Tuesday, 12 May 2026

Day in brief

Agentic identity and device-based Conditional Access guidance sharpen Intune setup requirements

This was primarily a documentation-maintenance day, with one substantive new how-to and one retired page. The strongest administrator-facing changes are the new device-based Conditional Access procedure, revised Vulnerability Remediation Agent identity guidance, and explicit custom-compliance script prerequisites. The agent remains documented as limited public preview for selected customers and public-cloud-only; the update is not a general-availability announcement. Most other edits are terminology, formatting, screenshot, or metadata corrections.

Intune · Device security
Device-based Conditional Access gets a dedicated setup procedure
A new Intune how-to documents a two-phase process: configure compliance policies in Intune, report compliance to Microsoft Entra ID, and then create the Conditional Access policy in Entra through the Intune admin center. It specifies a Microsoft Entra ID P1 or P2 license, a Security Administrator or Conditional Access Administrator role, and compliance policies as prerequisites. This is a new guidance page, not evidence of a new Conditional Access capability launch.
Security Copilot · Troubleshooting
Vulnerability Remediation Agent guidance adds agentic-identity operations
The revised operations guidance says the agent runs under an agentic identity rather than the Intune administrator account used for setup. It adds identity management, including creating a new agent identity, and a Test run to verify delegated permissions before execution. It also states that authentication expires after 90 consecutive days without a run until the identity is renewed.
Intune · Device security
Custom compliance scripts now spell out JSON and scope-tag prerequisites
The Create Custom Script guidance now shows `return $hash | ConvertTo-Json -Compress` as the script’s last line so output is compressed into one line. It explicitly says the upload workflow does not support scope tags and that authors must have the default scope tag to create, edit, or view custom compliance discovery scripts. This is a documentation clarification with direct authoring and delegation impact, not evidence of a script-engine change.
Intune · Device security
Compliance-policy example clarifies highest-severity device status
The Create Policy example now states that when assigned policies have Unknown severity 1, Compliant severity 3, and InGracePeriod severity 4, the device receives the InGracePeriod status. The change clarifies how to interpret the example’s device-level result; it does not indicate that the compliance evaluation behavior changed.
Intune · Device security
Older app-based Conditional Access how-to is retired from Learn
The page identified as Create App Based Policy was removed, including its step-by-step procedure for configuring app-based Conditional Access. This is a documentation-page retirement only; the supplied evidence does not show that app-based Conditional Access itself was retired.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 12 May 2026

Agentic identity and device-based Conditional Access guidance sharpen Intune setup requirements

47 updates