. By default, the wipe preserves eSIMs; select the eSIM removal option only when you want the wipe to remove them. Personally owned work profile devices aren't supported.

Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management, reducing the need to coordinate manual log collection with the device user.

The following eSIM features are rolling out and might not be available to all tenants yet.

Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create > New policy > Android Enterprise > Settings catalog. The value must stay at or below Time to lock screen and applies to fully managed and dedicated devices on Android 9 and later, and corporate-owned work profile devices on Android 15 and later.

Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them with Multi-Device Query. Inventory data is a subset of corporate-owned data; properties such as IMEI, ICCID, and MAC address aren't available. This gives you more consistent analytics across mixed corporate and BYOD environments.

Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC, USB, or Wireless - to control when the screen stays on. AC and USB support Android 6.0 and later; wireless charging requires Android 8.1 and later. No modes are selected by default.

Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum number of days, with a minimum of three, or enter 0 to disable the restriction. There's no documented upper limit, giving you flexibility for your organization's needs.

Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management, giving you finer control over how Defender inspects memory on your Linux endpoints.

Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a Disconnect if a Remote Desktop Services session when no smart card is present option for interactive logon. The Microsoft Office templates also gained new settings. Create a Windows settings catalog profile to configure them.

Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings, Web Content Filter, and Siri Settings for iOS/iPadOS and macOS. Configure them under Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS > Settings catalog. This lets you test upcoming Apple management controls ahead of general availability.

For more information, see Create a policy using settings catalog.

The following protected apps are now available for Microsoft Intune:

• Notion by Notion Labs
• Superhuman Mail by Superhuman Labs
• Calven by Calven Pty Limited
• Heijmans by Heijmans
• Notability by Ginger Labs, Inc. (iOS)
• Ben for Intune by Thanks Ben Ltd
• SDP - On Premises | Intune by Zoho Corporation

For more information about protected apps, see Microsoft Intune protected apps.

The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or build range. For example, create an assignment filter that pilots a configuration on a newer build before rolling it out broadly or excludes devices that haven't yet updated.

You can build rules using the rule editor or the rule syntax text box, with the same operators available for other filter properties. Existing assignments continue to work without changes.

For more information, see:

• Use assignment filters to assign apps, policies, and profiles
• App and device properties, operators, and rule editing when creating assignment filters

Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view, select the device, copy the eSIM's ICCID from device inventory, then select Remove eSIM and enter the ICCID. The action supports fully managed and dedicated devices on Android 15 and later, and work profile devices on Android 17 and later.

Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy applies. The default, False, doesn't request removal, although the operating system might still remove eSIMs when required. The setting supports Android 15 and later.

Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it to True after configuring a work profile password requirement. The default, False, allows a common lock. The setting supports Android 9 and later.

Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience on supported iPhone, iPad, and Mac devices.

Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or take action. Helpers can view and control the device to troubleshoot issues and complete support tasks remotely.

For more information, see Planning for Remote Help.

Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware, and use the reported ICCID to identify the correct eSIM for a removal action. EID reporting requires Android 13 and later; full inventory requires Android 15 and later.

Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture for agentic workloads.

For more information, see Manage security baseline profiles in Microsoft Intune and What is Windows 365 for Agents?.

Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value, all values directly under a key, or the same value across subkeys under HKEY_LOCAL_MACHINE. This gives you richer device state visibility and advanced querying without custom scripts.

For more information, see Use the Intune properties catalog to get device hardware properties.

In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from other channels, such as Group Policy, Configuration Manager, and local scripts. Extending Tamper Protection, this capability locks settings to your defined values for consistent and predictable device states.

For more information, see Controlled configuration for Microsoft Defender settings.

Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security posture, and other custom attributes not covered by built-in settings. Results appear alongside standard compliance reporting in the Intune admin center.

For more information, see Custom compliance settings in Microsoft Intune.

Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights to manage Managed Google Play app sync. With the dedicated permission, you can grant zero-touch enrollment portal access independently from app management permissions.

For more information, see Enroll by using Google Zero Touch.

Microsoft Intune now supports a more comprehensive on-demand sync for Windows devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies, apps, and scripts, so devices reflect your latest changes faster. This capability is especially useful during troubleshooting, incident response, and high-priority rollouts.

For more information, see Device action: sync.

The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are:

• Allow Local Fonts permission on these sites (LocalFontsAllowedForUrls)
• Allow M365 authentication popups in work profiles (M365AuthPopupsInWorkEnabled)
• Allow MAM enrollment when managed device has Purview DLP policy configured (MAMWithDeviceDLP)
• Automatically open Copilot side pane with contextual insights for links opened from Outlook (M365LinksAutoOpenCopilotEnabled)
• Block Local Fonts permission on these sites (LocalFontsBlockedForUrls)
• Browsing with Copilot Allowed URLs (BrowsingWithCopilotAllowList)
• Browsing with Copilot Blocked URLs (BrowsingWithCopilotBlockList)
• Configure whether the Discover or Work feed tabs are shown on the Copilot new tab page (ConfigureNTPFeedTabVisibility)
• Controls the availability of browsing with Copilot in Microsoft Edge (AllowBrowsingWithCopilot)
• Default Local Fonts permission setting (DefaultLocalFontsSetting)
• Enable Copilot address bar suggestions (CopilotAddressBarSuggestionsEnabled)
• Enable opaque origins for data URLs in Web Workers (DataUrlInWebWorkerOpaqueOriginEnabled)
• Enable the Copilot new tab page (CopilotNewTabPageEnabled)
• Enable the extended lifetime option for SharedWorkers (SharedWorkerExtendedLifetimeEnabled)
• Force foreground priority for specific URLs (ForceForegroundPriorityForUrls)
• List of URL patterns for which developer tools are allowed to be opened (DeveloperToolsAvailabilityAllowlist)
• List of URL patterns for which developer tools are blocked (DeveloperToolsAvailabilityBlocklist)
• Maximum number of concurrent connections to the proxy server for WebSocket requests (MaxConnectionsPerProxyForWebSocket)
• Override for the CPU performance tier (CpuPerformanceTierOverride)
• Set the default Copilot new tab page feed tab to Work or Discover (SetNTPDefaultFeedTab)

For the full list of policies, see the Microsoft Edge policies reference.

There are new OneDrive settings in the Windows settings catalog:

• Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device.
• Enable OpenID Connect (OIDC) authentication for syncing content from an on-prem SharePoint Server using the OneDrive sync app – lets the OneDrive sync app authenticate to an on-premises SharePoint Server using OpenID Connect when the server supports it.
• Specify the Application ID URI for your Entra application for OIDC – specifies the Application ID URI for your Microsoft Entra application used for OIDC when it differs from your SharePoint Server URL.
• Prevent users at your organization from enabling offline mode in OneDrive on the web – blocks users from turning on offline mode for OneDrive on the web.
• Prevent users at your organization from enabling offline mode in OneDrive on the web for libraries and folders that are shared from other organizations – blocks offline mode for libraries and folders shared from other organizations.
• Hard-delete the contents of a folder shortcut when unmounted – permanently deletes the contents of a folder shortcut when it is unmounted instead of moving them to the Recycle Bin.
• Hard-delete contents of a folder shortcut when a user loses permissions to the folder – permanently deletes the contents of a folder shortcut when the user loses permissions to that folder.

For more information, see Use Group Policy to control OneDrive sync app settings.

There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog). The new settings are:

• Turn off automatic updates for Windows App – controls whether Windows App automatically checks for and installs updates.
• Automatically log off users after inactive interval – signs users out of Windows App after a set period of inactivity.
• Skip First Run Experience (FRE) – skips the first-run experience so users go straight to their resources.
• Admin Release Ring Policy – sets the update release ring (channel) that Windows App follows.
• Automatically create Windows App shortcuts to desktop – creates desktop shortcuts for published Windows App resources.

For more information, see Configure updates for Windows App.

The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove. It lets you provide a custom list of package family names (PFNs) to remove, in addition to the built-in default set of Microsoft Store packages. For more information, see the ApplicationManagement policy CSP.

The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP.

Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go to Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog.

Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States catalog. Now you can deploy apps published for specific markets, such as Japan or Spain, that aren't available in the US catalog.

For more information, see Add Microsoft Store apps to Microsoft Intune.

Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user interaction, and schedule downloads and installations to reduce downtime.

For more information, see Samsung Knox E-FOTA integration with Microsoft Intune.

Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID, Diagnostics Data, and Location Services, appear during setup. By default, these screens are shown.

For more information, see Set up ADE for tvOS and Set up ADE for visionOS.

The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is:

• Disable Model Context Protocol (MCP) (DisableMCP)

For more information, see the Visual Studio administrative templates documentation.

Microsoft is adding several Intune Suite capabilities to Microsoft 365 E3 and Microsoft 365 E5 to enable more organizations to use advanced endpoint management and security without a separate add-on.

