Thursday, 18 June 2026

Android BYOD shifts to Management API as Apple ADE grouping reaches general availability

The 18 June Intune changes are concentrated in enrollment. Personally owned Android work-profile management is moving from the Company Portal and custom-DPC path to Google's Android Management API, with web-based enrollment and an explicit migration path. Intune also says enrollment-time grouping is generally available for new Apple ADE policies on iOS/iPadOS and macOS. Separately, Microsoft 365 Apps policy authoring is moving to the Microsoft 365 Apps admin center, while existing policies remain unchanged. Most other Apple updates align setup procedures with the newer policy-creation experience.

• Intune · Device enrollment

  Personally owned Android work profiles enter the AMAPI migration

  Intune now documents two enrollment paths: Company Portal with the custom DPC is being phased out, while browser-based enrollment uses Android Management API, is the default for new tenants and after migration, and does not require Company Portal for enrollment. The documented migration is to enable web enrollment for new devices and deploy the Move to Android Management API policy for existing enrolled devices.

• Intune · General

  Enrollment-time grouping becomes generally available for new Apple ADE policies

  Intune's What's New entry says enrollment-time grouping is now generally available for Apple automated device enrollment on iOS/iPadOS and macOS. It lets Intune identify a device's Microsoft Entra security group during enrollment so policies, apps, and settings can be applied earlier. The capability is supported in new Apple ADE enrollment policies.

• Intune · Device enrollment

  Apple ADE setup guidance moves from Profiles to Enrollment policies

  The updated macOS automated-enrollment procedure identifies Enrollment program tokens > Enrollment policies as the updated creation experience and says the older Profiles experience will eventually be retired and will not receive new features. It also documents the Device group step: only static Microsoft Entra groups are selectable, and enrollment-time device membership assignment permission in a custom RBAC role under Enrollment programs is required.

• Intune · Device configuration

  Microsoft 365 Apps policy authoring leaves the Intune admin center

  A Message Center plan says that, starting with Intune's June 2026 release, Microsoft 365 Apps policy settings will only be configurable in the Microsoft 365 Apps admin center. Existing policies and functionality remain unchanged, so the immediate task is to update administrative guidance and point future configuration to the other center.

• Intune · Device enrollment

  A new Android re-Workplace Join procedure covers registration drift

  A new how-to addresses Android Enterprise devices that are already enrolled in Intune but have incomplete Azure AD registration, including devices affected by unfinished web enrollment or migration from the custom DPC stack to Android Management API. It directs users to open the enrollment app, select the Workplace Join notification, complete registration, and retry the work app. Work credentials and Microsoft Authenticator are prerequisites; this is an operational troubleshooting procedure, not a separate new-en

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.