Wednesday, 29 April 2026

Day in brief

Unlicensed admin access clarified as Apple ADE guidance shifts from profiles to policies

29 April was a documentation-heavy Intune day: all 151 recorded items were updates, with no new, removed, or Message Center entries. Representative diffs show many ordinary edits—Cloud PKI image alt text, link wording, and image syntax—alongside a few operational clarifications. Nothing supplied establishes a new feature launch, preview, GA milestone, or product retirement; the SCEP change retires legacy installation instructions only.

Intune · Fundamentals
Pre-July 2021 tenants face a one-way unlicensed-admin decision
Updated Intune licensing guidance says tenants created after July 2021 support unlicensed administrator access by default, with no action required. Tenants created before July 2021 require Intune licenses unless Allow access to unlicensed admins is enabled, and that setting can't be undone afterward. The guidance also clarifies the 350-admin-per-security-group limit, permits multiple groups, and excludes nested-group members.
Intune · Device enrollment
Apple ADE instructions replace Profiles with Enrollment policies
The iOS/iPadOS ADE procedure now directs administrators to select the Apple mobile tab, choose a token, open Enrollment policies, and use Create policy > iOS/iPadOS. Assignment is labeled Assign policy and the default action is Set Default Policy. This is a published terminology and procedure rewrite, not evidence of a new enrollment capability.
Intune · Device enrollment
Apple ADE guidance specifies tvOS and visionOS 26.0 or later
The updated Apple ADE overview lists tvOS 26.0 or later and visionOS 26.0 or later, replacing the earlier unversioned visionOS entry. Administrators should verify target OS versions against this published guidance; the diff alone does not establish a separate launch or service-side change.
Windows Autopilot · Windows
Windows Autopilot diagnostics adds a Swiss blob endpoint
The Windows Autopilot Diagnostics upload entry now includes lgmsapeswiss.blob.core.windows.net and specifies TCP 443. The page also adds a Diagnostics collection section pointing to device-action network requirements. Review proxy and firewall allowlists where diagnostic collection is filtered; this is an endpoint-documentation update, not evidence of a new feature.
Intune · Fundamentals
Legacy SCEP connector installation steps are deprecated in guidance
The SCEP infrastructure page comments out the old Certificate Connector installation block and labels it deprecated for the new connector and its dedicated install article. Update NDES/SCEP runbooks to follow the current dedicated installation guidance; this retires an old documentation procedure, not the SCEP capability or connector product.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Wednesday, 29 April 2026

Unlicensed admin access clarified as Apple ADE guidance shifts from profiles to policies

151 updates