The following capabilities are added to Microsoft Enterprise Mobility + Security E3 (EMS E3), which is included with Microsoft 365 E3:

• Remote Help
• Advanced Analytics
• Intune Plan 2, which includes Microsoft Tunnel for mobile application management (MAM), specialty device management, and firmware over-the-air (FOTA) updates for supported devices

Microsoft 365 E5 includes all Microsoft 365 E3 capabilities, plus:

• Endpoint Privilege Management
• Enterprise Application Management
• Microsoft Cloud PKI

These capabilities are gradually rolling out. Eligible tenants are automatically provisioned, and no action is required. Before the change takes effect in your tenant, Microsoft posts a notification in the Microsoft 365 admin center 30 days in advance.

This update applies to commercial Microsoft 365 E3 and E5. There are no changes to the Education (EDU) or frontline worker (FLW) plans at this time. For Government plans, Intune Suite packaging is planned to align with the equivalent enterprise plans, subject to compliance and regulatory requirements. For the capabilities currently supported in GCC High and DoD, see Supported Intune features in GCC High and DoD.

For more information, see Microsoft Intune advanced capabilities and the blog post Microsoft 365 adds advanced Microsoft Intune solutions at scale.

Microsoft Intune now supports automatic updates for Enterprise App Management (EAM) applications. When you enable auto-update for an EAM app with a required assignment, Intune detects when a newer version is available in the EAM catalog and automatically updates the app on targeted devices. This eliminates manual packaging and supersedence workflows, reduces update maintenance at scale, and helps keep devices secure with timely updates.

For more information, see Microsoft Intune Enterprise Application Management.

For available macOS PKG apps, updates now deploy to devices automatically when the same app policy was updated with a new app version, so users no longer need to select Install or Reinstall in Company Portal to get the latest version. When you edit an existing available app policy with a newer version of the app that uses the same bundle ID, Intune deploys the update to the device automatically.

Automatic updates apply when both of the following are true:

• You upload an updated version of the app to Intune.
• The user already installed the app on the device.

This behavior requires the Microsoft Intune management agent for macOS version 2606.013 or later.

For more information, see Add an unmanaged macOS PKG app to Microsoft Intune.

Microsoft Intune now extends Enterprise App Management (EAM) to the GCC High (GCCH) and DoD cloud environments. Government organizations can use the EAM enterprise catalog to discover, deploy, and keep prepackaged Microsoft and third-party apps up to date without manual repackaging. A secure cross-cloud integration model maintains the compliance boundaries and authentication requirements expected for government tenants.

For more information, see Microsoft Intune Enterprise Application Management.

You can now use Trustd Mobile as a mobile threat defense partner (MTD) for enrolled devices that run the following platforms:

• Android 9.0 and later
• iOS/iPadOS 15.0 and later

To learn more about this support, see Use Trustd Mobile with Microsoft Intune.

Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux (RHEL) 9.7 as a Linux server distribution.

• This support requires the use of Podman 5.8.2 as its default container engine. Customers upgrading from environments using Podman v3 containers should recreate containers and reinstall Microsoft Tunnel, as those containers aren't compatible with newer Podman versions.
• Like other RHEL 9.x versions, RHEL 9.7 doesn't automatically load the ip_tables module into the Linux kernel. When you use this version, plan to manually load ip_tables before you install Tunnel.

For the full list of supported distributions and their container requirements, see Prerequisites for the Microsoft Tunnel in Intune.

The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type).

Applications

Connectivity

General

Platform key:

• COBO — Android Enterprise corporate-owned fully managed
• COSU — Android Enterprise corporate-owned dedicated devices
• COPE — Android Enterprise corporate-owned devices with a work profile (at work profile level)

For a list of all settings you can currently configure, see Android Enterprise device settings list in the Intune settings catalog.

The existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux Server now includes new settings you can configure and deploy to your managed Linux devices:

• Offline security intelligence update - Manage how Microsoft Defender Antivirus keeps its security intelligence current on Linux Server devices, including updates while the device is offline.
• Scheduled scan - Manage when Microsoft Defender Antivirus runs scheduled scans on Linux devices.

These settings:

• Are added to the existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux. No new profile is required. By default, they're set to Not configured.
• Are supported for Linux Server devices enrolled with Intune, and for Linux devices managed through the Microsoft Defender for Endpoint security settings management scenario, which supports devices that are managed by Defender for Endpoint but not enrolled with Intune.

For details about the available Defender settings, see Set preferences for Microsoft Defender for Endpoint on Linux in the Microsoft Defender for Endpoint documentation.

The Intune security baseline for Windows, version 25H2, is updated to include one new setting, Disable Internet Explorer 11 Launch Via COM Automation, with a baseline default of Enabled.

This setting was excluded from the version 25H2 baseline at its initial release due to a known issue, which is now resolved. When enabled, the setting prevents Internet Explorer 11 from being launched through COM automation, which reduces the attack surface on managed devices.

This change is an update to an existing baseline version, not a new baseline version. The new setting isn't visible in a baseline profile's properties until you edit and save the profile:

• Pre-existing baseline profiles: To add the new setting to a profile you created before this update, select and then Edit the profile, and then Save it. When you open the profile for editing, the new setting appears with its baseline default configuration. You can reconfigure the setting before you save, or save with no changes to apply the baseline default. After you save, Intune deploys the setting to the assigned groups at the next device check-in. If you don't edit and save the profile, the setting doesn't take effect.

• New baseline profiles: When you create a profile that uses the Windows security baseline version 25H2, or update an existing profile to version 25H2, that profile includes the new setting along with all the previously available settings.

To view the setting and its baseline default, see Windows MDM baseline settings.

The following OEMConfig apps are available in Intune for Android Enterprise:

• FCNT | com.fcnt.arrowsconfig
• FCNT | com.fcnt.arrowsconfig_test

For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.

ChatGPT is now available as a protected app for Microsoft Intune.

For more information about protected apps, see Microsoft Intune protected apps.

Remote Help supports RemoteApp in Azure Virtual Desktop (AVD), enabling help desk agents to securely view and control apps running within RemoteApp sessions. For more information, see Launch Remote Help.

Intune supports WPA3-Personal as a security-type option when configuring Wi-Fi device configuration profiles for iOS/iPadOS. Admins can now select WPA3-Personal alongside existing options such as WPA2-Personal.

This feature:

• Allows managed iOS/iPadOS devices to connect to networks that require the stronger WPA3 protocol.
• Brings iOS/iPadOS in line with the latest Wi-Fi Alliance security standards and helps organizations meet evolving network-security requirements.

Support for WPA3 on Windows, Android, and macOS platforms and for WPA3-Enterprise will be available in a future release (no ETA).

To learn more about the settings you can currently configure, see Add Wi-Fi settings to Apple devices in Microsoft Intune.

An updated security baseline for Microsoft 365 Apps for Enterprise is now available in Microsoft Intune. This baseline aligns with the most recent Microsoft 365 Apps security guidance and includes updated policy recommendations to help protect against evolving threats.

This release is version v2512, which skips the previously published version found in the Security Compliance Toolkit (v2412). Review the new baseline carefully before you adopt it.

The following three settings aren't available in this baseline release and are expected to be added in a future update. The parent setting to these three, (VBA Macro Notification Settings set to Disable all except digitally signed macros) is still included in the v2512 release:

• Require macros to be signed by a trusted publisher: Pending availability in the Settings Catalog.
• Block certificates originating from the current user store only: Pending availability in the Settings Catalog.
• Require Extended Key Usage (EKU) for code signing: Pending availability in the Settings Catalog.

Existing profiles don't automatically upgrade. To use the latest version, create a new baseline profile or update an existing profile to the latest version.

To view the full list of settings and their default values, see Microsoft 365 Apps for Enterprise security baseline version 2512. For a detailed breakdown of setting changes, see the blog post Security baseline for M365 Apps for enterprise v2512.

The minimum supported version of the Microsoft Intune app for Android is now version 2025.11.01. This change took effect on May 1, 2026. Users running an older version might experience sign-in failures.

Most users have app updates set to automatic and receive the updated app without taking any action. Users not running a supported version should update the Microsoft Intune app to the latest version to resolve any sign-in issues.

To check which devices are affected, go to Apps > Monitor > Discovered apps and find the Microsoft Intune app to identify devices running older versions.

When users enroll their personally owned Android devices in Intune, a work profile is created with a separate partition on the device for the user's work account. These devices are referred to as personally owned devices with a work profile.

As part of the Intune move to the Android Management API (opens Android's web site), there are some updates for personally owned devices that enroll in Intune:

• Web based enrollment for an improved enrollment flow and experience - Users don't have to install an app to enroll in Intune. Web enrollment is tenant wide.
• New implementation for how Intune delivers policies - Modern update on how Intune delivers and monitors policies on Android personally owned devices with a work profile. This change also aligns with how Intune manages policies on corporate owned devices with a work profile, fully managed, and dedicated devices. You can scale your migration to targeted groups.

