Monday, 9 February 2026

Endpoint Privilege Management now supports single-session Azure Virtual Desktop users

The substantive service-release content centers on Endpoint Privilege Management (EPM): elevation policies now support deployment to users on Azure Virtual Desktop single-session virtual machines. Intune also adds Windows 11, version 25H2, to two feature-update readiness reports, introduces new Windows Settings catalog controls, and adds a Lenovo Device Orchestration link plus four protected apps. Separately, Windows Autopilot guidance records a Hybrid Entra join timeout and the OS updates that resolve it. The Settings insight rewrite clarifies documented scope and interpretation; much of the remaining activity is editorial or procedural maintenance.

• Intune · Fundamentals

  Service release expands EPM and Intune app-management entry points

  The service release 2601 entry states that EPM elevation policies support deployment to users on AVD single-session virtual machines. It also adds a direct Intune admin center link to Lenovo Device Orchestration for supported Lenovo devices and lists four protected apps as newly available: Clarity Express for Intune, Datadog, Qlik Analytics, and Tier1 for Intune (iOS).

• Intune · Fundamentals

  Windows Settings catalog adds Edge and Share Sheet controls

  The Windows Settings catalog adds Microsoft Edge policies through version 143.0.3650.23, including Allow sharing tenant-approved browsing history with Microsoft 365 Copilot Search, Enable RAM (memory) resource controls, and Specifies whether to opt out of Local Network access restrictions. Experience > Disable Share App Promotions prevents promotional apps from appearing in Windows Share Sheet when enabled. The profile path is Devices > Configuration profiles > Create profile > Windows 10 and later > Settingsカタログ.

• Intune · Fundamentals

  Windows 11 25H2 enters feature-update readiness reporting

  The Windows feature update compatibility risks report and Windows feature update device readiness report now support Windows 11, version 25H2, as a selectable target OS under Select target OS. The reports provide readiness and compatibility-risk insights for that target.

• Windows Autopilot · Device enrollment

  Autopilot guidance identifies fixes for Hybrid Entra join timeouts

  The Windows Autopilot Known Issues page records deployment timeouts with error code 0x80004005 for Hybrid Entra join Autopilot deployments. The issue is resolved in KB5065789 or later for 25H2, KB5065426 or later for 24H2, and KB5070312 or later for 23H2.

• Intune · Fundamentals

  Settings insight scope is documented for two security baselines

  The revised guidance says Settings insight is available for the Microsoft Edge Baseline and Microsoft 365 Apps for Enterprise Security Baseline, but not currently for the Security Baseline for Windows 10 and later or the Microsoft Defender for Endpoint baseline. Light-bulb icons indicate that similar organizations commonly use Microsoft's recommended default; the feature does not suggest alternative values. This is a documentation clarification, not evidence of changed baseline behavior.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.