Tuesday, 27 January 2026

Windows enrollment guidance shifts setup from Global Administrator to Intune Administrator

27 January was a documentation-only period: all 14 Intune entries were updates, with no new capabilities, retirements, or Message Center announcements. The most consequential edits refine Windows enrollment role guidance and flag Settings catalog (DDM) as unsupported in two filter-workload table entries. The remaining changes are primarily RBAC clarification, terminology, links, formatting, and repositioned notes.

• Intune · Device enrollment

  Windows Enroll now lists Intune Administrator as the admin-center role

  The prerequisites section now requires an Intune subscription, Microsoft Entra ID P1 or P2 or a Premium trial, and sign-in with the built-in Intune Administrator role. The previous prerequisite named a Microsoft Entra Global Administrator. The diff changes the documented prerequisite, but does not establish a backend permission change.

• Intune · Fundamentals

  Trial guidance separates initial Global Administrator use from routine tasks

  Free Trial Sign Up now suggests signing out of the Global Administrator account and using the account needed for the Intune task. Its role table says Intune Administrator can set up Intune and Automatic Enrollment for Windows devices, while the earlier Global Administrator entry was removed. This is least-privilege guidance, not evidence that Global Administrator access is technically blocked.

• Intune · Compliance

  Filters table now marks Settings catalog (DDM) unsupported

  Two Settings catalog (DDM) entries changed from supported (✅) to unsupported (❌). The diff gives no rollout explanation or additional scope, so administrators should verify existing filter assignments involving DDM settings catalog workloads before relying on them.

• Intune · Fundamentals

  Policy and Profile Manager scope is described more precisely

  The role description now says Policy and Profile Manager can create and manage Intune policies, including compliance, device configuration, and most enrollment policies, replacing the broader but less specific “Intune policies” wording. This is an RBAC documentation clarification, not an announced permission expansion.

• Intune · App management

  App protection monitoring relocates the iOS device-name caveat

  The page now places the existing reporting note in a new “Before you begin” section: on iOS 16 and later, the Device Name value in all app protection reports is generic. The diff indicates a documentation reorganization and terminology cleanup rather than a newly introduced reporting behavior.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.