To use these features, opt in through the Microsoft Intune admin center:

• Web based enrollment: Devices > Device Onboarding > Enrollment > Android> Personally owned devices with a work profile > Use web enrollment for all users enrolling into Android personally-owned work profile management
• Policy: Devices > Manage devices > Configuration > Create > New policy > Android Enterprise > Move to Android Management API

To learn more, see:

• New policy implementation and web enrollment for Android personally owned work profile blog
• Use Android Management API for personally owned devices with work profiles

Enrollment time grouping is now generally available for Apple automated device enrollment (ADE) on iOS/iPadOS and macOS. With enrollment time grouping, you can identify a device's Microsoft Entra security group during enrollment, so policies, apps, and settings can be applied earlier in the setup process.

Enrollment time grouping is supported in new Apple ADE enrollment policies. For requirements and setup details, see Set up enrollment time grouping. With the enrollment time grouping availability to iOS/iPadOS and macOS, we're also making the new Apple enrollment policies experience avaialble. Please check our previous blog post to learn more. (https://techcommunity.microsoft.com/blog/intunecustomersuccess/new-iosipados-visionos-tvos-and-macos-ade-enrollment-policies-experience/4393531)

In the Intune admin center, the Devices > All Devices > select a device page is redesigned and available for you to preview. This feature was available in the 2604 service release.

After the initial 2604 release, we made the following improvements:

• After you select one of the following device actions, you can temporarily view passcodes and PINs in the Device action status table:

• Reset passcode
• Recover passcode
• Remote Lock
• Rotate BitLocker Keys

• Updates to Device actions:

• Device actions work as expected when multi admin approval policies are enabled.
• Device actions for supervised iOS devices are available when the action is supported.
• Admins can enable and disable Lost mode.

• Updates to navigation:

• Tools and reports have been moved to the left navigation menu.
• The monitor tab is now the default landing tab.

• In the Essentials section:

• The Copy button and the User and Compliance links are available.
• Supervised iOS devices show a badge to help identify these devices.

• When preview is disabled, the feedback pane shows the correct text.
• Comanagement information is available.
• Admins can remove the primary user from an Azure domain joined device.

Intune now requires HTTPS delivery for managed Win32 app content. This change primarily affects organizations that use Microsoft Connected Cache and haven't configured their cache nodes for HTTPS delivery. Clients that previously pulled content from Connected Cache can still download Intune Win32 apps, but those requests bypass the cache nodes and fall back to the content delivery network (CDN). This behavior can increase internet traffic and bandwidth usage.

For more information, see the blog post How to enable HTTPS support for Microsoft Connected Cache for Enterprise and Education.

For setup and validation guidance, see:

• HTTPS support for Microsoft Connected Cache overview
• HTTPS setup on Windows
• HTTPS setup on Linux

Intune now includes a STIG audit baseline that assesses Windows devices against the recommended configurations defined in the Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency (DISA). The initial baseline audits against the Microsoft Windows 11 STIG SCAP Benchmark Version 2, Release 7 (benchmark date: January 5, 2026).

Unlike other Intune security baselines that configure and enforce settings, the STIG audit baseline is audit-only. It evaluates the current state of a device's configuration and generates detailed audit reports without changing any configured settings, helping organizations demonstrate compliance with DoD security recommendations. Audit results have a documented mapping to NIST XCCDF result categories for formal DISA compliance reporting, and Graph API support enables programmatic data retrieval and cross-tenant assessment aggregation.

The STIG audit baseline is available for US Government Community Cloud High (GCC High) tenants and requires Advanced Analytics licensing.

For more information, see Use STIG audit baselines to assess Windows device compliance.

Microsoft Intune mobile application management now supports Multiple Managed Accounts, letting users add and manage more than one managed account within the same app. App protection policies apply separately to each account, so you can tailor protection based on the account's organization or tenant. This capability helps consultants, acquisition teams, or users with multiple mailboxes stay productive without switching devices.

Currently we support Multiple Managed Accounts in Microsoft Teams on iOS/iPadOS (v8.10.0 or later). Support for additional apps and platforms is coming soon.

This feature is gradually rolling out and may not yet be available in your tenant.

To learn more, see Multiple managed accounts for app protection policies.

You have the option to display custom text in the top bar of the Managed Home Screen (MHS). In addition to the existing choices (serial number, device name, tenant name), you can now select Custom and enter a free-text string of up to 63 characters. Custom strings support dynamic variables: {{SerialNumber}}, {{DeviceName}}, and {{TenantName}}. This is useful for kiosk scenarios such as checkout devices, departmental tagging, or any case where staff need a quick visual identifier.

Using Intune, you can detect and block a Local AI Agent, like OpenClaw, on Windows devices enrolled in Intune. Specifically, you can:

• Use a Properties catalog policy to collect the Local AI Agent entity. Admins can use this information to identify devices where OpenClaw is present or active.
• Use Device Query to view devices with a Local AI Agent, like OpenClaw.
• Use the Local AI Agent Baseline - OpenClaw (Preview) to block users from using OpenClaw.

This feature is in preview.

A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to \<MTD partner name\> on enrolled Android COBO and COPE devices toggle lets you grant enhanced security permissions to one Mobile Threat Defense partner app, such as Microsoft Defender for Endpoint or a supported third-party partner, on enrolled Android Enterprise corporate-owned fully managed (COBO) and Android Enterprise corporate-owned work profile (COPE) devices.

When you turn on this toggle, the selected MTD app receives the following exemptions on targeted devices:

• Suspension — The app is prevented from being suspended.
• Hibernation — The app is prevented from entering hibernation.
• Power restrictions — The app is exempt from power-related restrictions such as app standby, and can start foreground services from the background.
• User controls — Users can't clear app data or force-stop the app.

These exemptions help the MTD app maintain continuous threat protection without interruption from system or user actions. Only one MTD partner can hold these permissions per tenant.

For Microsoft Defender for Endpoint, a second toggle is also available: Automatically launch Microsoft Defender for Endpoint during setup on Android COBO and COPE devices. When enabled, the Defender for Endpoint app automatically launches during device setup, allowing it to complete its initial configuration without requiring the user to manually open it.

For more information, see Mobile Threat Defense role.

Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs). Previously, renewing an issuing CA required creating a new CA and manually updating dependent SCEP certificate profiles, which increased operational overhead and configuration risk. With in-place renewal, certificate issuance continues uninterrupted for scenarios such as Wi-Fi, VPN, and email, without changes to existing SCEP profiles or device assignments.

For more information, see Renew a certification authority in Cloud PKI.

You can no longer configure the Managed Home Screen exit lock task mode password by using an app configuration policy. To set or update the lock task mode password for Managed Home Screen, create or update a device configuration profile that defines the lock task mode password policy.

For more information, see Configure the Microsoft Managed Home Screen app for Android Enterprise.

There's a new Block Bluetooth sharing setting in the settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type > General). When set to True, the device can't share content over Bluetooth. When set to False, Intune doesn't change or update this setting. By default, the OS has the following behavior:

• Fully managed and dedicated devices allow Bluetooth sharing.
• Corporate-owned devices with a work profile block Bluetooth sharing.

For a list of existing settings you can configure in the settings catalog, see Android Enterprise device settings list in the Intune settings catalog.

There are new Microsoft Edge 148 settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later for platform > Settings catalog for profile type).

The new policies include:

• Microsoft Edge > Startup, home page and new tab page > Configure whether the Discover or Work feed tabs are shown on the New Tab Page

This policy configures whether the Discover or Work feed tabs are shown on the New Tab Page. By default, both Work and Discover tabs are enabled. Your options:

• EnableBothWorkDiscover: If you set this value or don't configure this policy, Microsoft Edge shows both the Work and Discover feed tabs on the new tab page.
• EnableOnlyWork: Microsoft Edge shows only the Work feed tab on the new tab page.
• EnableOnlyDiscover: Microsoft Edge shows only the Discover feed tab on the new tab page.

This policy works with the Set the default New Tab Page feed tab to Work or Discover policy, which controls which feed tab is selected by default when both tabs are available.

ConfigureNTPFeedTabVisibility

• Microsoft Edge - Default Settings (users can override) > Set the default New Tab Page feed tab to Work or Discover

This policy sets the default feed tab on the New Tab Page to Work or Discover. Your options:

• Work: If you set this value or don't configure this policy, Microsoft Edge sets the default feed tab to Work.
• Discover: Microsoft Edge sets the default feed tab to Discover.

This policy only takes effect when Configure whether the Discover or Work feed tabs are shown on the New Tab Page is set to EnableBothWorkDiscover or is not configured. If only one tab is visible, this policy has no effect.

SetNTPDefaultFeedTab

• Microsoft Edge > Identity and sign-in > Allow M365 authentication popups in work profiles

This policy controls whether Microsoft Edge allows Microsoft 365 authentication pop-ups to bypass the pop-up blocker in work profiles. When users are signed in with a work account, some Microsoft 365 sites, like microsoft.com, cloud.microsoft.com, and visualstudio.com, might open authentication pop-ups to login.microsoftonline.com, login.live.com, or login.microsoft.com. These pop-ups are required to complete sign-in.

