Friday, 27 March 2026

Microsoft Tunnel sets March 31 Android 10 cutoff as Autopilot adds managed installer support

Two administrator-facing changes stand out: Windows Autopilot device preparation now documents managed installer policy application during OOBE before Win32, Microsoft Store, and Enterprise App Catalog apps install, while Microsoft Tunnel guidance sets March 31, 2026 as the Android 10 support cutoff and requires Android 11 or later. Intune’s hotpatch and Windows Update pages also revise how default protection, policy control, and Windows Autopatch approval are described. Cloud configuration’s guided deployment path is explicitly deprecated and being removed. Most remaining edits are ordinary documentation maintenance, especially image-path corrections and minor formatting changes, rather than additional feature launches.

• Intune · Device security

  Microsoft Tunnel sets March 31 Android 10 support cutoff

  Support retirement: the updated prerequisites state that support for Android 10 ended March 31, 2026. Devices running Android 10 must upgrade to Android 11 or later to continue using Microsoft Tunnel. This is a minimum-version change, not a new capability.

• Windows Autopilot · Device enrollment

  Autopilot device preparation adds managed installer policy support

  New capability guidance: Windows Autopilot device preparation now supports the managed installer policy during OOBE. Intune applies it before Win32, Microsoft Store, and Enterprise App Catalog apps install; those app types were previously skipped to avoid installation conflicts and deployment failures. The supplied change does not identify a preview or general-availability status.

• Intune · Compliance

  Hotpatch guidance now documents default enablement and restart exceptions

  Updated security and behavior guidance says hotpatch security updates are enabled by default for all eligible devices in Intune, with control through a tenant-level setting or quality update policies. During a hotpatch month, a device missing the latest baseline receives both the restart-required baseline and the hotpatch update; upgrading to the latest Windows version during a hotpatch month switches the device to standard updates and requires a restart.

• Intune · Device updates

  Intune update policies are framed as Windows Autopatch approval controls

  Documentation clarification: the overview now says Intune sends policy configuration to Windows Autopatch, which determines what update content is approved, while devices download approved updates from Windows Update. A device assigned to a policy is enrolled in Autopatch for that content type and receives only approved content; without targeting for that content type, the latest Windows Update content is deployed.

• Intune · Windows

  Cloud configuration’s guided deployment scenario is being removed

  Retirement and procedure change: the page says the automatic guided scenario is deprecated and being removed from the Intune admin center. It now directs administrators to the Windows client cloud config setup guide to create all policies manually. This changes the deployment procedure; it does not announce a new cloud configuration feature.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.