Wednesday, 24 June 2026

Trustd Mobile integration, required-app auto-updates, and baseline changes headline Intune guidance

The substantive updates center on newly documented Trustd Mobile Mobile Threat Defense integration, Enterprise App Catalog auto-update rules, and security-baseline revisions. Trustd Mobile guidance covers risk-driven compliance and Conditional Access for Android 9.0 and later and iOS/iPadOS 15.0 and later; Enterprise App Catalog auto-update is scoped to Windows 10 and Windows 11 apps with Required assignments. The Microsoft 365 Apps security baseline 2512 replaces version 2306, while older Windows 25H2 profiles need an edit-and-save to receive the newly added IE11 COM-automation control. Intune also documented self-service compliance-partner onboarding; other notable clarification includes Remote Help's different control scope for AVD desktop and RemoteApp sessions.

• Intune · Device security

  Trustd Mobile integration is newly documented for Intune MTD

  New guidance describes Trustd Mobile sending a risk score through the Intune Mobile Threat Defense connector; the score updates device compliance and can drive Conditional Access blocking. The documented scope is Android 9.0 and later and iOS/iPadOS 15.0 and later, with Microsoft Entra ID P1, Intune Plan 1, a Trustd Mobile subscription, and the Trustd Mobile app required. This is newly added integration guidance, not a supplied GA announcement.

• Enterprise App Management · App management

  Enterprise App Catalog auto-update is documented for Required assignments

  The updated Enterprise App Management guidance says Intune can automatically update Enterprise App Catalog apps when a newer catalog version is available, without creating a new app or configuring supersedence for each update. The scope is Windows 10 and Windows 11 devices and apps with a Required assignment; Available for enrolled devices assignments retain the existing update workflow. Guided update supersedence remains an option for administrators who want to review updates before applying them.

• Intune · Device security

  Microsoft 365 Apps security baseline 2512 replaces version 2306

  The settings reference identifies Version 2512 as first made available in June 2026 and states that it replaces Version 2306. Listed defaults include Block Flash activation in Office documents set to Enabled and Restrict legacy JScript execution for Office set to Enabled. Microsoft directs administrators to the Security Compliance Toolkit's Microsoft 365 Apps for Enterprise 2512.zip for the complete settings list.

• Intune · Device security

  Older Windows 25H2 profiles need saving for the new IE11 control

  The Windows security baseline guidance says Disable Internet Explorer 11 Launch Via COM Automation was added in the June 2026 service update with an Enabled baseline default. Profiles created before the update do not apply it automatically: edit and save the profile, after which Intune deploys the setting at the next device check-in. Newly created or updated-to-25H2 profiles include the setting by default.

• Intune · Device security

  Self-service compliance partners gain a custom connector path

  Intune guidance now describes compliance partners onboarding and publishing their own connectors. Once a partner connector is available, administrators select Custom MDM Compliance Partner and enter the partner-provided Custom MDM Compliance Partner Entra Application ID. Configuration cannot be completed unless the ID belongs to a valid onboarded partner, and partner availability depends on completed onboarding and connector publication.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.