Your options:

• If you enable this policy or don't configure it, Microsoft 365 authentication pop-ups are allowed in work profiles.
• If you disable this policy, Microsoft 365 authentication pop-ups follow the default settings like other pop-ups. Users can choose to allow or block them, but they aren't automatically allowed.

This policy only applies to work profiles. In personal profiles, Microsoft 365 authentication pop-ups are always allowed regardless of this policy's configuration.

M365AuthPopupsInWorkEnabled

• Microsoft Edge > Automatically open Copilot side pane with contextual insights for links opened from Outlook

This policy controls whether Microsoft Edge automatically opens the Microsoft Copilot side pane when users open web links from Outlook emails sent from the same tenant. Starting in Microsoft Edge version 148, when users open eligible links from Outlook emails sent from the same tenant, Microsoft Edge automatically opens the Copilot side pane with contextual insights. Copilot can use the originating Outlook email as context to surface relevant insights and suggested next steps alongside the web content.

Your options:

• If you enable this policy or don't configure it, the Copilot side pane opens automatically when users open links from Outlook emails sent from the same tenant.
• If you disable this policy, the Copilot side pane doesn't open automatically when users open links from Outlook emails sent from the same tenant.

This feature applies only to links opened from Outlook emails sent from the same tenant and requires Microsoft Copilot to be available for the user in Microsoft Edge. This feature is disabled if the Control Copilot access to page context for Microsoft Entra ID profiles policy or the Control Copilot access to Microsoft Edge page content for Entra account user profiles when using Copilot in the Microsoft Edge sidepane policy is disabled, regardless of this policy's configuration. Copilot requires access to page content to provide contextual insights.

M365LinksAutoOpenCopilotEnabled

• Microsoft Edge > Enable the extended lifetime option for SharedWorkers

Controls whether Microsoft Edge keeps a SharedWorker running briefly after all tabs using it are closed, allowing background tasks to finish.

Your options:

• If you enable or don't configure this policy, SharedWorkers can use the extended lifetime option.
• If you disable this policy, the extended lifetime option is ignored, even if it is requested by the page.

This policy is temporary and will be removed in a future release.

SharedWorkerExtendedLifetimeEnabled

• Microsoft Edge > List of URL patterns for which developer tools are allowed to be opened

This policy controls where developer tools can be used in Microsoft Edge by specifying an allowlist of URL patterns. URL patterns are matched against the URL of every frame on the page being inspected.

Your options:

• If you configure this policy and don't configure the List of URL patterns for which developer tools are blocked policy, developer tools are available only when every frame on the page matches a pattern in this allowlist. If any frame doesn't match, developer tools are blocked for the entire page. For information on the URL format, see Filter formats for URL list-based policies.
• If you configure both this policy and the List of URL patterns for which developer tools are blocked policy, this allowlist takes precedence. URLs that match this allowlist are allowed even if they also match the blocklist. URLs that match the blocklist but not this allowlist are blocked. URLs that match neither are governed by the Control where developer tools can be used policy.
• If you disable or don't configure this policy, developer tools availability is determined by the List of URL patterns for which developer tools are blocked and Control where developer tools can be used policies.

This policy applies to developer tools opened for websites, extensions, and web applications. It supports up to 1,000 entries. Example value:

``text contoso.com https://ssl.server.com contoso.com/good_path https://server.contoso.com:8080/path .exact.hostname.com file://* ``

DeveloperToolsAvailabilityAllowlist

• Microsoft Edge > List of URL patterns for which developer tools are blocked

This policy specifies URL patterns where developer tools are blocked. For information on the URL format, see Filter formats for URL list-based policies. URL patterns are evaluated against the URL of every frame on the page being inspected. If any frame matches a pattern in this policy, developer tools are blocked for the entire page.

Your options:

• If you configure this policy and don't configure the List of URL patterns for which developer tools are allowed to be opened policy, developer tools are blocked when any frame matches a pattern in this policy. If no frames match, availability is determined by the Control where developer tools can be used policy.
• If you configure both this policy and the List of URL patterns for which developer tools are allowed to be opened policy, the allowlist takes precedence. URLs that match the allowlist are allowed, even if they also match this policy. URLs that match this policy (but not the allowlist) are blocked. If a URL matches neither, the Control where developer tools can be used policy determines availability.
• If you disable or don't configure this policy, developer tools availability is determined by the List of URL patterns for which developer tools are allowed to be opened and Control where developer tools can be used policies.

This policy supports up to 1,000 entries. Example value:

``text https://contoso.com contoso.com https://ssl.server.com contoso.com/bad_path https://server.contoso.com:8080/path .exact.hostname.com * file://* ``

DeveloperToolsAvailabilityBlocklist

• Microsoft Edge > Maximum number of concurrent connections to the proxy server for WebSocket requests

Specifies the maximum number of simultaneous connections to a proxy server for WebSocket requests. To configure limits for non-WebSocket requests, see the MaxConnectionsPerProxy policy.

If you don't configure this policy, the default value of 32 is used. Some web applications maintain multiple concurrent connections, like long-lived or hanging requests. Setting a value lower than the default may cause networking delays when many such applications are open. Some proxy servers can't handle a high number of concurrent connections per client. In these cases, reducing the value of this policy might improve reliability. The supported range is 6 to 256:

• Values less than 6 are treated as 6.
• Values greater than 256 are treated as 256.

Modify this value only if required by your proxy server configuration or network environment.

MaxConnectionsPerProxyForWebSocket

• Microsoft Edge > Controls the availability of browsing with Copilot in Microsoft Edge

When browsing with Copilot is enabled, users can explicitly invoke it for a query. It isn't invoked automatically. Browsing with Copilot is available only on domains specified in the Browsing with Copilot Allowed URLs policy and is blocked on domains specified in the Browsing with Copilot Blocked URLs policy. If no domains are configured in the allow list, browsing with Copilot is effectively disabled.

This feature is available only to users with an active Microsoft 365 Copilot subscription. For more information about configuring browsing with Copilot, see Configure browsing with Copilot.

Your options:

• If you enable this policy, browsing with Copilot is turned on for all users who receive the policy, and users can't turn it off.
• If you disable this policy, browsing with Copilot is turned off for all users who receive the policy, and users can't turn it on.
• If you don't configure this policy, browsing with Copilot is off by default, and users can turn it on.

AllowBrowsingWithCopilot policy

• Microsoft Edge > Browsing with Copilot Allowed URLs

Allows you to define a list of URLs where browsing with Copilot is available. Users can't modify this list.

Your options:

• If you enable this policy, browsing with Copilot is available only on the sites specified in the list. To allow a broader set of sites while blocking specific exceptions, configure this policy together with the Browsing with Copilot Blocked URLs policy. For example, you can include * to allow all sites, and then use the block list to restrict access to specific URLs. You can define exceptions based on schemes, subdomains, ports, or origins. When multiple filters apply, the most specific match determines whether a URL is allowed or blocked. The block list takes precedence over the allow list.
• If you disable or don't configure this policy, browsing with Copilot is unavailable on all sites, even if the Controls the availability of browsing with Copilot in Microsoft Edge policy is enabled.

Browsing with Copilot supports only HTTP and HTTPS protocols. Wildcards (*) are supported, and subdomains are matched even without wildcards. This policy applies only to the site origin; any path specified in the URL pattern is ignored. For guidance on formatting URL patterns, see Filter formats for URL list-based policies. Example value:

``text https://www.contoso.com [*.]contoso.edu contoso.net login.contoso.us ``

BrowsingWithCopilotAllowList

• Microsoft Edge > Browsing with Copilot Blocked URLs

Controls the list of URLs where browsing with Copilot is blocked. Users can't modify this list. Use this policy to define exceptions to broader allowlists. For example, you can set Browsing with Copilot Allowed URLs to * to allow all sites, and then use this policy to block access to specific URLs. This policy supports blocking by scheme, subdomain, or port. When multiple URL patterns apply, the most specific match determines whether access is allowed or blocked. Blocklist entries take precedence over allowlist entries.

If you don't configure this policy, no exceptions are applied to Browsing with Copilot Allowed URLs. Browsing with Copilot supports only HTTP and HTTPS protocols. Wildcards (*) are supported, and subdomains are matched even without wildcards. URL matching is based on the site origin only; any path specified in the pattern is ignored. For information about URL pattern format, see Filter formats for URL list-based policies. Example value:

``text https://www.contoso.com [*.]contoso.edu contoso.net login.contoso.us ``

BrowsingWithCopilotBlockList

• Microsoft Edge > Enable the Copilot new tab page

This policy configures the availability of the Copilot new tab page in Microsoft Edge for Business. The Copilot new tab page combines search and chat into a single input box and includes personalized cards that provide quick access to relevant files, calendar events, and suggested Copilot prompts. Users who don't have a Microsoft 365 Copilot license might experience limited relevance in Copilot prompt card content.

