Wednesday, 13 May 2026

Day in brief

Configuration Manager adds an untrusted-domain management point deployment example

The new Configuration Manager article provides a step-by-step proof-of-concept for installing a management point in an untrusted Active Directory domain. In Intune, macOS Platform SSO guidance now specifies the exact Company Portal bundle ID and changes the documented Account Name token. The Multi Admin Approval page adds explicit second-administrator requirements for access-policy changes, while Configuration Manager guidance changes the stated ODBC prerequisite threshold from 18.4.4.1 to 18.4.1.1. The remaining supplied edits are largely link, wording, metadata, or formatting maintenance, making this a guidance-heavy period rather than a feature-release day.

Configuration Manager · General
New Configuration Manager example covers untrusted-domain management point installation
A new step-by-step example shows how to install a Configuration Manager management point on a server in an Active Directory domain with no trust to the site-server domain. The article explicitly limits the scenario to a site system connected to a primary site; secondary sites still require a two-way domain trust. It is presented as a proof-of-concept reference, not as evidence of a newly launched deployment mode.
Intune · Device enrollment
macOS ADE guidance specifies only the Company Portal bundle ID
The Automated Device Enrollment procedure now says the Company Portal line-of-business app's App bundle ID list must contain only `com.microsoft.CompanyPortalMac`; administrators should remove unrelated bundle IDs. This is a configuration-procedure clarification, not a documented change to ADE or Platform SSO availability.
Intune · Apple
The documented Platform SSO Account Name token changes
For **Token To User Mapping** > **Account Name**, the documented value changes from `preferred_username` to `com.apple.PlatformSSO.AccountShortName`. The accompanying explanation still identifies the Microsoft Entra `preferred_username` attribute as the source for the macOS account name, so administrators implementing this mapping should compare their profiles with the revised procedure.
Intune · Windows
Access-policy changes are documented as requiring second-administrator approval
The Multi Admin Approval guidance states that changes to access policies require a second administrator's approval. It also says the automatically protected resource type isn't available as a selectable profile type when creating an access policy. This is security and workflow guidance rather than a new selectable policy type.
Configuration Manager · General
Configuration Manager guidance lowers the stated ODBC prerequisite threshold
The Configuration Manager prerequisite text now says an upgrade is stalled when the ODBC redistributable version is lower than `18.4.1.1`, replacing the previous documented threshold of `18.4.4.1`. The evidence establishes a documentation requirement change, so administrators should verify the installed version against the revised text before an upgrade.