Tuesday, 3 March 2026

Apple outlines userless visionOS/tvOS enrollment and DDM for iOS/iPadOS apps

The most consequential updates are planned Apple capabilities on Intune’s In Development page: service-access controls for organization-owned Apple devices, userless automated device enrollment (ADE) for visionOS and tvOS, and Declarative Device Management (DDM) for required line-of-business apps on iOS/iPadOS 18 and later. None is identified as generally available. Separate guidance clarifies Android prerequisites for Device Locate and documents a macOS LAPS issue affecting versions earlier than macOS 26.4. The remaining edits are largely editorial or documentation clarification, including adding Honeywell UEMConnect to the Managed Home Screen OEMConfig description and correcting What's New markup. The Message Center item only points to the February 2026 service build in Tenant Status and provides no feature-level detail.

• Intune · Apple

  Apple’s roadmap adds userless ADE and service-access controls

  The In Development page says Intune will add userless ADE for visionOS and tvOS through Apple Business Manager or Apple School Manager, including custom configuration uploads, default enrollment restrictions, and remote device actions. It also describes future Apple access-management settings for organization-owned iOS/iPadOS and macOS devices, allowing administrators to control which devices users can sign in to and which apps and services are available. These are planned capabilities, not a general-availability (

• Intune · Apple

  DDM support is planned for required Apple line-of-business apps

  Intune is adding Declarative Device Management support for configuring required line-of-business apps on iOS/iPadOS 18 and later. The described Managed App configuration uses policy-based deployment and configuration, real-time app status, and expanded per-app associated-domain attributes. The page says administrators will configure this by changing the app’s management type in App information; the entry remains an In Development announcement.

• Intune · General

  Android Device Locate prerequisites are stated more precisely

  The Device Locate guidance now explicitly says the Android remote action is available only when the administrator can read the policies configuring device location. The account must have the Device configuration/Read permission and scope-tag visibility to the device restriction or settings catalog policy controlling location settings. This is documented as a prerequisite clarification, not evidence of a newly announced product behavior change.

• Intune · Device enrollment

  macOS LAPS guidance isolates the pre-26.4 password-reset issue

  The known issue affects macOS versions earlier than 26.4 when ADE enrollment uses a configured local administrator account and a targeted passcode profile. The device can prompt for an administrator password reset even when Change at next auth is disabled or Max Age (days) has a value; the standard account is unaffected. Microsoft’s documented workaround is to manually rotate the administrator password after the reset, while upgrading to macOS 26.4 resolves the issue.

• Intune · Apple

  A replacement TeamViewer connector experience is planned

  The In Development page says Intune will update its TeamViewer integration to simplify onboarding and improve reliability, replacing the existing connector experience in the Intune admin center. Organizations using the older connector will need to migrate after it is retired, but the supplied update does not provide a complete retirement date or migration window.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.