Most policies that customize the New Tab Page are supported on the Copilot new tab page. For a complete list of supported and unsupported policies, see Configure the Copilot new tab page. This policy applies only to Microsoft Entra ID profiles and controls the Copilot new tab page experience in Microsoft Edge for Business. This policy doesn't apply to the Copilot new tab page on personal Microsoft account profiles.

Your options:

• If you enable this policy, the Copilot new tab page is turned on.
• If you disable or don't configure this policy, the Copilot new tab page is turned off. When the policy isn't configured, users can turn it on via user settings.

CopilotNewTabPageEnabled

• Microsoft Edge > Manageability > Allow MAM enrollment when managed device has Purview DLP policy configured

Controls whether Microsoft Edge allows Mobile Application Management (MAM) enrollment on managed devices when Microsoft Purview Data Loss Prevention (DLP) is configured.

Your options:

• If you enable this policy, MAM enrollment is allowed even when Purview DLP is detected on the device.
• If you disable or don't configure this policy, MAM enrollment is blocked when Purview DLP is detected on the device.

MAMWithDeviceDLPEnabled

To learn more about the settings catalog, see Use the Intune settings catalog to configure settings.

There's a new 802.1x Wired Networks device configuration profile for iOS/iPadOS devices. The feature supports 802.1x Ethernet access controls, which is ideal for M-series iPads that support native resolution screen extension. It allows iPads to securely connect to hot desk docks and monitors using wired access.

This profile:

• Supports EAP protocols, like TLS, PEAP, and TTLS
• Is similar to the macOS wired network profile experience

This feature helps with secure enterprise deployments for iPads in education, finance, and other regulated industries.

To learn more about wired networks, see Add and use wired networks settings on your devices.

The following protected apps are now available for Microsoft Intune:

• Caju AI by Caju AI
• eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS)
• eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS)
• Harvey AI by Harvey AI (Android)
• Notta for Intune by Notta
• SwiftConnect Mobile by SwiftConnect

For more information about protected apps, see Microsoft Intune protected apps.

For devices using Managed Home Screen (MHS), you can now silence apps whenever MHS prompts the user for authentication, such as during sign-in or at the session PIN screen. When silenced, apps can't start activities, display notifications, appear in recent apps, or trigger toasts, dialogs, or device ringing. You can configure an allowlist of apps that remain unsilenced during the locked state, ensuring that critical communications like calls aren't interrupted. This feature is opt-in and configurable, allowing your organization to tailor the experience to its operational needs. Once the device is unlocked, all apps automatically return to their normal state.

For more information, see Configure the Microsoft Managed Home Screen app for Android Enterprise.

Microsoft Tunnel now supports Strict Tunnel Mode on Android Enterprise devices. When Strict Tunnel Mode is enabled, all network traffic is forced through the VPN tunnel. If the VPN connection is unavailable or drops, all network traffic on the device is blocked until the VPN reconnects, preventing apps from accessing the public internet outside of the tunnel.

Strict Tunnel Mode is available when a Microsoft Tunnel VPN profile is configured with Always-on VPN. Admins can configure an app exclusion list to allow specific apps to bypass the tunnel and connect directly to the network, regardless of VPN connection status.

Strict Tunnel Mode requires devices enrolled through Android Management API (AM API). For unenrolled devices using Microsoft Tunnel for Mobile Application Management (MAM), Strict Tunnel Mode is available through the Microsoft Edge app configuration policy.

For more information about Microsoft Tunnel capabilities, see Overview of Microsoft Tunnel.

With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. To manage these settings, use the DDM configurations released in March 2026 instead.

In the settings catalog, the following Restrictions are now deprecated:

• Allow Apple Intelligence Report
• Allow Assistant
• Allow Assistant User Generated Content
• Allow Assistant While Locked
• Allow Auto Correction
• Allow Continuous Path Keyboard
• Allow Definition Lookup
• Allow Dictation
• Allowed External Intelligence Workspace IDs
• Allow External Intelligence Integrations
• Allow External Intelligence Integrations Sign In
• Allow Genmoji
• Allow Image Playground
• Allow Image Wand
• Allow Keyboard Shortcuts
• Allow Mail Smart Replies
• Allow Mail Summary
• Allow Notes Transcription
• Allow Notes Transcription Summary
• Allow Personalized Handwriting Results
• Allow Predictive Keyboard
• Allow Safari Summary
• Allow Spell Check
• Allow Visual Intelligence Summary
• Allow Writing Tools
• Force Assistant Profanity Filter
• Force On Device Only Dictation
• Force On Device Only Translation

In the device restrictions template, the following settings are deprecated.

Built-in apps:

• Block Siri
• Block Siri while device is locked
• Block Siri for dictation
• Block Siri for translation
• Require Siri profanity filters
• Block user-generated content in Siri

Keyboard and dictionary:

• Block word definition lookup
• Block predictive keyboards
• Block auto-correction
• Block spell check
• Block keyboard shortcuts
• Block dictation

This feature is rolling out to tenants gradually and may take several weeks to become available in your environment.

The Vulnerability Remediation Agent is now available to all customers in preview. Previously, the agent was available only to a select group of customers in a limited preview.

The Vulnerability Remediation Agent now uses Microsoft Entra agentic identity instead of a human user identity. When you set up a new agent instance, the setup process automatically provisions an agentic identity in your tenant's Entra directory. The agent runs under the permissions delegated to this agentic user, providing a more secure and scalable identity model.

What this means for existing agents: If you already have a Vulnerability Remediation Agent instance that uses a human user identity, your agent continues to work as-is for now. Human user identity support expires 90 days after this release, after which you must transition to an agentic identity. A banner on the agent page notifies you when agentic identity is available for your agent. For transition steps and details, see Transition existing agents to agentic identity.

What's new for agentic identity:

• New agent instances are provisioned with an agentic identity during setup.
• After setup, you must delegate the required permissions to the agentic user in the Microsoft Entra and Microsoft Defender admin centers.
• Use the Run Readiness Check button to verify that all required permissions are in place before running the agent.

For more information, see Agent identity.

The latest version of Remote Help for Windows (version 5.2.1037.0) includes general bug fixes and performance improvements to enhance reliability.

When Microsoft Intune is enabled as a data source in Security Copilot, by default:

• The Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access to Copilot in Intune.
• All the other built-in and custom Intune role-based access (RBAC) roles automatically inherit Security Copilot contributor access to Copilot in Intune.

Intune admins can use Security Copilot capabilities in Intune without requiring more role assignments.

Previously, access to Copilot in Intune required a separate role assignment in Security Copilot or a Microsoft Entra ID role, like the Intune Administrator role.

This update reduces access friction and simplifies Copilot onboarding for organizations.

To learn more, see:

• Microsoft Copilot in Intune
• Roles and authentication in Microsoft Security Copilot

We updated documentation to clarify how to interpret device-reported values in compliance reports. Some compliance reports include a Setting column with values reported directly by the device, providing additional context for noncompliance in scenarios such as custom compliance and Android app configuration reporting. This update adds guidance on treating these values as informational only and highlights security considerations for reviewing device-reported data. For more information, see Device-reported values in compliance reports.

On macOS devices enrolled with Automated Device Enrollment (ADE), you can run Platform SSO during device registration. Before you enroll, you:

1. Create an Intune settings catalog policy and configure the Enable Registration During Setup setting.
2. Deploy the Company Portal (5.2604.0 and newer) as a line-of-business app.
3. Configure the Automated Device Enrollment policy to use Setup Assistant with modern authentication and enable await final configuration.

When this feature is enabled, users have access to Microsoft Entra ID resources immediately when they arrive at desktop.

To learn more, see Configure Platform Single Sign-On (PSSO) during Automated Device Enrollment for macOS devices.

Intune enhanced app inventory brings faster, more detailed visibility into the apps in your environment to support identification of outdated or risky software. Improved data freshness and richer app metadata provide clearer insight into installed applications, while new controls let you specify which devices are included in inventory collection.

This feature is initially available for Windows, with additional platforms to follow.

You can now use Apple access management settings in Apple Business Manager and Apple School Manager to configure service access for Apple accounts on organization-owned devices. These controls let you choose what devices users can sign in to and which apps and services are available to them. For more information, see Configure service access for Apple accounts.

The Autopatch update risk visibility report extends the security update status dashboard with granular insight into patch compliance and risk across your managed devices. It classifies devices as Current, Exposed, or Critical and highlights policies contributing to risk, so you can identify and remediate issues faster.

For more information, see Protect your estate: Reassess your Windows update policies.

On Android Enterprise devices, you can use the General > Block location in the settings catalog to disable the location services on the device and prevent users from turning it on.

