Wednesday, 20 May 2026

Endpoint Privilege Management reports now require explicit View Reports permission

The period’s most consequential change is a documented EPM reporting authorization boundary: Device configurations > Read no longer suffices, and report access requires the explicit View Reports permission. Configuration Manager also gained a 2509 rollup with fixes affecting co-managed compliance and deployment, while version 2603 is marked globally available. Intune’s Managed Home Screen guidance added precise authentication-time app-silencing settings. Remaining edits were largely formatting, catalog, link, and terminology maintenance.

• Endpoint Privilege Management · Device security

  EPM reporting access now has an explicit role permission

  The updated EPM reporting guidance requires Endpoint Privilege Management Policy Authoring > View Reports, also called EpmPolicy.ViewReports, for reports in the Intune admin center and Microsoft Graph. Users without the permission receive HTTP 403 responses from the privilegeManagementElevations endpoint. The guidance lists Endpoint Privilege Manager, Endpoint Privilege Reader, Endpoint Security Manager, and Read Only Operator as built-in roles containing it; custom roles must enable the action. It also states that

• Configuration Manager · General

  KB37864969 supersedes the previous Configuration Manager 2509 rollup

  The new Configuration Manager 2509 update rollup supersedes KB36949461 and includes its fixes plus additional ones. Listed issues include incorrect restart errors in Build and Capture task sequences using Windows 11 24H2, Windows 10 IoT Enterprise LTSC 2021 being incorrectly reported as unsupported, application deployments failing with HTTP 404 errors after upgrading to 2509, and Software Center compliance checks that may fail in co-managed environments after an internal service is deprecated in October 2026. The 

• Configuration Manager · General

  Configuration Manager 2603 is marked globally available

  The What's new guidance now states: "As of May 27, 2026, version 2603 is globally available for all customers to install." This is an availability-status change in the documentation, rather than evidence of a new Intune capability.

• Intune · App management

  Managed Home Screen guidance documents authentication-time app silencing

  The Managed Home Screen configuration reference adds a boolean setting, Silence apps while Managed Home Screen requires authentication, whose default is FALSE. When enabled, apps cannot start activities, show notifications, appear in recent apps, or trigger toast, dialog, or ringing alerts while authentication is required; they are automatically unsilenced when the device is unlocked. A bundleArray exclusion setting allows selected packages, such as com.microsoft.emmx in the example, to remain active. This is a new

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.