Thursday, 19 February 2026

Automated Device Enrollment needs alternate MFA for iOS Setup Assistant

All 25 supplied changes are documentation updates, with no message-center announcement. The most actionable guidance adds an explicit iOS/iPadOS enrollment MFA limitation, clarifies failure conditions for macOS Direct Enrollment, and tightens Configuration Manager BitLocker policy guidance. Other notable edits correct a task-sequence imaging instruction and document a Company Portal path for unmanaged Android line-of-business apps. The evidence does not establish a new feature launch, preview, general availability milestone, or retirement during the period.

• Intune · Device enrollment

  iOS/iPadOS ADE documentation adds a phishing-resistant MFA limitation

  The Automated Device Enrollment Authentication page adds a caution that phishing-resistant MFA is currently unsupported in Setup Assistant for iOS/iPadOS. Users enrolling through Automated Device Enrollment with modern authentication must have an alternate MFA method available to complete enrollment. This is newly documented guidance; the evidence does not say that the service behavior itself newly changed.

• Intune · Device enrollment

  macOS Direct Enrollment now spells out restriction-related enrollment failures

  The guidance says enrollment restrictions are not supported for this enrollment method. A device platform restriction targeted at any Apple device can cause profile download to fail, and using a profile downloaded before an enrollment restriction was configured—after that restriction is enabled—will also cause enrollment to fail.

• Configuration Manager · Device security

  Configuration Manager BitLocker guidance emphasizes domain GPO precedence

  The updated guidance explicitly distinguishes standalone MBAM domain policies from Configuration Manager local BitLocker policies: domain policies override the local Configuration Manager policies. It now recommends avoiding group policies for BitLocker and configuring all settings through Configuration Manager BitLocker management policies.

• Configuration Manager · Device updates

  Task-sequence imaging guidance reverses the cached-scan instruction

  For the option controlling use of cached Windows Update Agent scan results, the article now says to disable the option when using a task sequence to capture and build an OS image. Disabling it also instructs the agent to download the latest catalog from the software update point; the previous text incorrectly said to enable it for image capture.

• Intune · App management

  Unmanaged Android app guidance adds a Company Portal LOB scenario

  The Apps deployment article now documents that unmanaged Android users can browse and install available line-of-business applications from the Company Portal instead of the Play Store. It specifies Android-Line-of-Business apps with Target platform set to Device Administrator, while also linking an end-of-support note for Android device administrator devices. This is documentation coverage, not evidence of a new rollout or availability change.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.