This setting is now called Location and has three options you can configure:

• Device default - Intune doesn't change or update this setting. By default, the OS allows end users to turn location services on or off.
• Location enabled - Requires location services to be on and prevents end users from turning them off.
• Location disabled - Requires location services to be off and prevents end users from turning them on.

For a list of all the settings you can configure, see Android Intune settings catalog settings list.

The Change Review Agent now provides risk-based recommendations directly in the Multi Admin Approval experience for Windows PowerShell scripts. On the My requests and All requests tabs, a new Agent Response column displays when a suggestion is available. You can then select the suggestion to open and complete the Change Review Agent's approval workflow for that request without leaving the Multi Admin Approval node.

Change Review Agent suggestions continue to be available in the agent's primary experience as well.

For more information, see Change Review Agent suggestions in Multi Admin Approval.

You can now control which applications act as system-level credential providers on managed Android Enterprise devices running Android 14 and higher. Credential providers are responsible for password autofill and passkey storage.

To configure credential manager permissions, go to Apps > Android > Configuration > Managed Devices and choose Android Enterprise as the platform type.

By default, Android blocks third-party credential providers on managed devices. This configuration setting lets you:

• Allow specific apps (such as Microsoft Authenticator or a third-party password manager) to act as credential providers
• Enable passkey-based sign-in across managed Android Enterprise devices
• Maintain control over which credential sources are trusted on corporate devices

A known limitation is that Google Password Manager can't act as a credential provider on corporate-owned work profile or personally owned work profile devices. It is blocked on the end user's device. Use a different credential app as a workaround.

For more information, see Add app configuration policies for managed Android Enterprise devices.

You can now manage Android line-of-business (LOB) apps directly in Microsoft Intune without publishing them to Managed Google Play on Android Enterprise corporate-owned fully managed (COBO) and dedicated (COSU) devices.

With direct LOB app management, admins can upload APK files directly to Intune and deploy required apps to supported Android Enterprise enrollment types using a native Intune workflow.

Direct LOB app management enables you to:

• Deploy in-house LOB APKs to fully managed and dedicated devices without publishing them to Managed Google Play
• Manage the app lifecycle directly from Intune
• Create app configuration policies for directly deployed LOB apps, giving you the same configuration flexibility you have for Managed Google Play apps

For more information, see Add an Android line-of-business app to Microsoft Intune.

Intune's Endpoint Privilege Management (EPM) now supports support approved elevation requests from all users of a device. This update expands the utility of support approved file elevations and helps to improve scenarios that involve shared devices.

Previously, file elevation requests that require support approval were supported from only a device's primary user or the user who enrolled the device.

For more information about this type of elevation request, see Support approved file elevations for Endpoint Privilege Management.

Microsoft Intune has added support for userless Apple automated device enrollment (ADE) for visionOS and tvOS devices, enabling you to enroll and manage Apple Vision Pro and Apple TV through Apple Business Manager or Apple School Manager. This capability supports ADE without user affinity and includes custom configuration uploads for settings, default enrollment restrictions, and device actions. The feature is available with Microsoft Intune Plan 2 as part of the Microsoft 365 Suite.

Enrolled visionOS and tvOS devices appear alongside iOS and iPadOS devices in the Intune admin center within Apple mobile and can be filtered. Support requires tvOS 26 and later or visionOS 26 and later. We recommend that you keep these devices up to date to receive the latest security fixes.

For more information, see:

• Overview of Apple ADE for Apple mobile
• Use the Intune settings catalog to configure settings
• Device actions

Intune has two new remote actions that allow admins to temporarily suspend and restore Managed Home Screen (MHS) on Android devices. These actions let users exit MHS and access the device's default launcher for a defined period, without removing policies or requiring a PIN.

When the specified duration expires, or when the restore managed home screen action is triggered, MHS automatically re-locks the device into the kiosk experience. This helps maintain security while reducing disruption during troubleshooting or short-term use outside of MHS.

To learn more, see:

• Suspend Managed Home Screen
• Restore Managed Home Screen

The following protected apps are now available for Microsoft Intune:

• Harvey AI by Harvey AI Corporation (iOS)
• Continia Expense App by Continia Software A/S

For more information about protected apps, see Microsoft Intune protected apps.

In the Intune admin center, when you go to Devices > All Devices and select a device, you can see device-specific info, like device properties.

This page is redesigned and is available for you to preview. To enable the new experience:

1. In the [Microsoft Intune admin center], go to Devices > All Devices.
2. Move the Preview new device view toggle to On.

The new experience is only available when you go to Devices > All Devices and select a device. If you open a device page from a different part of the Intune admin center, like from a report, the original page view is shown, even with the toggle enabled.

When turned on, you see the new full page layout that gives you a single view of the device. Use this view to:

• Track device activity
• Access tools and reports
• Manage device information

The single device page has the following tabs:

• Device action status: Shows requested, in‑progress, and recently completed device actions. You can search, sort, and filter this list. You can quickly see what actions are running or have completed without leaving the device view.
• Tools and reports: This tab was previously called Overview. It shows monitoring reports, like compliance and device configuration status, tools, like remediations. These features were previously accessed in other parts of the Intune admin center.
• Properties: Contains admin‑modifiable device properties with visible scope tags and a dedicated editing view.
• Device details: This tab was previously called Hardware. It provides physical device information and key Intune and Microsoft Entra management details.

Other features:

• Device actions are grouped, ordered, and labeled consistently across platforms and device types, and only shows relevant and permitted actions. Destructive actions are separated and require confirmation, reducing unintentional actions.

• The updated layout uses a standard structure across device types and platforms, while adapting to platform‑specific capabilities.

• Improved labeling, hierarchy, and formatting make device information easier to scan and understand. The Essentials section elevates important device information and is accessible from any tab.

All existing device management capabilities remain available. This update focuses on making them easier to find and use.

Microsoft Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Devices already enrolled on Ubuntu 22.04 remain enrolled, but you should notify users to upgrade to a supported Ubuntu version. You can identify devices running Ubuntu 22.04 in the Intune admin center by going to Devices > All devices, filtering by Linux, and adding the OS version column. For more information, see Enroll Linux desktop devices in Microsoft Intune.

Windows devices managed by Intune need to run Intune Management Extension version 1.58.103.0 or later. Devices on earlier versions no longer receive configurations or updates that depend on the Intune Management Extension, including Win32 app deployments, PowerShell scripts, remediations, and platform scripts.

The Intune Management Extension updates automatically, so most managed devices should already have a compatible version. Verify that your devices can sync with Intune to receive updates.

Microsoft Edge version 139 security baseline is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for the Microsoft Edge browser and is the latest available Edge security baseline in Intune.

The Edge v139 security baseline includes new settings, updated default values, and retired settings.

Existing security baseline profiles don't automatically update to the new version. To use this baseline, Intune admins can create a new baseline profile or update an existing profile to the latest version.

We recommend carefully reviewing the settings in the new baseline before moving from a previous baseline version, especially if existing profiles include customizations.

For a detailed breakdown of setting changes, see the blog post Security baseline for Microsoft Edge version 139.

To view the default configuration of settings in the updated baseline, see Microsoft Edge security baseline settings reference.

The Intune Data Warehouse (beta) connector v1 in Power BI is retired. If you use Power BI reports that rely on this connector, you need to transition to Intune connector v2 or the OData Feed connector before the transition completes. Power BI reports created after November 2025 already use connector v2, while reports created before that date may still use the beta connector and need updating. This change improves the long-term reliability and supportability of Intune data access.

Customer impact: This change does not introduce new user interface experiences. Customers who still rely on the Intune Data Warehouse (beta) connector in Power BI may be affected if they have not transitioned to supported alternatives. Customers already using supported and documented data access options do not experience disruption.

Required customer action: Review the published guidance and transition away from the Intune Data Warehouse (beta) connector in Power BI before the transition completes. Customers who do not take action lose access to data through the beta connector after it is retired.

Timing and rollout: Customer communications begin in late April 2026. The transition occurs gradually over two weeks starting April 20, 2026.

For more information, see Use the Microsoft Intune Data Warehouse.

New guidance has been added to the Microsoft Intune compliance policy reporting documentation to help explain how device compliance results appear in Intune reports. This update clarifies expected reporting behavior related to device check-in timing and user association, helping you better interpret compliance policy reports. For more information, see Known reporting behaviors.

There is a new TeamViewer integration in Microsoft Intune that simplifies onboarding and improves reliability for remote assistance workflows. The new connector replaces the existing TeamViewer connector experience and provides a more streamlined experience in the Intune admin center. If you're using the previous TeamViewer connector, you must migrate to the new connector within 12 months to maintain functionality. For more information about the new connector, see Use the TeamViewer integration in Microsoft Intune.

Microsoft Intune now supports management of Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. You can enroll Android XR devices, deploy apps through managed Google Play, and apply core security and compliance policies. Android XR devices appear and are managed alongside other Android devices in the Intune admin center. For more information about supported scenarios and current limitations, see Microsoft Intune announces Android Enterprise management support for Android XR.

