Thursday, 9 April 2026

Day in brief

Cloud PKI expiration guidance and staged Windows rollouts lead the Intune briefing

This was a documentation-led period: 285 tracked changes, including 59 new, 167 updated, and 59 removed, with no Message Center entries. The most consequential material is operational guidance for Cloud PKI certificate continuity, Intune device cleanup, and Windows update deployment. Many other representative edits are link or image-path corrections, so the supplied evidence does not establish a broad product launch or general-availability change. Apple update pages do carry a deprecation notice, but no retirement date or replacement procedure is provided.

Cloud PKI · General
Cloud PKI guidance adds a customer-managed CA-expiration runbook
The new Microsoft Cloud PKI guidance says SCEP profiles that reference an expired issuing CA stop issuing new certificates, potentially affecting Wi-Fi, VPN, email, and certificate-based authentication. Administrators are directed to create a replacement issuing CA with the same Root CA Source and matching properties such as EKUs and key sizes, then replace the old SCEP URI in each affected profile. Cloud PKI does not support multiple SCEP URIs, and changing the URI does not trigger certificate reissuance; the page
Intune · Tenant administration
Device cleanup rules are documented as hide-only, not wipe or retire
New Intune guidance states that scheduled cleanup rules hide records for devices that have not checked in, removing them from the Intune portal and reports without wiping or retiring the devices. Records can reappear if the device checks in before its certificate expires; after certificate expiry, re-enrollment is required. The documented threshold is 30 to 270 days, Jamf-managed devices are excluded, and configuration requires the specified cleanup-rule RBAC permissions.
Intune · Device updates
Feature-update guidance defines immediate, dated, and gradual availability
New Intune guidance documents three rollout behaviors for Windows feature update policies: make an update available as soon as possible, on a specific date, or gradually through offer groups. For gradual deployment, the first-group availability date must be at least two days in the future. Availability makes devices eligible after their next Windows Update scan; actual installation remains influenced by deadlines, restart controls, and user behavior.
Intune · Device updates
Driver-policy guidance calls out blocking settings and one-policy assignments
The Windows driver update procedure tells administrators to check that the update-ring Windows driver setting is set to Allow and that Settings Catalog > Windows Update client policies > Exclude WU Drivers in Quality Update is set to Allow Windows Update drivers. It also recommends assigning each device to only one driver update policy and using test groups and phased deployments before broader approval.
Intune · Device updates
Supervised Apple update guidance carries a deprecation notice and operating limits
The new supervised iOS/iPadOS update guide includes the Apple MDM software updates deprecation notice and documents support for supervised iOS 10.3 through 18 and iPadOS 13.0 through 18. Deploying an older OS version also requires a device restrictions profile to restrict update visibility. Shared iPad updates install only while the device is charging and no users are signed in. The supplied evidence gives no deprecation date or replacement path, so this is a planning signal rather than a dated retirement notice.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Thursday, 9 April 2026

Cloud PKI expiration guidance and staged Windows rollouts lead the Intune briefing

285 updates