Tuesday, 26 May 2026

Day in brief

Device-based Conditional Access guidance spells out licensing and RBAC prerequisites

26 May’s most consequential Intune changes are in guidance rather than an announced service rollout. A new device-based Conditional Access how-to defines the Microsoft Entra license, administrator roles, and setup sequence; compliance references revise the stated iOS and Linux platform baselines; Cloud PKI guidance adds platform and CA-permission detail; and the Vulnerability Remediation Agent is described as public preview instead of limited public preview. Most other edits standardize requirements layouts, terminology, and links, so they should not be read as tenant-behavior changes without separate product evidence.

Intune · Device security
New how-to defines the device-based Conditional Access setup sequence
The new Intune guide describes two phases: configure Intune compliance policies so they report device status to Microsoft Entra ID, then create the Conditional Access policy. It requires a Microsoft Entra ID P1 or P2 license and either the Security administrator or Conditional Access administrator role. The page also confirms that the Conditional Access node in the Intune admin center is the same node used in Microsoft Entra ID. This is a new how-to page, not evidence of a newly launched Conditional Access feature.
Security Copilot · Fundamentals
Vulnerability Remediation Agent guidance now says public preview
The Security Copilot guidance replaces wording that called the Vulnerability Remediation Agent a limited public preview available only to selected customers with a statement that the feature is in public preview. The update does not claim general availability; administrators should continue to treat the agent as a preview capability and consult the public-preview guidance.
Intune · Device security
iOS/iPadOS compliance reference now lists iOS 17.0 and later
The iOS/iPadOS device-compliance settings reference changes repeated support text from iOS 8.0 and later to iOS 17.0 and later across device health, operating-system, and system-security settings. This is a reference-page change; the supplied diff does not establish that existing tenant enforcement or policy assignments changed.
Intune · Device security
Custom-compliance Linux reference replaces RHEL 8 with RHEL 10
The custom-compliance guidance for managed Linux and Windows devices changes its listed Red Hat Enterprise Linux version from RedHat Enterprise Linux 8 to RedHat Enterprise Linux 10. Administrators using Linux custom JSON and discovery scripts should check their support matrix and policy targeting against the revised reference; the evidence does not show an automatic migration of existing policies.
Cloud PKI · Fundamentals
Cloud PKI guidance documents Apple platforms and CA permissions
The Microsoft Cloud PKI overview now describes the service as available through Intune Suite or as a standalone capability, and lists Android, iOS/iPadOS, macOS, and Windows for enrolled devices whose platforms support Intune SCEP certificate profiles. It also documents custom-role permissions for Read CAs, Create certificate authorities, and Revoke issued leaf certificates; revocation additionally requires Read CA, and scope tags can be assigned to CAs. These are updated prerequisite and RBAC details, not annved?

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 26 May 2026

Device-based Conditional Access guidance spells out licensing and RBAC prerequisites

185 updates