Microsoft Intune now supports Apple Declarative Device Management (DDM) for required line-of-business apps on devices running iOS/iPadOS 18 and later. By changing the management type to DDM in App information, you can deploy and configure apps using Apple's policy-based model, which improves delivery efficiency, provides real-time app status, and expands per-app options such as associated domains.

Starting with the May 2026 Windows security update, hotpatch updates are enabled by default for all eligible devices managed through Windows Autopatch. Hotpatch updates install faster and require fewer restarts, helping devices get secure sooner.

If your organization isn't ready for this change, you can opt out using either of the following options:

• Tenant-level setting: Opt out of hotpatch updates across all eligible devices in your tenant. This option becomes available April 1, 2026 in the Intune admin center.
• Quality update policy: Control hotpatch behavior for a specific group of devices. Hotpatch settings configured in a quality update policy override the tenant-level setting for devices assigned to that policy.

Key dates:

• April 1, 2026: Tenant-level opt-out setting available in the Intune admin center.
• May 2026 security update: Hotpatch updates enabled by default.

For more information, see the Windows IT Pro Blog (https://aka.ms/HotpatchByDefault).

Device query for multiple devices now includes new capabilities to help you work with query results more efficiently.

You can use a search text box to search across all resulting rows of a query, use column headers to add filters for specific values, and create Microsoft Entra security groups directly from a query's device results.

For more information, see Device query for multiple devices.

The Windows security baseline for Windows 11, version 25H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for supported Windows devices and is the latest available Windows security baseline in Intune.

The Windows 11, version 25H2 security baseline includes new settings, updated default values, retired settings, and revised security guidance. Existing security baseline profiles don't automatically update to the new version.

To use the Windows 11, version 25H2 security baseline, Intune admins can create a new baseline profile or update an existing profile to the latest version.

The following two settings aren't included in this baseline release and will be added in a future baseline update. Each change will be communicated to customers when available:

• Disable Internet Explorer 11 launch via COM automation - This setting isn't included at release due to a known issue. The Windows client team is addressing the issue, and the setting will be added in a future baseline update.
• Configure NetBIOS settings - This setting is pending availability in the Settings Catalog and will be added to the baseline in a future update.

We recommend carefully reviewing the settings in the new baseline before moving from a previous baseline version, especially if existing profiles include customizations.

For a detailed breakdown of setting changes, see the Windows blog post Windows 11, version 25H2 security baseline.

To view the default configuration of the Intune baseline for Windows 11, version 25H2, see Windows MDM baseline settings.

The Microsoft Intune app for Linux now uses the Microsoft Identity Broker on supported Ubuntu and Red Hat Enterprise Linux (RHEL) distributions. Broker version 2.0.2 and later introduces a major architectural change from the previous Java-based broker. This update enables new single sign-on (SSO) experiences using phish-resistant MFA, smart card authentication, and certificate-based authentication with Microsoft Entra ID. For more information, see Enabling Phish-Resistant MFA (PRMFA) on Linux devices.

There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog).

The new policies include:

• Connectivity > Disable Cross Device Resume: This feature lets Windows suggest continuing an activity users start on a device, like a phone, to a PC. IT admins can use this policy to turn off this feature and prevent users from continuing tasks, like browsing files or continuing to use supported apps that require linking between a phone and PC.

When set to CrossDeviceResume is Disabled, the Windows device doesn't receive any CrossDeviceResume notification. Users won't see any "resume from your phone" prompts. When you select CrossDeviceResume is Enabled, the Windows device does receive notification to resume activity from linked devices. If you don't configure this policy setting, the default behavior is that the CrossDeviceResume feature is turned on, which means users see the notification. Changes to this policy take effect on reboot.

This policy:

• Is available to Windows Insiders.
• Uses the DisableCrossDeviceResume CSP.

• Windows AI > Remove Microsoft Copilot App: This policy setting allows you to uninstall the Microsoft Copilot app from devices. It applies to devices and users that meet the following conditions:

• The Microsoft 365 Copilot and Microsoft Copilot apps are both installed.
• The Microsoft Copilot app was not installed by the user.
• The Microsoft Copilot app was not opened in the last 14 days.

If this policy is enabled, the Microsoft Copilot app is uninstalled. Users can still re-install if they choose to.

RemoveMicrosoftCopilotApp CSP

To learn more about the settings catalog, see Use the Intune settings catalog to configure settings.

The following OEMConfig app is available in Intune for Android Enterprise:

• Inventus | com.inventus.oemconfig.gen

For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.

There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center], go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.

iOS/iPadOS

Declarative Device Management (DDM) > External Intelligence Settings:

• Allow Sign In
• Allowed Workspace IDs

Declarative Device Management (DDM) > Intelligence Settings:

• Allow Apple Intelligence Report
• Allow Genmoji
• Allow Image Playground
• Allow Image Wand
• Allow Personalized Handwriting Results
• Allow Visual Intelligence Summary
• Allow Writing Tools
• Mail > Allow Smart Replies
• Mail > Allow Summary
• Notes > Allow Transcription
• Notes > Allow Transcription Summary
• Safari > Allow Summary
• Force On Device Only Dictation
• Force On Device Only Translation

Declarative Device Management (DDM) > Keyboard Settings:

• Allow Definition Lookup
• Allow Auto Correction
• Allow Dictation
• Allow Predictive Text
• Allow Slide To Type
• Allow Spell Check
• Allow Text Replacement
• Allow Math Keyboard Suggestions

Declarative Device Management (DDM) > Siri Settings:

• Allow User Generated Content
• Allow While Locked
• Force Profanity Filter

macOS

Declarative Device Management (DDM) > External Intelligence Settings:

• Allow Sign In
• Allowed Workspace IDs

Declarative Device Management (DDM) > Intelligence Settings:

• Allow Apple Intelligence Report
• Allow Genmoji
• Allow Image Playground
• Allow Writing Tools
• Mail > Allow Smart Replies
• Mail > Allow Summary
• Notes > Allow Transcription
• Notes > Allow Transcription Summary
• Safari > Allow Summary
• Force On Device Only Dictation

Declarative Device Management (DDM) > Keyboard Settings:

• Allow Definition Lookup
• Allow Dictation
• Allow Math Keyboard Suggestions

Declarative Device Management (DDM) > Siri Settings:

• Force Profanity Filter

System Configuration > File Provider:

• Management Allows Remote Syncing
• Management Remote Syncing Allow List
• Management Allows External Volume Syncing
• Management External Volume Syncing Allow List
• Management Domain Auto Enablement List

Restrictions:

• Allow Rosetta Usage Awareness

The following protected apps are now available for Microsoft Intune:

• PerfectServe Clinical Collab by PerfectServe
• Synigo Pulse by Synigo B.V.
• DeepL for Intune by DeepL SE
• Foxit PDF Editor by Foxit Software Inc.
• EasyPlant QC Inspections by Technip Energies (Android)

For more information about protected apps, see Microsoft Intune protected apps.

On macOS devices, you can configure a recovery OS password that prevents users from booting company-owned devices into recovery mode, reinstalling macOS, and bypassing remote management. Admins can also rotate this password.

There are two ways to use this feature:

• Settings catalog policy - In a settings catalog policy, you can use the Recovery Lock settings to:

• Turn on the recovery lock feature
• Configure a password rotation schedule

• Remote device action - Use the Recovery Lock device action to manually rotate the recovery lock password for a specific device.

The Recovery Lock password can be viewed in the per-setting status report > Passwords and keys. To view the Recovery Lock password, the signed-in administrator needs the Remote tasks/View macOS recovery lock password permission.

We've improved connectivity when using the Launch Remote Help capability in the Intune admin center for Windows devices. For the best experience, we recommend updating firewall rules to include this new endpoint:

• *.trouter.communications.svc.cloud.microsoft

For the current list of required network endpoints, see Network requirements for PowerShell scripts and Win32 apps and Remote Help in the Intune endpoints documentation.

With this endpoint addition, we've also added a new Intune Management Extension log, NotificationInfra.log, which tracks notifications sent through the Microsoft real-time communication channel.

Intune now includes an opt-in preview to enable Scoped permissions, making your role-based access control (RBAC) configuration more precise. Enabling Scoped permissions is a one-time choice that can't be undone. In the future, this will become the default behavior for all tenants.

Previously, when an admin had multiple role assignments using different scope tags for the same permission category, Intune merged permissions across those assignments, which could unintentionally grant broader access than intended. With Scoped permissions enabled, each role assignment's permissions apply only within its own scope tag context, so admins receive exactly the access you intended.

To help you prepare before enabling this change, Intune includes a new Permissions Assessment Report. The report details your tenant's current permissions and shows how they will change after enabling Scoped permissions. You can rerun the report as often as needed, adjust role assignments, and communicate any changes to affected admins before opting in.

