Tuesday, 3 February 2026

Intune RBAC guidance now lists Android enrollment and cloud-attached device actions

The 3 February period was documentation-only: 12 existing Intune pages were updated, with no new or removed items and no Message Center entries. The most operationally relevant revisions clarify custom-role permissions, make Microsoft Edge mobile PAC failure behavior explicit, and document where Intune service notices appear in the admin center. The supplied evidence does not announce a new feature, preview, general-availability release, retirement, or product behavior change.

• Intune · Fundamentals

  Custom-role page now lists Android enrollment and cloud-attached actions

  The Create Custom Role page now documents Android Enterprise/Enrollment time device membership assignment for Android Enterprise, which allows Intune to assign devices to Entra ID groups during enrollment. It also lists Cloud attached devices actions for running CMPivot queries, running scripts, taking application actions, and viewing applications. Android Enterprise descriptions now use Managed Google Play terminology. The same diff removes the previous VPP-apps permission note; it does not say that the underlying

• Intune · Tenant administration

  RBAC guidance changes the documented selection model to Permission and Action

  The Role Based Access Control page changes its documented workflow from selecting a permission category and permission to selecting a permission and a specific action. It likewise describes user permissions as Permission and Action rather than Category and Permission. This is a terminology and procedure clarification in the documentation, not evidence of a newly introduced RBAC model.

• Intune · App management

  Edge mobile guidance makes PAC failure handling explicit

  The Manage Microsoft Edge page now states that Microsoft Edge for iOS and Android blocks network access by default when a PAC script is invalid or unavailable. Organizations can change the default to PAC failed open. The revision clarifies the documented default; it does not announce that Edge's runtime behavior changed.

• Intune · Fundamentals

  Service guidance adds the Intune admin center notice location

  The service description now identifies both notice locations: Microsoft 365 admin center notices appear at Health > Message center, while Intune admin center service change and service health notices appear at Tenant administration > Tenant status > Service health and message center.

• Intune · Android

  Service overview removes the 100-user trial wording and onboarding paragraph

  The service description reframes Intune from a mobile-focused EMM service to an endpoint management service, describes a 30-day free trial without the previous qualification that it included 100 user licenses, and removes the Intune Onboarding benefit paragraph. The supplied diff is a page-content revision only; it does not announce a licensing change or retirement of the onboarding benefit.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.