Monday, 18 May 2026

Day in brief

Certificate Connector 6.2510.3.3007 requires updating as Apple enrollment grouping guidance expands

18 May was entirely documentation-led: all 100 recorded items were updates, with no new or removed entries and no message-center announcements. The most consequential guidance covers a Certificate Connector security-and-maintenance release, expanded documented scope for enrollment-time grouping across Apple automated device enrollment, and a staged macOS Platform SSO setting rollout. No supplied item establishes a new preview, general-availability announcement, retirement, or broader product behavior change. Many other edits are mechanical, including Configuration Manager and Windows Autopilot metadata changes, Defender link and terminology updates, and cloud-native endpoint tutorial renaming.

Intune · Fundamentals
Certificate Connector 6.2510.3.3007 records security fixes and an update requirement
The Intune Certificate Connector history records version 6.2510.3.3007 with bug fixes and security improvements. It also says the connector must be updated automatically or manually to help ensure uninterrupted certificate issuance and management. This is release and maintenance guidance, not a stated GA or retirement event.
Intune · Device enrollment
Enrollment-time grouping guidance now lists iOS/iPadOS and macOS ADE
The updated Intune guidance now lists iOS/iPadOS and macOS automated device enrollment for enrollment-time grouping. For iOS/iPadOS, it specifies Setup Assistant with modern authentication and Company Portal for enrollment with user affinity, plus Microsoft Entra shared mode and shared iPad without user affinity. For macOS, it lists Setup Assistant with modern authentication for user affinity and enrollment without user affinity. The required enrollment time device membership assignment permission is located in a
Intune · Device enrollment
macOS ADE setup documents strict limits on the Device group tab
The macOS ADE procedure documents an optional Device group tab for selecting a Microsoft Entra security group for enrollment-time grouping. The group maps directly to the enrollment policy and can be edited after policy creation, but the tab is available only in new enrollment policies, not existing enrollment profiles. Only static groups are selectable, and configuration requires the enrollment time device membership assignment permission in a custom RBAC role under Enrollment programs.
Intune · Device enrollment
macOS Platform SSO first-user creation setting has staged May timing
The Platform SSO guidance says **Enable Create First User During Setup** is rolling out slowly and should be available by the end of May 2026. The wording describes a staged rollout, not a general-availability announcement; administrators should verify that the setting is present before building it into macOS ADE plans.
Intune · Device security
Workspace ONE compliance partner selection now uses the Omnissa name
For iOS/iPadOS and Android compliance partners, the documented selection changes from **VMware Workspace ONE mobile compliance** to **Omnissa Workspace ONE UEM**. The diff establishes a selector-label and terminology change, but does not indicate changed compliance behavior or an impact to existing configurations.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Monday, 18 May 2026

Certificate Connector 6.2510.3.3007 requires updating as Apple enrollment grouping guidance expands

100 updates