Friday, 17 April 2026

Day in brief

Managed Home Screen guidance warns Overview can expose Android system settings

17 April was mainly a documentation-maintenance day: 90 updates and one removal, with representative diffs dominated by link and path corrections. The administrator-relevant exceptions are added Android kiosk security warnings and a macOS Platform SSO re-registration note. The Security Copilot change removes an agents requirements page, but the supplied evidence does not show a product retirement or a licensing or availability change. Nothing supplied indicates a feature launch, preview, or general-availability announcement.

Intune · App management
Managed Home Screen is documented as insufficient by itself for kiosk lockdown
The updated Configure Managed Home Screen page warns that Managed Home Screen provides a controlled experience but does not, by itself, block access to all Android system features. It says kiosk security depends on the combination of Managed Home Screen settings and device configuration restrictions, and advises administrators to ensure users cannot access system settings, modify network or security configuration, or perform a device reset. This is added security guidance, not evidence of a product behavior change.
Intune · Android
Overview and device-settings controls now carry a specific Android kiosk warning
The updated Android Enterprise device restrictions reference retains the behavior that enabling the Overview button lets users skip or ignore sign-in and session PIN screens, while adding IMPORTANT and WARNING callouts. If End-user access to device settings is not explicitly blocked, users may be able to access Android system settings, change network or security configuration, or perform a full device reset. Check both controls in profiles where that access is not intended; this is a documentation clarification and
Intune · Apple
macOS Platform SSO profile edits are documented to trigger re-registration
A new note in Configure Platform SSO for macOS says that, after successful PSSO registration, updating Platform SSO > Authentication Method or Platform SSO > Use Shared Device Keys in the same profile causes device re-registration. For all other settings, removing and re-targeting the profile causes device re-registration. This clarifies behavior administrators should account for when modifying or redeploying profiles.
Security Copilot · General
Security Copilot agents requirements page is removed from Learn
The sole removal is ref-requirements.md, a Security Copilot page covering Microsoft Security Copilot agents in Intune, including the Vulnerability Remediation Agent, licensing, permissions, RBAC, plugins, and its manual trigger. The evidence establishes page removal only; it does not establish agent retirement or a change to licensing or availability.
Intune · General
Education setup references switch to reorganized Intune management paths
The updated Setup Intune page replaces links for Company Portal configuration, Terms and conditions, Windows automatic enrollment, Enrollment Status Page, Apple MDM push certificates, Apple VPP, Automated Device Enrollment, licensing, and enrollment restrictions with paths under app-management, device-enrollment, and fundamentals. The diff shows navigation maintenance, not a change to settings, prerequisites, or enrollment behavior.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Friday, 17 April 2026

Managed Home Screen guidance warns Overview can expose Android system settings

91 updates