Thursday, 19 March 2026

Direct LOB APK deployment expands Android Enterprise options as Defender onboarding guidance arrives

This period’s substantive Intune content centers on Android app deployment. A new guide provides a single path for deploying and configuring Defender for Endpoint on Android, while updated LOB-app guidance explicitly documents direct APK upload and required assignment for Android Enterprise fully managed and dedicated devices without Managed Google Play. A service release 2603 entry also describes macOS Recovery Lock and new Apple DDM settings. Other edits are mainly clarifications: LOB installation-error details now cover Android Enterprise, the Defender integration page points to the new guide, and the Configuration Manager firewall article restates prerequisites and corrects procedure numbering.

• Intune · App management

  New Defender for Endpoint Android guide consolidates deployment and configuration

  This new how-to covers acquiring Microsoft Defender for Endpoint from Managed Google Play, assigning and verifying it, configuring app configuration policies, setting up always-on VPN, and low-touch onboarding. It states that Google Play updates the app automatically and requires one of three Android Enterprise enrollment types plus the Intune service-to-service connection with Defender for Endpoint.

• Intune · App management

  Updated LOB guidance documents direct APK deployment for Android Enterprise

  The revised guide explicitly says required LOB apps on Android Enterprise fully managed and dedicated devices can be deployed without Managed Google Play: upload the APK directly to Intune and assign it as a required app to corporate-owned devices. Related app-management pages repeat this scope, making this a clarified deployment option rather than evidence of a newly launched feature.

• Intune · Fundamentals

  macOS Recovery Lock entry details password rotation and privileged retrieval

  The added Week of March 23, 2026 service release 2603 entry describes a Recovery OS password for company-owned Macs that prevents booting into recovery mode, macOS reinstallation, and bypassing remote management. Settings catalog policies can enable Recovery Lock and set a rotation schedule; a Recovery Lock device action can manually rotate the password. The password appears in the per-setting status report under Passwords and keys.

• Intune · Fundamentals

  Apple DDM catalog adds Intelligence, keyboard, Siri, and external-intelligence controls

  The service-release entry adds iOS/iPadOS DDM settings for External Intelligence, Apple Intelligence features such as Genmoji, Image Playground, Image Wand, and Writing Tools, Mail/Notes/Safari summaries, on-device dictation and translation, keyboard controls, and Siri controls. The supplied macOS diff explicitly lists External Intelligence settings for Allow Sign In and Allowed Workspace IDs. Administrators find these under the platform’s Settings catalog profile.

• Intune · Fundamentals

  Inventus OEMConfig package appears on Android Enterprise in-development listing

  The updated In Development page lists Inventus, package `com.inventus.oemconfig.gen`, as a supported OEMConfig app available in Intune for Android Enterprise. Because the item appears on an In Development page, the supplied change is a status listing and provides no general-availability date or rollout procedure.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.