Thursday, 27 August 2026

Intune now documents the Windows 365 for Agents security baseline version 24H1, including default settings for Cloud PCs running agentic workloads across Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint.

The security baselines overview now links to the Windows 365 for Agents security baseline, including its Version 24H1 settings reference.

The Configure baselines documentation now links to the Windows 365 for Agents security baseline settings reference.

The VPP token settings now include a Management type option: MDM (default) or DDM. DDM applies to app deployment and configuration on iOS/iPadOS 18 and later, and supports only Required or Uninstall assignments.

The reference now includes Ben for Intune, Calven, Heijmans, Notability, Notion, SDP - On Premises | Intune, and Superhuman Mail, with descriptions and app links.

A new article explains how to trigger and cancel remote enhanced log collection on supervised macOS 27+, iOS 27+, and iPadOS 27+ devices. Logs are sent directly to Apple for support analysis.

The documentation now lists Chrome, Edge, and Samsung browser as supported for web-based enrollment. The note about phone-call MFA potentially breaking enrollment and its workaround was removed.

The Intune client and host service endpoint entry now includes 150.171.109.0/24 and 150.171.110.0/24.

The page now states that the listed eSIM features are rolling out and might not yet be available to all tenants. The page date and authoring metadata were also updated.

The documentation describes TPM-backed association that writes tenant affinity to UEFI before enrollment, enabling device-targeted policies, device naming, OOBE customization, corporate marking, and stronger onboarding security.

The new article explains how to remove pre-associated devices from Intune and how to clear Device Link UEFI variables before deleting associated devices from Intune.

The page specifies Windows 11, physical-device, TPM 2.0, networking, licensing, and Intune RBAC requirements, including custom-role setup steps.

A new Step 7 guide explains associating devices for user-driven Microsoft Entra join, including exporting device information, importing it into Intune, and reviewing associations. Association is an optional alternative to corporate identifiers.

The new article documents device resets, local association removal, CSV updates, Autopilot registration, stale records, and decommissioning. It notes that associations persist through resets and that stale records are automatically deleted after 360 days.

Step 7 now includes device association as an alternative to corporate identifiers. The documentation explains associated-device OOBE settings, deployment precedence, and device- versus user-based policy assignment.

A new FAQ explains DeviceLink CSV timestamp changes, exporting device information after OOBE, corporate identifier requirements, OEM and partner support, and virtual machine limitations.

The tutorial now documents support for up to 25 essential applications, up from 10, and adds device association as an alternative to corporate identifiers. Associated devices can use settings such as OOBE customization and device naming.

Step 7 now identifies corporate identifiers as one option and links to optional device association as another. Associated devices are automatically treated as corporate-owned, and enrollment links were updated.

Windows Autopilot device preparation now supports associating physical Windows 11 devices with an organization before enrollment. Associated devices are automatically marked corporate-owned and can receive device-targeted policies and naming.

The tutorial now lists device association as an alternative to adding a Windows corporate identifier and clarifies the steps for deploying apps and PowerShell scripts.

The documentation explains that association state determines whether the Windows Autopilot profile or device association takes precedence. Associated physical Windows 11 devices are marked corporate-owned and can receive device-targeted policies and additional OOBE customizations.

The comparison now documents that device preparation devices can be associated with a tenant before enrollment, while Windows Autopilot devices can be registered. It also updates the explanation of deployment selection for Autopilot-registered devices.

Step 7 now offers two options: add a Windows corporate identifier or associate devices. The document date was also updated.

Step 7 now offers two paths: add a Windows corporate identifier or associate devices. The page’s update date was also refreshed.

Step 7 now presents two options: adding a Windows corporate identifier or associating devices. The documentation date was also updated.

Step 7 now documents two options: adding a Windows corporate identifier or using Associate devices. The page date was also updated.

The documentation date and “Date added” value changed from August 20, 2026, to August 27, 2026.

The new page documents security fixes for the SMS Provider and administration service, applicable to Configuration Manager versions 2603, 2509, and 2503 with required rollups. Installation requires a site reset and manual updating of existing secondary sites.

The documentation now states that KB 37447175 is superseded by KB 38982839 for version 2503, while remaining applicable to version 2409.