Monday, 27 April 2026

Co-managed compliance faces an October deadline as Configuration Manager 2603 hardens CMG

The most consequential material is a co-management compatibility deadline, not a broad Intune policy rollout. Configuration Manager 2603 is described as an in-console update and brings tighter Network Access Account access, Cloud Management Gateway cipher hardening, and removal of the SQL Server Native Client dependency. In Intune, Autopatch update risk visibility adds device-risk classification for Windows, while Ubuntu 26.04 LTS is supported and Ubuntu 22.04 LTS support ends in August 2026. The supplied evidence does not label the Intune items as preview or generally available. Other entries are largely reference maintenance involving build and file-list details, a regional diagnostics endpoint, and checklist-link edits; notably, 2603 checklist links were changed to the checklist-for-installing-update-2509.md path. Those edits do not establish a product behavior change.

• Configuration Manager · Compliance

  Software Center compliance has an October 2026 co-management deadline

  Changed behavior and lifecycle warning: an internal service required for device compliance checks will be deprecated in October 2026. Afterward, Software Center compliance checks may fail in co-managed environments where the Compliance workload is managed by Intune. The documented prevention is to apply the update before October 2026.

• Configuration Manager · General

  Configuration Manager 2603 is in-console and removes the SQL Native Client dependency

  Release availability and dependency retirement: 2603 is available as an in-console update that can be installed at the top-tier site in a hierarchy. All Configuration Manager components and site roles now remove the dependency on deprecated sqlncli.msi; administrators can safely uninstall sqlncli from site systems, and the product no longer includes it in redistributables.

• Configuration Manager · General

  Network Access Account and CMG receive 2603 security hardening

  Security and behavior changes in 2603 restrict Network Access Account information to supported OSD media task sequence scenarios, add permission requirements, and remove legacy access paths. Cloud Management Gateway instances disable weak DHE cipher suites; remaining suites are TLS 1.3 AES_256_GCM/AES_128_GCM and TLS 1.2 ECDHE. EnableCertPaddingCheck registry keys are also set by default on CMG Virtual Machine Scale Set instances to mitigate CVE-2013-3900.

• Intune · General

  Autopatch update risk visibility adds three Windows risk classes

  New reporting capability: the Autopatch update risk visibility report extends the security update status dashboard with granular patch-compliance and risk insight. It classifies managed Windows devices as Current, Exposed, or Critical and highlights policies contributing to risk, helping administrators identify and remediate issues faster. No preview or general-availability status is stated.

• Intune · General

  Intune adds Ubuntu 26.04 LTS support as 22.04 support ends

  Platform-support change: Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026; devices already enrolled on Ubuntu 22.04 remain enrolled, but users should be notified to upgrade to a supported Ubuntu version. Administrators can identify them under Devices > All devices by filtering for Linux and adding the OS version column.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.