For more information about the current default behavior, the Scoped permissions opt-in preview, and the new report, see Permission behavior across role assignments.

All authenticated users can now access Support Assistant in the Intune admin center to find solutions and troubleshooting guidance. Creating and managing support tickets still requires a Microsoft Entra role that includes the microsoft.office365.supportTickets permission. For more information, see How to get support in the Microsoft Intune admin center.

Microsoft Intune supports Red Hat Enterprise Linux (RHEL) 9 LTS and RHEL 10 LTS. Support for RHEL 8 LTS will end in July 2026. Devices already enrolled on RHEL 8 will remain enrolled. You can identify devices running RHEL 8 in the Intune admin center by going to Devices > All devices, filtering OS by Linux, and adding OS version columns. Notify users to upgrade their devices to a supported RHEL version. For more information about enrolling Linux devices, see Enrollment guide: Enroll Linux desktop devices in Microsoft Intune.

Devices configured with system-level (WinHTTP) proxy settings can now send telemetry to endpoint analytics and Advanced Analytics, enabling more comprehensive reporting. Endpoint Privilege Management (EPM) will also include elevation usage data from these devices.

No admin action is required. If endpoint analytics or EPM is enabled for a device, telemetry and events will automatically appear in the User Experience (Device blade), endpoint Analytics reports, and EPM.

For more details about displaying advanced proxy settings, see Netsh.exe commands.

All guided scenarios except Windows 365 Boot are removed from the Microsoft Intune admin center. You can no longer access the guided scenario wizards, but any Intune objects previously created by these wizards remain available and manageable. The Windows 365 Boot guided scenario remains available from the Windows 365 overview page in the Intune admin center. No action is required.

For alternative step-by-step guidance, see the following resources:

• Microsoft Intune documentation
• Intune prescriptive guides
• Intune administration guides: https://m365accelerator.microsoft.com/intune
• Securing apps for mobile | Android
• Securing apps for mobile | iOS
• Configuring Intune and Configuration Manager to co-manage devices
• Manage and secure devices for Windows
• Microsoft Copilot in Intune

We've improved the update and reporting experience for Remote Help on macOS to make version management more reliable and transparent for IT admins.

After you deploy the latest Remote Help client (version 1.0.26012221) through Microsoft Intune, you can now view the full client version in your device inventory and during app upgrades. This improvement makes it easier to verify deployments. Remote Help installations deployed through Intune are also registered with Microsoft AutoUpdate (MAU), allowing Intune-managed macOS devices to automatically receive future Remote Help updates. For more information, see Deploy Remote Help with Microsoft Intune.

You can use assignment filters in policy assignments for DDM-based configurations, like software updates.

This feature is rolling out slowly and should be available for all customers by late March 2026.

To learn more about filters, see Use assignment filters to assign your apps, policies, and profiles in Microsoft Intune.

Autopatch update readiness provides a unified experience for tracking and remediating Windows update issues across Intune-enrolled devices and Windows Autopatch group-enrolled devices. With a single dashboard, admins can view all managed devices, including enrollment status and policy assignments, to better understand update readiness across their environment.

Key capabilities include:

• Device update journey: View granular update states for each device to quickly identify where updates are blocked and why.
• Centralized alerting: See actionable alerts for update failures, policy conflicts, and readiness gaps in one place, with integrated remediation guidance.
• Update readiness checker: Proactively evaluate devices for deployment risks and flag devices as At Risk based on signals such as disk space, appraiser data, and setup conditions.
• Repair devices with OS reinstall: Remediate upgrade‑blocked devices by triggering an OS reinstall for common issues like insufficient disk space or app compatibility problems, with supporting alerts and reporting.

For more information, see Autopatch update readiness.

With the release of iOS 26, iPadOS 26, and macOS 26, Apple has deprecated legacy mobile device management (MDM) software update commands and payloads. As a result, Microsoft Intune will soon end support for creating legacy iOS/iPadOS and macOS software update policies. To continue managing Apple software updates in Intune, configure update policies using Apple's declarative device management (DDM) model. DDM provides a more modern and reliable approach to managing software updates, with improved device autonomy and reporting.

For guidance on moving to DDM‑based software updates, see the Intune Customer Success blog: Move to declarative device management for Apple software updates.

Multi-administrator approval now supports device configuration policies created through the settings catalog and device compliance policies. When you turn on this feature, any changes you make, including creating, editing, or deleting a policy, must be approved by a second administrator before they take effect. This dual-authorization process helps protect your organization from unauthorized or accidental changes to role-based access control.

For more information, see Use Access policies to require Multi Admin Approval.

A new setting that affects the Microsoft Entra account registration experience on Windows is available in the Microsoft Intune admin center. The setting, Disable MDM enrollment when adding work or school account on Windows, controls whether devices enroll in MDM during the account registration flow. The default setting is set to No, which allows MDM enrollment. No action is required unless you want to change the default enrollment behavior. This Microsoft Entra setting is in preview. For more information, see Enable MDM automatic enrollment for Windows.

There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile (Devices > Configuration profiles > Create profile > Windows 10 and later > Settings catalog).

The new policies include:

Microsoft Edge:

• Control whether an informational webpage for Edge for Business is shown in the new tab after major browser updates: When Enabled or not configured, users with Microsoft Entra ID profiles see an informational page about new Edge for Business features after major browser updates. When Disabled, the informational page isn't shown to users.

This policy:

• Applies only to Microsoft Entra ID profiles. It doesn't apply to Microsoft account (MSA) profiles.
• Is available starting in Microsoft Edge version 144, which allows you to configure the setting before any version 145 changes.

• Enable Silent Printing: When Enabled, Microsoft Edge automatically closes the print preview window and prints to the default printer using its default settings. If the default printer is Save as PDF, the file is saved to the user's Downloads folder. When Disabled or not configured, silent printing is disabled. The print preview window stays open, and the user must choose the print settings as usual.

Microsoft Edge > Content settings:

• Allow precise geolocation on these sites: When Enabled, enter a list of URL patterns for sites that are allowed to access the user's high-accuracy geolocation without prompting for permission. When Disabled or not configured, the default geolocation setting applies to all sites (if configured) or the user's personal setting is used.

For information about valid URL patterns and examples, see Filter formats for URL list-based policies. Wildcards (*) are supported.

• Block geolocation on these sites: When Enabled, enter a list of URL patterns for sites that are blocked from requesting or accessing the user's geolocation. These sites can't prompt the user for location permissions. When Disabled or not configured, the default geolocation setting applies to all sites (if configured) or the user's personal browser setting is used.

For information about valid URL patterns and examples, see Filter formats for URL list-based policies. Wildcards (*) are supported.

Windows Backup and Restore:

• Enable Windows Restore: Choose to enable Windows Restore. When enabled, the restore process for a device can be initiated:

• At the time of device enrollment during the out-of-box experience (OOBE), or
• The first time a user signs in with their Microsoft Entra ID account after the device finishes enrolling.

It allows a user to restore their backed‑up Windows settings and Microsoft Store apps from the cloud to a new or reset device. It restores the user experience settings and configuration preferences. It's not a full system image. To learn more, see Windows Backup for Organizations overview.

Your options:

• Windows Restore Not Configured
• Windows Restore Enabled

This policy:

• Was previously for Windows Insiders and is now generally available (GA).
• Uses the WindowsBackupAndRestore CSP.

To learn more about the settings catalog, see Use the Intune settings catalog to configure settings.

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.

There are new settings in the Settings Catalog. To see these settings, in the [Microsoft Intune admin center], go to Devices > Manage devices > Configuration > Create > New policy > iOS/iPadOS or macOS for platform > Settings catalog for profile type.

iOS/iPadOS

AirPlay:

• Device Name

macOS

AirPlay:

• Device Name

Microsoft Defender:

• The Microsoft Defender category is updated with new settings. Learn more about available macOS Defender settings at Microsoft Defender - Policies.

The following protected apps are now available for Microsoft Intune:

• Jump by Accio Inc.
• Mijn InPlanning by Intus Workforce Solutions (Android)

For more information about protected apps, see Microsoft Intune protected apps.

Device query for multiple devices now includes expanded operator support, clearer query validation, and improved results to make building and interpreting queries easier.

• New join types supported\ You can now use the following join types when querying across entities:
• leftsemi
• rightsemi
• leftanti
• rightanti
• Updated join behavior\ Joins that use on Device.DeviceId are no longer supported. Queries should instead:
• Use on Device, or
• Omit the on clause entirely when joining on the device entity.
• Updated device references in operators\ Using Device by itself is no longer supported in operators such as distinct, summarize, or order by. Queries must reference a specific device property.
• Improved query results\ Queries that involve a device—either by querying a device directly or by joining a device with another entity—now return the device as a clickable link in the results, allowing you to quickly navigate to device details.
• Clearer error messages\ Some query error messages have been updated to provide clearer, more descriptive guidance when queries are invalid.

For previous months, see the What's new archive.