Tuesday, 17 February 2026

Day in brief

Configuration Manager hotfix stops co-managed updates falling back to WSUS

The period’s most consequential change is KB36495448 for Configuration Manager: it addresses incomplete Windows Update scan-source policies that could redirect Intune- or WUfB-targeted Feature and Quality Updates to WSUS on co-managed devices using third-party updates. Connected Cache guidance also documents selective HTTPS delivery, while HSTS guidance adds an important site-system compatibility warning. Most remaining edits are mechanical replacements of sample GUIDs, identifiers, links, and examples rather than evidence of new Intune service behavior.

Configuration Manager · General
KB36495448 fixes partial scan-source policies on co-managed devices
The new Configuration Manager client-fix reference covers versions 2503, with Update rollup 32851084 installed, and 2509. With third-party updates enabled, the client could set only part of the Windows Update scan-source policy, causing Feature Updates and Quality Updates intended for Intune or Windows Update for Business to come from WSUS or Configuration Manager instead. The fix stops Configuration Manager from setting or modifying the affected scan-source values and cleans up incomplete values left by earlier###
Configuration Manager · General
Connected Cache guidance adds selective HTTPS delivery
The Connected Cache update now applies to Configuration Manager 2409, 2503, and 2509. It documents proxy support for environments requiring absolute URLs and lets distribution point cache nodes deliver Intune-managed Win32 application content over HTTPS, including Microsoft Teams content for the first time. Cache nodes need a valid TLS certificate generated through the organization’s PKI; other content types continue to use HTTP.
Configuration Manager · General
HSTS guidance warns of HTTP-role breakage in Configuration Manager
The revised communications guidance says Configuration Manager does not support HSTS configuration in IIS, clients do not honor HSTS headers, and mandatory HTTPS redirection is incompatible with HTTP or Enhanced HTTP site-system roles. The Fallback Status Point is HTTP-only, while WSUS-based Software Update Points still deliver update payloads over HTTP, so HSTS or HTTPS redirection can break those functions. This is a security and compatibility clarification, not a new Intune control.
Intune · Device security
Device Protect guidance clarifies mixed-management and managed-app coverage
This is an editorial clarification rather than evidence of a new capability. The page is retitled “Protect data and devices with Microsoft Intune,” explicitly references third-party compliance and Mobile Threat Defense signals, separates Microsoft Entra Conditional Access for MFA from Intune sign-in settings, and states that app-based Conditional Access can require managed apps while personal data remains unaffected. It also more specifically describes co-management and tenant attach for on-premises and hybrid-held

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 17 February 2026

Configuration Manager hotfix stops co-managed updates falling back to WSUS

34 updates