Friday, 13 March 2026

Intune RBAC guidance adds PIM-based time-bound administrator elevation

This was a documentation-only period, with no message-center announcements or evidenced tenant behavior changes. The most consequential update adds optional Privileged Identity Management guidance for the Intune Administrator role; other edits clarify deployment-plan wording, record a slow rollout target for an unnamed feature, and correct a Linux guide link.

• Intune · Fundamentals

  PIM is now documented as an option for Intune Administrator elevation

  The Role-Based Access Control guidance still recommends assigning the Intune Administrator role only for the required duration, and now adds that organizations with Microsoft Entra ID P2 or Microsoft Entra ID Governance can use Privileged Identity Management for time-bound elevation. This is security guidance clarification, not evidence of a newly released Intune RBAC capability.

• Intune · Device security

  Deployment-plan guidance changes the existing-device email sequence

  For existing devices, the documented sequence now says to deploy the email app at any time and then deploy the email device configuration policy. The page also presents the settings catalog before built-in templates and removes the macOS-and-Windows qualifier from the sentence describing antivirus and scanning built in with Microsoft Defender for Endpoint; the diff does not establish a product-behavior change.

• Intune · Fundamentals

  The What’s New page adds a late-March target for an unnamed rollout

  A note now says the referenced feature is rolling out slowly and should be available to all customers by late March 2026. The supplied diff does not identify the feature, its prerequisites, or any administrator action, so this should not be treated as a specific feature launch announcement.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.