Tuesday, 19 May 2026

Day in brief

Intune Multi Admin Approval guidance expands to app-authenticated Graph mutations

19 May’s consequential items center on control-plane security and certificate lifecycle. Intune’s new Multi Admin Approval how-to covers app-authenticated Graph mutations for workloads with configured access policies; Security Copilot in Intune now documents automatic role inheritance from Intune RBAC; and a new Cloud PKI article lays out staged CA renewal. Assignment-filter recommendations and compliance-report warnings are guidance clarifications, not evidence of a new launch, preview, general-availability change, retirement, or compliance-enforcement change. The remaining sampled updates are mainly metadata, link, formatting, or wording maintenance.

Intune · Fundamentals
Multi Admin Approval guidance covers app-authenticated Graph writes
The new Intune how-to says MAA intercepts application-authenticated Microsoft Graph calls when an access policy protects the target. Affected resources include compliance policies, configuration policies, device actions, RBAC, scripts, and Tenant Configuration. Only modifying POST, PATCH, PUT, and DELETE operations are affected; calls without required approval headers return HTTP 403, while GET requests are unaffected. MAA remains opt-in per workload, and applications cannot approve or reject requests, so an admin-
Intune · General
Copilot in Intune inherits access from Intune RBAC by default
When Intune is enabled as a Security Copilot data source, the Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access. All other built-in and custom Intune RBAC roles automatically inherit Security Copilot contributor access. This replaces the previously documented need for a separate Security Copilot or Microsoft Entra role assignment. Existing Intune RBAC permissions and scope tags still limit available data and actions.
Cloud PKI · General
Cloud PKI renewal guidance documents staged CA versioning
A new Cloud PKI how-to says renewal creates a new CA certificate and always generates a new public/private key pair; certificates and CRLs from earlier CA versions remain available. Renewal can be performed in the Intune admin center or through Microsoft Graph and applies to Intune-managed and BYOCA issuing CAs. A CA becomes eligible at half its validity lifetime or after expiry. The required permissions are Read CAs and Create certificate authorities (CAs). Expired CAs can be renewed, but issuance remains####un?
Intune · Fundamentals
Assignment filters are preferred for Intune-only property targeting
Expanded performance guidance recommends assignment filters instead of dynamic device groups when Intune policies or apps target device properties such as OS type, manufacturer, model, ownership, or category. Filters evaluate at device check-in without group membership processing; the example replaces a Windows dynamic group with an All devices assignment and the filter `operatingSystemSKU -eq "Windows"`. Dynamic groups remain necessary for Conditional Access, licensing, Autopilot profile targeting, and user-based‌
Intune · Device security
Compliance reports add security guidance for device-reported values
Updated Intune guidance says some compliance reports include a Setting value column containing information reported directly by the device, including in custom compliance and Android app configuration scenarios. Device-side logic, such as an application or admin-supplied script, generates the content; Intune does not validate or enforce it. Use the value for context only, never as the sole basis for administrative action, independently verify links or files before interacting with them, and avoid sharing values if5

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 19 May 2026

Intune Multi Admin Approval guidance expands to app-authenticated Graph mutations

116 updates