Friday, 8 May 2026

Day in brief

Android Strict Tunnel Mode and MTD permissions get sharper Intune guidance

The 8 May feed was documentation-only: all 41 supplied changes updated existing Intune pages, with no new or removed items and no Message Center notices. The consequential edits add explicit guidance for Android threat-defense permissions and Microsoft Tunnel enforcement, while compliance pages sharpen scheduling and platform-version boundaries. The evidence does not classify these updates as previews, general-availability releases, retirements, or confirmed service-behavior changes; much of the remaining work is heading, link, wording, and procedure cleanup.

Intune · Device security
MTD connector guidance documents a one-partner Android role
The updated Intune Mobile Threat Defense connector page documents an optional **Mobile Threat Defense role** toggle for Android Enterprise corporate-owned fully managed and corporate-owned work profile devices. It grants the selected partner enhanced permissions: preventing app suspension and hibernation, exempting the app from power restrictions, and disabling user controls such as clearing app data or force-stopping the app. Only one partner can hold the role per tenant; the connector must be configured, the MTD⁣
Intune · Device security
Microsoft Tunnel guidance defines Strict Tunnel Mode’s Android prerequisites
The Microsoft Tunnel VPN profile guidance says Android Strict Tunnel Mode is available when the connection type is Microsoft Tunnel and Always-on VPN is enabled. It forces all traffic through the tunnel and blocks traffic if the VPN drops until reconnection; an app exclusion list can bypass the tunnel. The listed scope includes Android Enterprise corporate-owned fully managed, corporate-owned work profile, and personally-owned work profile devices, with Android Management API enrollment required; legacy EMM APIxE3
Intune · App management
MAM Tunnel separates Edge-only blocking from enrolled-device blocking
For unenrolled MAM Tunnel devices, the `StrictTunnelMode` Microsoft Edge app-configuration key blocks Edge internet traffic when the MAM Tunnel connection is unavailable. For enrolled devices, Strict Tunnel Mode is configured at the device level in the Microsoft Tunnel VPN profile and applies to all network traffic, not just Edge. Administrators should choose the configuration path based on enrollment state; this is a clarified security procedure, not a stated rollout.
Intune · Device security
Noncompliance schedules use documented 0.25-day admin-center increments
The revised Intune compliance-action guidance says **Schedule (days after noncompliance)** accepts whole numbers and decimal values in 0.25 increments in the admin center: `0.25` equals 6 hours and `0.5` equals 12 hours. Other decimal values, such as `0.33` for 8 hours, must be configured through Microsoft Graph. This clarifies the UI/API procedure rather than announcing a new action.
Intune · Device security
iOS/iPadOS compliance guidance now uses an iOS 17.0 floor
The iOS/iPadOS compliance settings reference changes repeated labels from **iOS 8.0 and later** to **iOS 17.0 and later**. The supplied diff does not establish whether enforcement or underlying service support changed, so administrators should validate the impact on older devices before treating the wording as a retirement or changing policy scope.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Friday, 8 May 2026

Android Strict Tunnel Mode and MTD permissions get sharper Intune guidance

41 updates