Monday, 13 April 2026

Day in brief

New Intune guidance details macOS Platform SSO, Windows inventory, and VPN caveats

The period was primarily a documentation expansion and reorganization rather than a release bulletin. New Intune pages add setup and reference coverage for macOS Platform SSO, Windows properties-catalog inventory, VPN profiles, Apple restrictions, and Group Policy migration, while many updates simply repoint links from legacy intune-service/configuration locations to device-configuration paths. The former Group Policy Analytics migration article was removed, but a new migration page documents the same import, review, and Settings Catalog workflow. The supplied evidence identifies no preview, general-availability event, capability retirement, or service-behavior change.

Intune · Apple
macOS Platform SSO receives a dedicated Intune configuration guide
A new how-to explains configuring Platform SSO through a Settings Catalog policy and deploying it to macOS. It covers Microsoft Entra ID credentials, passwordless authentication, smart cards, and Touch ID, and says Platform SSO includes the Enterprise SSO app extension. This is new configuration guidance, not evidence of a launch or availability change.
Intune · Windows
Properties catalog guidance defines Windows inventory scope and roles
The new guide documents collecting selected Windows hardware properties such as BIOS, TPM, disk, memory, battery, and network-adapter information. The described scenario covers corporate-owned, Intune-managed devices, including co-managed devices, that are Microsoft Entra hybrid joined or Microsoft Entra joined. Configuration requires the Policy and Profile manager role or a custom role with Device Configurations > Create and Organization > Read.
Intune · Android
VPN guidance calls out app sequencing, certificate grouping, and Windows 11 caveat
The new VPN profile guide says to deploy the VPN app before creating the profile. For certificate-based authentication, the VPN profile, certificate profile, and trusted-root profile should target the same groups. It also states that iOS/iPadOS and macOS user enrollment supports only per-app VPN, and flags an issue between the Windows 11 client and the Windows VPNv2 CSP.
Intune · Apple
Apple restriction reference spells out unmanaged-app document blocking
The new Apple device restriction reference documents the iOS/iPadOS setting Block viewing corporate documents in unmanaged apps: Yes blocks viewing corporate documents in unmanaged apps, while Not configured is the default and leaves Intune unchanged; the operating system might otherwise allow viewing in any app. Its example says setting Yes can prevent OneDrive content from being saved to Dropbox after the policy is received, such as after a restart. This clarifies documented setting behavior rather than reporting
Intune · Windows
GPO migration guidance adds scoped-role and scope-tag prerequisites
A new Windows how-to describes importing on-premises GPOs, reviewing which settings are available in Intune, and migrating them into a Settings Catalog policy assigned to users or devices. It requires an Intune administrator or a role with Security baselines and Device configurations/Create permissions. Only administrators scoped to the GPO can create the policy, and an omitted scope tag defaults to Default. The page documents the workflow; it does not establish a new migration capability.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

457 updates

Microsoft Intune

430 updates

Removed Microsoft Intune documentation in intune/intune-service/configuration/vpn-settings-configure.md.

Wi Fi Profile Shared Key

Removed

Removed Microsoft Intune documentation in intune/intune-service/configuration/wi-fi-profile-shared-key.md.

Wi Fi Settings Configure

Removed

Removed Microsoft Intune documentation in intune/intune-service/configuration/wi-fi-settings-configure.md.

Wired Networks Configure

Removed

Removed Microsoft Intune documentation in intune/intune-service/configuration/wired-networks-configure.md.

Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/update-office.md.

Administrative Templates Import Custom

Removed

Removed Microsoft Intune documentation in intune/intune-service/configuration/administrative-templates-import-custom.md.

Updated Microsoft Intune documentation in intune/device-enrollment/apple/enable-supervised-mode.md.

Windows Holographic Business device settings - Microsoft Intune

Updated

Updated Microsoft Intune documentation in intune/device-configuration/templates/ref-device-restrictions-windows-holographic.md.

App management

Microsoft Edge for Business: Cross-tenant support using Intune Mobile Application Management (MAM)

New

Microsoft Edge for Business now supports cross-tenant Intune Mobile Application Management (MAM) policies, enabling data protection on devices managed by different tenants. This opt-in feature enforces app protection, redirects downloads to OneDrive, and activates leak controls, enhancing security for contractors and partners without disrupting users.

Message CenterMC1255405 on mc.merill.net ↗Major updatePlan for change