Daily Intune NewsThe substantive story is a planned Microsoft Tunnel traffic-enforcement mode for Android, alongside updated Recovery Lock rollout timing. Most other notable edits are documentation clarifications covering current admin-center paths, RBAC terminology, Platform SSO prerequisites, and Endpoint analytics navigation; the supplied evidence does not show a general-availability launch or changed remote-action semantics.
Intune · Device enrollmentThe In Development entry says Microsoft Tunnel will support Strict Tunnel Mode for Android Enterprise devices enrolled through Android Management API and for unenrolled Android devices using Microsoft Tunnel for MAM. With an Always On VPN profile, the mode will force network traffic through the tunnel and block traffic if the VPN connection is unavailable; admins will be able to define app exclusions. It applies to personally owned and corporate-owned work profiles, corporate-owned fully managed devices, and unenro
The macOS settings catalog guidance now says Recovery Lock is gradually rolling out and that full availability is expected by mid-May 2026, replacing the previous late-April expectation. The diff changes rollout timing guidance, not the setting’s documented behavior.
The macOS scenario guide says admins must configure Platform SSO first, create a Platform SSO settings catalog policy, and add scenario settings to that existing policy because only one SSO policy can be assigned to a group. This clarifies procedure and prerequisites rather than announcing a new Platform SSO capability.
Intune · Tenant administrationThe procedure now lists Intune Administrator and a custom role instead of Intune Service Administrator and a custom role. It also spells out the path as Devices > Organize devices > Device cleanup rules with direct admin-center links. The diff shows documentation terminology and navigation changes, not a confirmed backend RBAC change.
Intune · Endpoint analyticsThe Configure page changes Reports > Analytics > Endpoint analytics to Reports, then under Analytics, Endpoint analytics, and changes Devices > Configuration profiles to Devices > Configuration. Direct links to those locations were added. This is an admin-center navigation clarification, with no evidence of a feature or permission change.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The Remote lock procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, Endpoint Security Manager, or a custom role as the supported role destinations.
The Restart procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, Endpoint Security Manager, or a custom role as the supported role destinations.
The restart procedure now uses direct Devices and All devices navigation and current Help Desk Operator, School Administrator, Endpoint Security Manager, and custom-role references.
The shutdown procedure now directs operators to Devices and All devices and presents Help Desk Operator, School Administrator, Endpoint Security Manager, and custom roles directly.
Replaces reference-style Intune admin center and role links with direct Devices > All devices links and named Help Desk, School Administrator, Endpoint Security Manager, and custom-role links.
The Fresh Start procedure now points directly to Devices and All devices and provides direct links for Help Desk Operator, School Administrator, Endpoint Security Manager, and custom roles.
The Full scan procedure replaces indirect portal references with direct Intune admin center links for Devices and All devices, and direct role links for Help Desk Operator, Endpoint Security Manager, and custom roles.
The Quick scan procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, Endpoint Security Manager, or a custom role as the supported role destinations.
The Retire procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
The BitLocker key rotation steps now point directly to Devices and All devices and identify Help Desk Operator, Endpoint Security Manager, and custom roles as the role references.
The FileVault recovery-key procedure now links directly to Devices and All devices and identifies Help Desk Operator, Endpoint Security Manager, and custom roles.
Fresh Start instructions replace reference-style role and navigation links with direct Intune admin-center links.
The rename procedure now points directly to Devices and All devices and to current Help Desk Operator, School Administrator, and custom-role definitions.
The Reset passcode procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
Autopilot Reset documentation replaces reference-style links with direct Intune admin-center Devices and All devices links.
Changes Autopilot Reset link-section comments and removes .md from built-in-role link targets.
Delete action instructions replace reference-style role and admin-center navigation links with direct links.
Deprovision action instructions replace reference-style role and navigation links with direct Intune admin-center links.
Both enable and disable Lost Mode steps now link directly to Devices and All devices, with direct Help Desk Operator, School Administrator, and custom-role references.
The Rename procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
Replaces reference-style role and admin-center links with direct Microsoft Intune admin center, Devices, and All devices destinations.
Replaces reference-style role and admin-center links with direct Microsoft Intune admin center, Devices, and All devices destinations.
Disable Activation Lock instructions replace reference-style links with direct Intune admin-center and role links.
The Locate device procedure replaces generic portal and relative RBAC references with direct Devices and All devices links plus direct Custom role, Help Desk Operator, and School Administrator links.
The supervised-device sound procedure now links directly to Devices and All devices and to Help Desk Operator, School Administrator, and custom-role definitions.
