Thursday, 15 January 2026

Day in brief

Edge for Business and Windows Update guidance add clearer policy guardrails

The period was led by Intune documentation covering Edge for Business policy selection, Windows driver-update controls, and feature-update rollout timing. The supplied evidence does not identify a preview, general-availability announcement, service retirement, or tenant-wide behavior change; the removed Edge security-baseline page appears to reflect a walkthrough reorganization rather than feature retirement.

Intune · Device updates
Windows driver update policies get a new approval and deployment playbook
New Intune how-to documentation—not a stated feature launch—covers viewing available driver updates, approving or pausing individual updates, and sending assignments to Windows Update. It adds two concrete checks: set the Windows update ring policy's Windows driver setting to Allow, and set Settings catalog > Windows Update client policies > Exclude WU Drivers in Quality Update to Allow Windows Update drivers. The guidance also says each device should be targeted by only one driver-update policy.
Intune · Device updates
Feature update policies are documented as durable version targeting
New Intune guidance says a feature-update policy remains in effect until modified or removed, unlike pausing feature updates in update rings, which expires after 35 days. It also states that policies don't downgrade devices already running a newer Windows version, and that the latest applicable monthly quality update is included when a feature update installs. A safeguard hold can still prevent installation.
Intune · Device updates
Feature-update rollout guidance now names gradual offer availability
Updated Intune guidance defines three availability behaviors for feature-update policies: make the update available as soon as possible, make it available on a specified date, or make it available gradually using offer groups. The page clarifies that availability makes devices eligible at their next Windows Update scan; actual installation remains affected by user behavior, deadlines, and restart controls.
Intune · App management
Edge for Business guidance separates enrolled and non-enrolled policy paths
The updated Intune walkthrough directs non-enrolled devices to App Configuration Policies through the Managed Apps channel. For enrolled Windows devices, it says to choose either Settings Catalog policies or the Microsoft Edge Security Baseline—not both—and never to deploy App Configuration Policies and Settings Catalog policies to the same client. The former Step 6 security-baseline link is replaced by end-user experience guidance, with troubleshooting moved to Step 7; this is documentation reorganization, notev
Intune · Device security
Mobile Threat Defense inventory sharing is clarified as opt-in
Updated Intune security guidance says App Sync and Certificate Sync for iOS/iPadOS are opt-in, with no information shared by default. When enabled, app and certificate inventories from both corporate- and personally-owned enrolled devices are sent to MTD providers during device check-in intervals. The revised page lists certificate data such as Account ID, Entra ID Device ID, Device Owner, Certificate List, Common Name, and Is Identity, and identifies Zimperium as a supported partner.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Thursday, 15 January 2026

Edge for Business and Windows Update guidance add clearer policy guardrails

55 updates