Friday, 27 February 2026

Day in brief

Windows diagnostic-data and stale-device cleanup guidance sharpens Intune tenant administration

The supplied evidence is documentation-led rather than a feature-release bulletin: there are no Message Center items, and it does not establish a preview, general-availability launch, retirement, or product behavior change. The most consequential material adds concrete tenant setup, cleanup, RBAC, compliance-synchronization, and Configuration Manager upgrade guidance. Other sampled edits are mainly link moves, support-navigation corrections, and wording cleanup.

Intune · Windows
Windows diagnostic-data and license verification setup is spelled out
A new Intune how-to identifies Tenant administration > Connectors and tokens > Windows data as the configuration location. The setting **Enable features that require Windows diagnostic data in processor configuration** defaults to Off; turning it Off disables Intune features that rely on that configuration, although it might not undo processor configuration enabled elsewhere. Dependencies listed include Windows Update compatibility and expedite reports plus failure alerts for driver, expedited quality, and feature-
Intune · General
Device cleanup rules hide stale records rather than wipe or retire devices
New how-to guidance says scheduled cleanup rules hide devices from the Intune portal and reports after a configured period, with the setting accepting 30 to 270 days. One rule can be created per platform and applies to all devices on that platform. Cleaned-up devices can reappear before their device certificate expires; after expiration, re-enrollment is required. The rules aren't available for Jamf-managed devices.
Intune · General
Tenant Status access requires three Intune read permissions
The new Tenant Status guidance documents the path Tenant administration > Tenant Status and the information shown there, including tenant details, service release versions, licenses, enrolled devices, connector status, and health messages. Access requires `Organization.Read`, `ManagedDevice.Read`, and `ManagedApp.Read`; the Intune Read Only Operator role grants them, while a custom role or the Intune Administrator Microsoft Entra role can also be used. PIM roles must be elevated before viewing the page.
Configuration Manager · General
Configuration Manager upgrades need role-specific registry validation
The revised post-upgrade procedure says to inspect `HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths`, value `Machine`, after upgrading a central administration site, primary site, secondary site, or distribution point. CAS, primary, and secondary sites should include `Software\Microsoft\SMS`; distribution points should include `Software\Microsoft\SMS\DP`. If the role-specific data is missing, the guidance says to add it manually to avoid site-system inbox upload issues and possible DP, ,
Intune · Device security
Compliance-partner guidance makes Workspace ONE UEM synchronization explicit
The updated Intune partner-compliance article states that changes saved in the Intune admin center must be manually synchronized from the Workspace ONE UEM console. Until synchronization, UEM is unaware of the configuration changes and users in newly assigned groups do not successfully report compliance. Azure services synchronize changes made after the initial configuration or the last manual synchronization. This is a procedural documentation clarification, not evidence of a changed integration rollout.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Friday, 27 February 2026

Windows diagnostic-data and stale-device cleanup guidance sharpens Intune tenant administration

86 updates