Monday, 11 May 2026

Windows Autopilot automatic Cloud PC provisioning reaches general availability

The period’s main rollout is general availability for Windows Autopilot device preparation in automatic mode for Windows 365 Enterprise, Windows 365 Frontline dedicated and shared, and Windows 365 Cloud Apps. Policies can provision apps, scripts, and configurations when a Cloud PC is created; Windows 365 Reserve remains in public preview. Other notable updates document deployment-log retention, a Configuration Manager rollup caveat, and Intune compliance and Android app-reporting guidance.

• Windows Autopilot · Device enrollment

  Automatic-mode device preparation is generally available for Windows 365 Cloud PCs

  Windows Autopilot device preparation policies can now be included in Cloud PC provisioning policies for Windows 365 Enterprise, Windows 365 Frontline dedicated and shared, and Windows 365 Cloud Apps. Policies apply when a Cloud PC is created and deliver apps, scripts, and configurations before user sign-in. Windows 365 Reserve remains in public preview.

• Windows Autopilot · Device enrollment

  Autopilot deployment records are automatically cleaned up after 28 days

  The reporting guidance specifies that deployment records created after automatic cleanup was introduced are removed every 28 days. Older Windows 365 records are not covered by automatic cleanup and require one-time manual removal; administrators should preserve any history they still need before cleanup.

• Configuration Manager · Compliance

  Configuration Manager 2509 rollup documents two fixes it can overwrite

  The rollup’s known-issues section says KB 36419072, the offline feedback update, and KB 36495448, the co-management and third-party update scan source fix, are not included. Installing the rollup overwrites changes from either fix if it was previously installed individually; both are planned for a future rollup.

• Intune · Device security

  Clear replaces Secured as the strictest mobile threat-defense threshold

  The Intune compliance-policy guidance now labels the most secure MTD threat level as Clear rather than Secured. Clear means the device cannot have any threats present; any detected threat makes the device noncompliant. This is a terminology correction in the guidance, not evidence of changed enforcement behavior.

• Intune · App management

  Android Enterprise LOB app status reports may misstate conflicts

  Directly deployed Android Enterprise line-of-business apps still install correctly, but the Intune admin center can show a lower app version as Installed instead of In-Conflict, show a matching Managed Google Play app as Waiting for install or omit it, and report mixed Install and Uninstall intents inconsistently. Verify the app on the device rather than treating these status displays as installation failures.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.