Tuesday, 23 June 2026

Day in brief

Multi Admin Approval now gates app-only Intune Graph mutations

The period’s clearest operational change is Multi Admin Approval enforcement for app-authenticated Microsoft Graph calls: tenants with active MAA access policies can now require approval for automation modifying protected Intune resources. Other substantive items include a changed Microsoft 365 Copilot mobile control path, a Microsoft 365 packaging rollout, and a planned macOS Wi-Fi setting for MAC randomization. Most remaining updates are documentation maintenance, including icon substitutions, wording changes, and standardized prerequisite blocks rather than new product behavior.

Intune · Fundamentals
Automation must now satisfy MAA approval enforcement
Changed behavior for tenants with MAA access policies: app-authenticated calls from service principals, scripts, and third-party applications are intercepted when they modify protected Intune resources. POST, PATCH, PUT, and DELETE calls without the required approval headers return HTTP 403; read-only GET calls are unaffected. Protected resource types include compliance and configuration policies, device actions, RBAC, scripts, and tenant configuration. Only interactive administrators can approve or reject requests
Intune · App management
The former Copilot mobile app-configuration switch is retired
Changed behavior and guidance: the com.microsoft.office.officemobile.BingChatEnterprise.IsAllowed key is no longer a control for independently enabling or disabling Copilot in the Microsoft 365 mobile app. The page says Microsoft 365 is now Microsoft 365 Copilot, with Copilot as a core mobile workflow. To restrict access, administrators should use Integrated Apps settings for web, desktop, and mobile, or block the Microsoft 365 Copilot mobile app for mobile-only restriction
Endpoint Privilege Management · App management
Microsoft 365 packaging rollout adds security and Intune changes
A Message Center major update says the 2026 Microsoft 365 Packaging Update is rolling out from mid-June through early August. It adds features including Microsoft Defender Plan 1, URL time-of-click protection, Intune improvements, and 50 GB of additional Exchange Online storage. Microsoft 365 Business SKU backfill is scheduled to complete by September 30, and administrators are told to review and configure new policies
Intune · General
macOS Wi-Fi gains a planned MAC-randomization control
In-development capability: Intune Wi-Fi profiles are planned to gain Disable MAC address randomization for managed macOS devices running macOS 15 and later. The setting addresses environments such as network access control that rely on a static MAC address, although randomized MAC addresses remain recommended for privacy. The evidence gives no general-availability date
Intune · Windows
DFCI guidance warns against mixing microphone setting categories
Documentation clarification, not a reported product behavior change: the Windows DFCI guidance now says to configure either the Microphones and speakers category or the Microphones granular settings, not both, because combining them can cause a conflict. It also clarifies that Only not configured allows local changes except where Intune explicitly sets Enable or Disable, while None prevents changes to any UEFI or BIOS setting, including settings not shown in the profile

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Tuesday, 23 June 2026

Multi Admin Approval now gates app-only Intune Graph mutations

45 updates