The Remove apps and configuration procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
The Remove passcode procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
The Restore Managed Home Screen procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator, School Administrator, or a custom role as the supported role destinations.
The custom notification procedure now leads directly to Devices and All devices and provides direct role references for Help Desk Operator and custom roles.
The suspension procedure now points directly to Devices and All devices and names Help Desk Operator, School Administrator, and custom roles.
Updated Microsoft Intune documentation in intune/device-management/actions/wipe.md.
The shared-device logout procedure now links directly to the Devices and All devices pages and to Help Desk Operator and custom-role definitions.
The Remove user procedure replaces generic portal references with direct Microsoft Intune admin center links for Devices and All devices, and names Help Desk Operator or a custom role as the supported role destinations.
The enable and disable Lost Mode procedures now point directly to Devices and All devices and provide direct links for Help Desk Operator, School Administrator, and custom roles.
The procedure now links directly to Devices and All devices and names Intune Administrator and custom-role destinations; its 1,440-minute maximum remains documented.
Updated Microsoft Intune documentation in intune/device-management/actions/rotate-local-admin-password.md.
The macOS Recovery Lock procedure now uses direct Devices and All devices navigation and includes direct links for Intune Administrator, custom, Help Desk Operator, and School Administrator roles.
Updated Microsoft Intune documentation in intune/privacy/data-handling/data-storage-processing.md.
The device-action overview adds direct links for All devices, Device actions, Devices, and Bulk device actions instead of generic portal destinations.
The local administrator password procedure now directs admins through Devices and All devices and provides the custom-role destination for Remote tasks/Rotate Local Admin Password.
Updated Microsoft Intune documentation in intune/whats-new/in-development.md.
Updated Microsoft Intune documentation in intune/device-enrollment/configure-multifactor-authentication.md.
Updated Microsoft Intune documentation in intune/whats-new/in-development.md.
Updated Microsoft Intune documentation in intune/device-enrollment/setup-notifications.md.
Updated Microsoft Intune documentation in intune/device-enrollment/setup-time-grouping.md.
Updated Microsoft Intune documentation in intune/device-enrollment/windows/attestation.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-web-based-ios.md.
Updated Microsoft Intune documentation in intune/device-enrollment/add-corporate-identifiers.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-account-service-access.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-configurator-ios.md.
Updated Microsoft Intune documentation in intune/device-enrollment/add-corporate-identifiers.md.
Updated Microsoft Intune documentation in intune/device-enrollment/windows/create-bulk-package.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-macos.md.
Updated Microsoft Intune documentation in intune/device-enrollment/setup-enrollment-manager.md.
Updated Microsoft Intune documentation in intune/device-enrollment/create-device-limit-restrictions.md.
Updated Microsoft Intune documentation in intune/device-enrollment/create-device-limit-restrictions.md.
Updated Microsoft Intune documentation in intune/device-enrollment/create-device-limit-restrictions.md.
Updated Microsoft Intune documentation in intune/device-enrollment/create-device-limit-restrictions.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-macos.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-web-based-ios.md.
Updated Microsoft Intune documentation in intune/device-enrollment/setup-time-grouping.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-macos.md.
The retirement procedure now uses direct Devices and All devices navigation and current Help Desk Operator, School Administrator, and custom-role references.
The Remote lock procedure now points directly to Devices and All devices and to current Help Desk Operator, School Administrator, Endpoint Security Manager, and custom-role definitions.
The FileVault recovery-key procedure now points directly to Devices and All devices and current Help Desk Operator, Endpoint Security Manager, and custom-role references.
The BitLocker key rotation procedure now points directly to Devices and All devices and current Help Desk Operator, Endpoint Security Manager, and custom-role references.
Updated Microsoft Intune documentation in intune/device-management/actions/shutdown.md.
The Locate device procedure now points directly to Devices and All devices and provides direct links for Help Desk Operator, School Administrator, and custom roles.
The passcode-reset procedure now points directly to Devices and All devices and to current Help Desk Operator, School Administrator, and custom-role definitions.
Changes Delete action link-section comments and removes .md from role-reference link targets.
The Activation Lock removal procedure reorganizes Intune admin center and role link references without changing the action flow.
The pause workflow now uses direct Devices and All devices navigation and directs Intune Administrator and custom-role references to their current destinations. The documented maximum pause remains 1,440 minutes.
The removal procedure now provides direct Devices and All devices navigation and current Help Desk Operator, School Administrator, and custom-role references.
Updated Microsoft Intune documentation in intune/device-management/actions/rotate-recovery-lock-passcode.md.
Updated Microsoft Intune documentation in intune/device-management/actions/suspend-managed-home-screen.md.
