Thursday, 5 March 2026

Configuration Manager hotfix fixes co-managed Feature and Quality Update redirection to WSUS

The standout operational change is KB36495448 for Configuration Manager: on co-managed devices running version 2503 with Update rollup 32851084 or version 2509, third-party-update integration could leave partial Windows Update scan-source policies and send Feature or Quality Updates to WSUS/Configuration Manager instead of Intune or Windows Update for Business. The hotfix stops Configuration Manager from setting those scan-source values and cleans up incomplete prior state. Intune also added Recovery Lock configuration guidance, expanded its security-baseline reference to Windows 11 version 25H2, and recorded service release 2602 support for Apple DDM assignment filters. Most other entries are ordinary link, table, metadata, or support-page relocation edits; the old support article was removed after its content moved to a new path.

• Configuration Manager · General

  KB36495448 repairs Windows Update scan-source policies in co-managed Configuration Manager

  The fix applies to Configuration Manager 2503 with Update rollup 32851084 and version 2509 when third-party updates are enabled in a co-managed environment. The affected client could set only UseUpdateClassPolicySource and SetPolicyDrivenUpdateSourceForOtherUpdates, causing Feature and Quality Updates intended for Intune or Windows Update for Business to be redirected to WSUS/Configuration Manager. After the hotfix, Configuration Manager no longer sets those scan-source values on co-managed devices and cleans up an

• Intune · Apple

  Recovery Lock guidance sets a narrow macOS eligibility boundary

  New Intune settings-catalog guidance documents Recovery Lock for macOS. Intune generates a strong random password, requires it to access the recovery partition environment or update/remove the password, protects the Startup Options screen, and supports time-based rotation. The documented scope is macOS 11.5 or later on Apple silicon with Intune enrollment and supervision; Intel Macs are unsupported. Device actions can rotate the passcode, with custom permissions required to view or rotate it.

• Intune · Device security

  Intune security-baseline guidance adds Windows 11 version 25H2

  The security-baseline page now includes a Version 25H2 pivot based on the Windows 11 version 25H2 baseline, limited to settings that apply to Windows devices managed through Intune. Documented defaults include enabled prevention of the lock screen camera and slideshow, enabled UAC restrictions for local-account network logons, a disabled SMB v1 server, enabled SEHOP, and highest protection for IP source routing.

• Intune · Fundamentals

  Service release 2602 documents Apple DDM assignment filters and protected apps

  The Intune service-release notes state that assignment filters can be used with policy assignments for DDM-based configurations such as software updates on iOS/iPadOS and macOS. They also list Jump by Accio Inc. and Mijn InPlanning by Intus Workforce Solutions for Android as newly available protected apps.

• Intune · Apple

  Windows account-registration MDM control enters public preview; Admin tasks reaches GA

  The public-preview setting Disable MDM enrollment when adding work or school account on Windows controls MDM enrollment during the Microsoft Entra account-registration flow. Its default is No, which allows enrollment, and the update says no action is required unless administrators want to change that behavior. The same release-note update says Admin tasks under Tenant Administration is out of preview and generally available, with search, filtering, and sorting.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.