In Development

@@ -10,7 +10,7 @@ manager: laurawi author: lenewsad ms.author: lanewsad description: This article describes Microsoft Intune features that are in development.-ms.date: 2026-09-30T00:00:00.0000000Z+ms.date: 2026-10-29T00:00:00.0000000Z ms.topic: whats-new ai-usage: ai-assisted ms.reviewer: intuner@@ -113,40 +113,6 @@ Applies to: 
 - Android Enterprise
 
-### Apple OS 27 DDM status data in device inventory
-
-Microsoft Intune will add Apple OS 27 declarative device management (DDM) status data to device inventory. You'll be able to review system health information for supported hardware components, content cache details, and MDM state such as enrollment type, awaiting configuration, Return to Service, Shared iPad, and Lockdown Mode. Reported values will depend on the device's supported operating system, hardware, enrollment type, and available DDM capabilities.
-
-Applies to:
-
-- Apple devices running OS 27
-
-### Add support for the MEFERI OEMConfig app on Android Enterprise
-
-Intune will add support for the MEFERI OEMConfig app (`com.meferi.oemconfig`) for Android Enterprise devices. Once onboarded, admins will be able to use Intune's OEMConfig workflow to deploy and manage the device settings that MEFERI exposes through its OEM-provided schema. This update will expand the catalog of supported OEMConfig apps and reduce the need for custom management workarounds when organizations use MEFERI hardware. Admins will continue using the same OEMConfig pattern in Intune by adding the app from Managed Google Play, assigning it to devices, and creating OEMConfig profiles against the supported bundle.
-
-Applies to:
-
-- Android Enterprise
-
-### Enforce Routes capability in iOS/iPadOS and macOS VPN profiles
-
-Microsoft Intune will support Apple's **[Enforce Routes](https://developer.apple.com/documentation/networkextension/nevpnprotocol/enforceroutes)** feature in iOS/iPadOS and macOS VPN profiles.
-
-This feature helps prevent situations where VPN traffic accidentally or maliciously goes outside the VPN tunnel, like what happens with de-cloaking risks. It ensures VPN routing aligns with Apple's platform semantics.
-
-When you configure this feature in Intune, routing behavior is defined using **Include all networks** and **Exclude local networks** settings. Intune automatically derives the appropriate **Enforce Routes** configuration based on these selections to ensure consistent and predictable device behavior.
-
-To learn more about VPN profiles in Intune, see:
-
-- [Create VPN profiles to connect to VPN servers in Intune](../device-configuration/templates/configure-vpn)
-- [Add VPN settings to Apple devices in Microsoft Intune](../device-configuration/templates/ref-vpn-settings-apple)
-
-Applies to:
-
-- iOS/iPadOS
-- macOS
-
 ### Disable MAC address randomization on macOS Wi-Fi profiles
 
 On macOS devices, the **Disable MAC address randomization** setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices.
@@ -174,29 +140,6 @@ Applies to: 
 ## Device management
 
-### Remove legacy Apple MDM software update workloads from Intune
-
-Intune will remove legacy Apple MDM software update workloads after Apple retires the underlying MDM update commands and payloads. This change will help keep the Intune admin experience, Graph surface, and documentation aligned to what Apple still supports, instead of leaving behind settings that no longer have a valid backend. Organizations that still depend on the older workflows will need to finish moving remaining Apple software update scenarios to declarative device management (DDM). By cleaning up the outdated path, Intune will reduce confusion and make the supported Apple update model clearer for administrators planning future update deployments.
-
-Applies to:
-
-- Apple software updates in Microsoft Intune
-
-### New settings for Administrator protection in endpoint security Account Protection policy
-
-We’re adding two settings to Intune's Endpoint security [Account Protection profile](../device-configuration/endpoint-security/account-protection#account-protection-profiles). These settings enhance device security by requiring user authentication for administrator level actions. This authentication request helps to safeguard devices from unauthorized changes and malware.
-
-The two new settings are already available in the Intune [settings catalog](/en-us/intune/intune-service/configuration/settings-catalog). Selecting the setting name link opens its entry in the LocalPoliciesSecurityOptions CSP documentation:
-
-- [**User Account Control Type Of Admin Approval Mode**](/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#useraccountcontrol_typeofadminapprovalmode)
-- [**User Account Control Behavior Of The Elevation Prompt For Administrator Protection**](/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#useraccountcontrol_behavioroftheelevationpromptforadministratorprotection)
-
-To learn more about the Administrator protection scenario, see [Administrator protection on Windows 11](https://techcommunity.microsoft.com/blog/windows-itpro-blog/administrator-protection-on-windows-11/4303482) on the Windows IT Pro Blog.
-
-Applies to:
-
-- Windows 11 (24H2 and 25H2)
-
 ### Updated minimum supported version for macOS
 
 Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will remain enrolled, but new devices on those versions won't be able to enroll. You'll be able to use Intune reporting to identify affected devices and plan upgrades. Devices enrolled without user affinity have a separate support statement.
@@ -221,6 +164,23 @@ For existing agents, admins will be able to transition to an agentic identity fr 
 ## Device security
 
+### New endpoint security template for Microsoft Defender for Endpoint safe deployment settings
+
+We're working on a new endpoint security template in Intune dedicated to Microsoft Defender for Endpoint (MDE) safe deployment settings. This will give you a focused, purpose-built policy for managing how MDE updates roll out across your Windows devices.
+
+Microsoft Defender for Endpoint follows a safe deployment practices approach to release updates. You can mirror this in your own environment by assigning devices to update channels that control when MDE platform updates, engine updates, and security intelligence updates are applied. Devices in earlier channels receive updates sooner, giving you an opportunity to validate behavior before changes reach your broader production fleet.
+
+With this new template, you'll be able to configure safe deployment settings as a standalone policy for Windows devices managed through Intune or through MDE security settings management.
+
+For more information, see:
+
+- [Use safe deployment practices to safeguard and manage your environment](/en-us/defender-endpoint/mde-sdp-strategy)
+- [Manage endpoint security policies in Microsoft Intune](../device-security/microsoft-defender/security-settings-management)
+
+Applies to:
+
+- Windows
+
 ### Controlled Configuration for Microsoft Defender Antivirus on Windows
 
 Intune will support Controlled Configuration for Microsoft Defender Antivirus settings on Windows. When you enable it, antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management will take precedence over conflicting settings from Group Policy, Configuration Manager, and local changes or scripts. You'll be able to protect administrator-defined antivirus settings from being overridden, rather than protecting only secure default values. This will help reduce configuration drift, maintain consistent device states, and simplify troubleshooting by making the cloud-delivered configuration authoritative.
@@ -299,26 +259,6 @@ Applies to: - macOS
 - Windows
 
-### Certificate connector health monitoring in the Microsoft Intune admin center
-
-The Certificate Connector for Microsoft Intune will surface new health and status signals in the admin center, so you can spot certificate-issuance problems early. You'll get clear indicators for common failure conditions — such as the connector being unable to reach the certification authority (CA), the connector's service account lacking permission to issue or revoke certificates, or certificate requests being rejected because of a template mismatch with your SCEP or PKCS profile. Each signal includes guidance to help you investigate and remediate before devices relying on certificate-based authentication hit access, sign-in, or compliance issues.
-
-Applies to:
-
-- Certificate Connector for Microsoft Intune
-
-## Role-based access control
-
-### Scoped permissions for role-based access control moving to general availability
-
-The **Scoped permissions** setting for role-based access control (RBAC) will move from public preview to general availability. Scoped permissions prevents Intune from merging permissions across multiple role assignments that share the same permission category but use different scope tags. When enabled, each role assignment's permissions apply only within its own scope tag context, giving admins exactly the access you intended.
-
-When this feature reaches general availability, Scoped permissions will become the default behavior for all tenants.
-
-If you haven't enabled Scoped permissions yet, use the **Permissions Assessment Report** at **Tenant administration** > **Roles** > **Settings** to preview how permissions will change before opting in.
-
-For more information, see [Permission behavior across role assignments](../fundamentals/role-based-access-control/scope-tags#permission-behavior-across-role-assignments).
-
 ## Tenant administration
 
 ### JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS