Thursday, 12 March 2026

Day in brief

Recovery Lock rotation rollout leads Intune’s refreshed privileged-role security guidance

The 12 March period was dominated by documentation maintenance: 45 updates, one new page, one removal, and no Message Center items. The meaningful exceptions were concentrated in Intune security administration and remote actions, alongside new Configuration Manager feedback guidance. Many other edits were mechanical, such as removing the “| Microsoft Docs” title suffix, changing audience metadata, or correcting links.

Intune · General
Recovery Lock rotation now depends on a successful device check-in
The Intune remote-action guidance says Rotate Recovery Lock passcode is gradually rolling out, with full availability expected by late April 2026. Confirming the action starts rotation, but the new passcode is applied only at the device’s next successful Intune check-in; an offline or non-checking-in device retains its existing passcode.
Intune · Tenant administration
Intune Administrator guidance emphasizes privileged, broad access
Revised Intune RBAC guidance describes Intune Administrator as a Microsoft Entra privileged role with global read/write access across Intune. It recommends built-in or custom roles for routine administration and limiting the broad role to the time required, then removing it. This is strengthened security guidance, not evidence that the role’s permissions changed.
Intune · Fundamentals
Multi Admin Approval requirements now separate policy and approval permissions
The updated Intune guidance recommends a custom role with Create, Read, Update, and Delete access-policy permissions for administrators who create or manage policies. Approvers must belong to the policy’s approver group and have the Approval for Multi Admin Approval permission in their Intune role.
Configuration Manager · General
Configuration Manager feedback will reject unauthenticated requests from 26 June
Updated Configuration Manager feedback guidance says authentication will be required for security and reliability, and unauthenticated requests will no longer be accepted starting 26 June 2026.
Configuration Manager · General
A new Configuration Manager page flags standalone offline-feedback failures
The new offline-feedback update documents a System.IO.FileLoadException caused by a Microsoft.Identity.Client version mismatch when using UploadOfflineFeedback.exe. The page says the standalone tool will be fixed in a subsequent release and directs administrators to use embedded feedback experiences meanwhile.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Thursday, 12 March 2026

Recovery Lock rotation rollout leads Intune’s refreshed privileged-role security guidance

47 updates