Thursday, 21 May 2026

Day in brief

Vulnerability Remediation Agent guidance shifts to readiness checks and identity recreation

The strongest operationally relevant update concerns the Security Copilot Vulnerability Remediation Agent: revised guidance replaces Test run with Run Readiness Check, says runs remain disabled until permissions are delegated and the check succeeds, and removes the documented identity-replacement path. Other substantive updates clarify Microsoft Tunnel for Mobile Application Management and Microsoft Cloud PKI prerequisites, add a new Intune license-assignment procedure, and record Configuration Manager support for SQL Server 2022 compatibility level 160 in version 2603. Much of the remaining supplied material is ordinary link, terminology, layout, or screenshot maintenance. The evidence does not establish a new Intune feature launch, general availability milestone, retirement, or tenant-wide behavior change.

Security Copilot · Troubleshooting
Security Copilot agent setup now uses a readiness gate
The documentation replaces Test run with Run Readiness Check. It says agent runs are disabled until the required permissions are delegated in the Microsoft Entra and Microsoft Defender admin centers and the check succeeds; afterward, the Run button and scheduling option are enabled. The listed permissions now include Security Tasks / read and Organizational / read instead of the earlier Managed apps / read entry. The same guidance says an agent identity cannot be replaced; administrators must remove the agent and,‌
Security Copilot · Tenant administration
Vulnerability Remediation Agent identity replacement is replaced by recreation
The revised agent guidance removes the Create a new agent identity procedure. If an identity problem cannot be resolved, administrators are directed to remove the agent instance and set it up again to provision a new identity; if the identity was accidentally deleted in Entra, recovery should be attempted first. This is a documented operational limitation, not evidence of a newly announced agent feature.
Intune · App management
Tunnel for MAM prerequisites now emphasize platforms and additional licensing
The Microsoft Tunnel for Mobile Application Management prerequisite section now lists Android Enterprise and iOS/iPadOS and points to additional licensing guidance. It replaces the visible minimum-version statements for Android 10.0 or later and iOS 14.0 or later. The diff establishes a documentation rewrite, but not that platform support was expanded, narrowed, or otherwise changed.
Cloud PKI · Fundamentals
Cloud PKI guidance spells out SCEP platforms and CA permissions
Microsoft Cloud PKI documentation now explicitly lists additional licensing, Intune-enrolled Android, iOS/iPadOS, macOS, and Windows devices, and support for the Intune device-configuration SCEP certificate profile. It also documents custom-role permissions for Read CAs, Create certificate authorities, and Revoke issued leaf certificates—the last requiring Read CA—and says scope tags can be assigned to root and issuing CAs. This is a prerequisite and delegated-administration clarification.
Intune · Device enrollment
A new Intune article documents user-license assignment before enrollment
The new Assign Microsoft Intune licenses how-to says every user must have a user license before enrolling devices, and that users receiving Intune app protection policies without enrolling also require an Intune license. It provides the Microsoft 365 admin center path Users > Active users > unlicensed user > Licenses and apps > Intune > Save changes, plus School Data Sync guidance for Intune for Education and the requirement to also assign Intune A Direct.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Thursday, 21 May 2026

Vulnerability Remediation Agent guidance shifts to readiness checks and identity recreation

152 updates