Thursday, 7 May 2026

Apple 26.4 deprecates Intune’s legacy Apple Intelligence restrictions for DDM

The day’s meaningful Intune updates are mostly operational guidance rather than launches: Apple’s 26.4 deprecation path for Intelligence controls, an explicit compliance discovery-script output limit, and a higher documented unlicensed-admin group ceiling. Apple Wi-Fi edits add deployment-channel certificate guidance; no supplied item announces an Intune preview or general-availability release.

• Intune · Apple

  Apple Intelligence controls move from MDM restrictions to DDM

  For devices running Apple 26.4 and later, Apple deprecated the intelligence-related settings in the MDM restrictions payload. Intune’s in-development guidance directs administrators to DDM configurations released in March 2026. In the Settings Catalog, examples now marked deprecated include Allow Assistant, Allow Writing Tools, Allow Genmoji, and Force On Device Only Dictation; corresponding Siri and keyboard/dictionary settings are also deprecated in the device restrictions template. The guidance applies to iOS/i​

• Intune · Device security

  Compliance discovery scripts have a documented 2,048-character output limit

  The Create Policy guidance states that discovery script output is limited to 2048 characters. Output beyond that limit may be truncated, producing invalid JSON and error 65009 during compliance evaluation. The documented mitigation is to keep output concise or split large rule sets across multiple policies. This is an operational documentation clarification, not a new policy type.

• Intune · Fundamentals

  Unlicensed-admin group capacity is documented as 1,000

  The Unlicensed Admins guidance changes the per-security-group figure from 350 to 1000 unlicensed admins. If more than 1000 administrators are needed for a role assignment, the guidance says to use multiple security groups. Nested-group members remain excluded, and access changes can still take up to 48 hours. This is a documented capacity and eligibility update.

• Intune · Apple

  Apple Wi-Fi guidance clarifies certificate choices by deployment channel

  The Apple Wi-Fi reference now says certificate profiles must align with the selected deployment channel. When the user channel is selected, certificate options are limited to user certificate profiles; the reference also includes a corresponding device-channel limitation. The edit clarifies SCEP and PKCS certificate selection rather than announcing a new Wi-Fi profile capability.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.