Thursday, 23 April 2026

Guidance now highlights version-targeted policies for Android direct LOB updates

This was primarily a documentation-clarification period. The most actionable updates cover Android Enterprise direct line-of-business app versioning, macOS Platform SSO enrollment prerequisites, the Microsoft Edge for Business threat-level value, and Microsoft 365 Apps assignment behavior. A new device-security overview and related link cleanup are organizational changes; the supplied evidence does not establish a feature launch, preview, general-availability change, or product retirement.

• Intune · App management

  Updated Android LOB versions need newly targeted app-configuration policies

  The revised Android app-configuration guidance now covers directly deployed LOB apps and says policies associated with a previous app version are not automatically applied after an update. Administrators must create and assign a policy targeting the new version. Direct-LOB app configuration is supported on Android Enterprise fully managed (COBO) and dedicated (COSU) devices, not personally owned work profile or corporate-owned work profile (COPE) devices. This is explicit documentation guidance, not evidence of a 

• Intune · App management

  Direct APK deployment takes precedence over Managed Google Play

  The Android LOB deployment article clarifies that when the same app is deployed through Managed Google Play and as an APK uploaded directly to Intune, the directly uploaded app is installed regardless of the Managed Google Play version. If multiple directly uploaded versions are assigned, the higher version is installed. This documents deployment-selection behavior rather than announcing a new rollout.

• Intune · Device enrollment

  macOS Platform SSO enrollment now lists all required setup components

  The enrollment procedure now states that all of these are required: a Settings Catalog Platform SSO policy, Company Portal deployed as a line-of-business app, and an Automated Device Enrollment profile using Setup Assistant with Modern Authentication and await final configuration enabled. If any step is missing or misconfigured, the configuration fails; the documented recovery procedure removes the existing Platform SSO configuration and reenrolls the device.

• Intune · App management

  Edge app protection now specifies “Secured” for the blocked threat level

  In the Microsoft Edge for Business app protection policy procedure, the documented Max allowed device threat level paired with Block access changed from Medium to Secured. The evidence shows a documentation value update only, so administrators should verify the intended policy configuration rather than infer that the service behavior changed.

• Intune · App management

  Microsoft 365 Apps guidance adds a Word-uninstall assignment example

  The deployment page now gives a concrete example of the existing overwrite rule for multiple required or available assignments: if an earlier Microsoft 365 Apps assignment includes Word and a later assignment omits it, Word is uninstalled. The page explicitly says this condition does not apply to Visio or Project. This is a clarification and example, not evidence of a changed assignment engine.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.