Updated Microsoft Intune documentation in intune/device-management/actions/sync.md.
The passcode-removal procedure now directs operators to Devices and All devices and to current Help Desk Operator, School Administrator, and custom-role definitions.
The restoration procedure now points directly to Devices and All devices and current Help Desk Operator, School Administrator, and custom-role definitions.
The deprovisioning procedure reorganizes its Intune admin center and role link references without changing the deprovisioning steps.
The supervised-device sound procedure now uses direct Devices and All devices navigation and current Help Desk Operator, School Administrator, and custom-role references.
Updated Microsoft Intune documentation in intune/device-management/actions/send-custom-notification.md.
Updated Microsoft Intune documentation in intune/device-management/actions/update-cellular-data-plan.md.
Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/configure-platform-sso-macos.md.
Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/configure-platform-sso-scenarios-macos.md.
The shared-device user-removal procedure now provides direct Devices and All devices navigation and current Help Desk Operator and custom-role references.
The Logout current user procedure now points directly to Devices and All devices and provides direct links for Help Desk Operator and custom roles.
Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/configure-recovery-lock-macos.md.
Updated Microsoft Intune documentation in intune/whats-new/index.md.
Changes Endpoint analytics role references from relative ../fundamentals paths to absolute /intune/fundamentals paths for Help Desk, School Administrator, Read Only Operator, Endpoint Security Manager, and custom roles.
Changes Endpoint analytics role references from relative ../fundamentals paths to absolute /intune/fundamentals paths for Help Desk, School Administrator, Read Only Operator, Endpoint Security Manager, and custom roles.
Updated Microsoft Intune documentation in intune/endpoint-analytics/configure.md.
Updated Microsoft Intune documentation in intune/endpoint-analytics/index.md.
Updated Microsoft Intune documentation in intune/endpoint-analytics/index.md.
Updated Microsoft Intune documentation in intune/endpoint-analytics/index.md.
Removes the obsolete Graph link reference block and renames the admin-center link section in Collect diagnostics documentation.
Collect diagnostics instructions replace reference-style links with direct Intune admin-center navigation links.
The remediation procedure now points directly to Devices and All devices and identifies Help Desk Operator, School Administrator, and custom roles for the Run Remediation action.
Updated Microsoft Intune documentation in intune/device-management/actions/run-remediation.md.
The Full scan procedure now points directly to Devices and All devices and provides direct links for Help Desk Operator, Endpoint Security Manager, and custom roles.
The Quick scan procedure now directs operators to Devices and All devices and to current Help Desk Operator, Endpoint Security Manager, and custom-role definitions.
Updated Microsoft Intune documentation in intune/privacy/enable-windows-diagnostic-data.md.
Changes Windows diagnostic-data custom-role and Help Desk Operator links from relative paths to absolute /intune/fundamentals paths.
Changes cleanup-rule role references from relative paths to absolute /intune/fundamentals paths for Help Desk, School Administrator, Endpoint Security Manager, and custom roles.
Updated Microsoft Intune documentation in intune/governance/configure-cleanup-rules.md.
Updated Microsoft Intune documentation in intune/governance/configure-cleanup-rules.md.
Updated Microsoft Intune documentation in intune/privacy/index.md.
Removed Microsoft Intune documentation in intune/governance/compliance-and-regulatory-alignment.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-macos.md.
Updated Microsoft Intune documentation in intune/device-security/microsoft-tunnel/upgrade.md.
Updated Microsoft Intune documentation in intune/privacy/data-handling/data-storage-processing.md.
The checklist changes early update ring wording from “opt-in” to “opt in” without changing the described process.
Expands the CMGv2 acronym in the outbound-traffic alert and Total Outbound data metric description to Azure Virtual Machine Scale Sets.
Converts numbered Notes, included hotfixes, and dependency changes into bullet lists; the listed KBs and dependencies remain the same.
The Remote Assist procedure now uses direct Intune navigation for Devices and All devices and current role references.
Updated Microsoft Intune documentation in intune/advanced-analytics/device-scopes.md.
Updated Microsoft Intune documentation in intune/advanced-analytics/device-scopes.md.
Updated Microsoft Intune documentation in intune/advanced-analytics/device-query-multiple-devices.md.
Updated Microsoft Intune documentation in intune/advanced-analytics/device-query.md.
Device Scopes documentation changes links for custom roles and built-in operator roles to absolute Intune paths.
Device Query documentation changes custom-role and Help Desk Operator links to absolute Intune paths.
Device Query multiple-devices documentation changes custom-role and Help Desk Operator links to absolute Intune paths.
