Tuesday, 24 February 2026

Day in brief

Intune assignment filters gain granular management types as legacy values are replaced

An Intune managed-app assignment-filter rollout is the clearest operational change: Android and iOS/iPadOS management-type values are becoming more granular, legacy values are automatically mapped, and the update is expected to reach all customers by late March 2026. A new tenant-level how-to spells out the Windows diagnostic-data toggle and license attestation, while the Zero Trust material is planning guidance and the Automated Device Enrollment item clarifies an existing MFA limitation. The remaining Configuration Manager edits are predominantly terminology, link, formatting, and role-guidance maintenance; no Message Center announcement is supplied.

Intune · Fundamentals
Managed app assignment filters move from legacy values to enrollment-specific types
This is a staged Intune capability rollout, not merely a wording edit. Android lists granular corporate-owned work-profile, fully managed, dedicated-device, and personally-owned work-profile values; iOS/iPadOS adds Automated Device Enrollment user-associated and userless devices, Account Driven User Enrollment, and Device Enrollment with Company Portal and Web Enrollment. The legacy Android Enterprise and Managed values are being deprecated. Existing filters are automatically mapped, but the mapping requires a user
Intune · Windows
Windows diagnostic-data and license-attestation controls get a tenant-level how-to
The new Intune article gives the exact path Tenant administration > Connectors and tokens > Windows data and names the toggle Enable features that require Windows diagnostic data in processor configuration, whose default is Off. Turning it Off disables Intune features that rely on this configuration, although it might not disable processor configuration enabled by other methods. The guidance also explains tenant license attestation for dependent features and says attestation confirms entitlement rather than activat
Intune · App management
A new seven-layer Zero Trust framework spans app protection to endpoint DLP
Intune's new deployment approach presents a recommended seven-layer progression for Zero Trust device security, starting with app protection and extending to endpoint data loss prevention. It is a planning framework and conceptual guidance, not evidence that Intune has introduced a new enforcement feature or that administrators must reorder existing policies.
Intune · Endpoint analytics
Zero Trust guidance recommends compliance and enforcement before configuration profiles
The revised deployment plan explicitly places layers 3–4—compliance policies and enforcement—before layer 5, configuration profiles, describing an “assess and block first, configure second” approach. This is security and rollout guidance; the diff does not indicate that Intune automatically changes policy order or tenant settings.
Intune · Device enrollment
ADE Setup Assistant guidance clarifies the modern-authentication MFA limitation
The Automated Device Enrollment page now explicitly says phishing-resistant MFA isn't supported on iOS/iPadOS Setup Assistant and that users enrolling with Setup Assistant plus modern authentication need an alternate MFA method. This is a scope and wording clarification of the documented enrollment limitation, not evidence that the limitation was newly introduced.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 24 February 2026

Intune assignment filters gain granular management types as legacy values are replaced

43 updates