Thursday, 2 April 2026

Day in brief

Change Review Agent enters Multi Admin Approval preview as Recovery Lock rolls out

Intune’s most consequential signals on 2 April were a public-preview approval workflow and a staged macOS security action. The In Development material describes an Agent Response column for Windows PowerShell scripts in Multi Admin Approval, with Change Review Agent risk recommendations inline, while Recovery Lock passcode rotation is rolling out gradually and is expected to reach full availability by late April 2026. Most remaining entries are a remote-device-action documentation reorganization—new per-action pages under `device-management/actions` alongside removals of older paths—so they should not be read as proof of new launches or changed service behavior. There was no Message Center item.

Security Copilot · Windows
Change Review Agent recommendations move inline in Multi Admin Approval
Security Copilot guidance identifies a public preview that adds an **Agent Response** column for Windows PowerShell scripts in the Intune Multi Admin Approval experience. Approvers can view Change Review Agent risk-based recommendations inline instead of navigating to the separate agent experience.
Intune · Apple
macOS Recovery Lock passcode rotation is rolling out gradually
The Intune remote action may not yet be available in every tenant; full availability is expected by late April 2026. It supports supervised macOS 11.5 or later on Apple silicon, not Intel Macs, and requires a policy that enables Recovery Lock. The newly generated passcode appears in the admin center and becomes effective on the device at its next successful Intune check-in.
Intune · Fundamentals
Android Enterprise Block location is slated to become a three-option setting
In-development settings catalog guidance says **General > Block location** will be renamed **Location** with **Device default**, **Location enabled**, and **Location disabled** options. Enabled forces location services on and prevents users from turning them off; disabled forces them off and prevents users from turning them on. The guidance applies to COPE devices running Android 10 and earlier, COBO, and COSU devices; no availability date is given.
Intune · Fundamentals
macOS ADE Platform SSO registration guidance requires two enrollment sign-ins
The in-development procedure requires an `EnableRegistrationDuringSetup` settings catalog policy assigned through Setup Assistant’s **Await final configuration** step. During enrollment, users sign in once for regular enrollment and again in Company Portal to authenticate and obtain the SSO extension. Devices must use ABM or ASM ADE with modern authentication, and Company Portal 5.2604.0 or later must be deployed as a line-of-business app; a future reduction in sign-ins has no ETA.
Intune · General
Delete guidance distinguishes Retire from Wipe by platform and enrollment
The new remote-action page documents that Delete triggers **Retire** for Windows, iOS/iPadOS, macOS, Android device administrator, and Android BYOD. It triggers **Wipe** for Android COBO, COSU, COPE, and AOSP. This is a documentation clarification rather than evidence of a same-day behavior change. The page also warns that retiring or deleting a BitLocker-protected Microsoft Entra joined device removes key protectors and suspends BitLocker on the OS volume, so administrators should back up the recovery key and aÂ

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Thursday, 2 April 2026

Change Review Agent enters Multi Admin Approval preview as Recovery Lock rolls out

99 updates