Monday, 23 February 2026

Certificate Connector 6.2510.3.2002 enforces an allow list for SCEP extensions

The strongest administrator-facing change is a security enforcement: Certificate Connector 6.2510.3.2002 blocks unknown SCEP certificate extensions and enforces a six-OID list. Intune service release 2602 also documents changed Advanced Analytics Device query syntax, expanded multi-administrator approval, new Apple DDM and Settings Catalog options, and the approaching end of legacy Apple software-update policy creation. The new Configuration Manager 2509 reference is informational, detailing collected data by diagnostic level and clarifying that Basic and Enhanced levels don't collect IP addresses, user names, computer names, physical addresses, or email addresses. The remaining diffs are largely maintenance: Autopilot workflow text and formatting changes, archive backfills, and ConfigMgr note or code formatting.

• Intune · Device security

  Certificate Connector adds an allow list for SCEP certificate extensions

  Starting with Certificate Connector version 6.2510.3.2002, the SCEP validation service blocks unknown certificate extensions. The documented list includes 2.5.29.19 (Basic Constraints), 2.5.29.14 (Subject Key Identifier), 1.3.6.1.4.1.311.21.8 (Certificate Authority Version), 1.3.6.1.4.1.311.20.2 (Certificate Template Name), 2.5.29.1 (Authority Identifier, deprecated), and 2.5.29.3 (Certificate Policies, deprecated).

• Intune · Fundamentals

  Device query changes join syntax and operator references

  The service-release entry adds leftsemi, rightsemi, leftanti, and rightanti joins. Joins using `on Device.DeviceId` are no longer supported; queries should use `on Device` or omit the on clause when joining on the device entity. Using `Device` alone in operators such as `distinct`, `summarize`, or `order by` is also no longer supported; a specific device property is required. Device-involving results now show the device as a clickable link, with clearer invalid-query messages.

• Intune · Fundamentals

  Apple DDM assignments and Settings Catalog gain new options

  Service release 2602 says assignment filters can be used in policy assignments for DDM-based configurations such as software updates on iOS/iPadOS. The Apple Settings Catalog adds AirPlay > Device Name for iOS/iPadOS and macOS, and the macOS Microsoft Defender category receives new settings.

• Intune · Fundamentals

  Multi-administrator approval expands to Settings Catalog and compliance policies

  Multi-administrator approval now supports device configuration policies created through the Settings Catalog and device compliance policies. When enabled, creating, editing, or deleting a policy requires approval from a second administrator before the change takes effect.

• Intune · Fundamentals

  Legacy Apple MDM software-update policy creation is nearing retirement

  Apple deprecated legacy MDM software-update commands and payloads with iOS 26, iPadOS 26, and macOS 26. Intune says it will soon end support for creating legacy iOS/iPadOS and macOS software-update policies. The supplied entry does not provide an end date or replacement procedure.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.