Friday, 24 July 2026

Samsung Knox E-FOTA guidance highlights firmware campaigns, targeting performance, and EPM scope tags

This was a documentation-led period with two new Intune articles and 18 updates, but no Message Center notices or retirements. The most substantive additions document Samsung Knox E-FOTA integration prerequisites and capabilities, introduce a broader targeting-method framework, warn against inefficient dynamic-group rules, and record an Endpoint Privilege Management scope-tag limitation. Other changes mainly clarify navigation, external links, dates, and related content; the new Samsung article does not by itself establish a separate preview or general-availability announcement.

• Intune · Endpoint analytics

  Samsung Knox E-FOTA integration gets a new Intune setup article

  The new how-to documents an integration that, according to the article, can launch, manage, and monitor Samsung firmware campaigns from the Intune admin center; lock devices to an OS version or selected firmware; and schedule download and installation windows. It says deployments require a Samsung Knox E-FOTA license and at least Microsoft 365 E3, support Android Enterprise corporate-owned dedicated, fully managed, and COPE enrollment types, and require an Intune Administrator plus a Samsung Knox administrator for-

• Intune · Device enrollment

  A new guide separates group scope from Intune policy targeting

  The new targeting guide recommends starting with a broad audience and refining it with assignment filters, rather than creating many policy-specific groups. It distinguishes groups, which define the audience, from filters, which determine which devices in that audience receive a policy, and says group membership is processed when identity attributes change while filters evaluate at each device check-in. This is targeting guidance, not evidence of a new targeting behavior.

• Intune · Fundamentals

  Intune guidance says to avoid memberOf in dynamic group rules

  The performance guidance now explicitly says not to use the memberOf operator in dynamic group rules. It recommends direct comparisons such as -eq, -startsWith, and -in, explaining that transitive membership lookups can add significant processing complexity and, in large environments, lead to long evaluation times or unexpected results. Where possible, it suggests using a direct device property or an assignment filter instead.

• Endpoint Privilege Management · Windows

  EPM scope tags remain unsupported by two documented roles

  The known-issues page states that the built-in Endpoint Privilege Manager role and the custom Endpoint Privilege Management Policy Authoring role do not support scope tags. The documented workaround for restricting an administrator's view with scope tags is to grant permissions that include Read for Device configurations.

• Intune · Device enrollment

  Apple token procedures now use the Apple enrollment tab

  The token-management procedure replaces the Intune Apple mobile tab with the Apple tab. For renewal, it now directs administrators to Apple Business's Devices and Management Services areas, or Apple School Manager's Preferences and Your MDM servers areas, then to the relevant service or server and Download Token; in Apple Business, Download Token is under the top-right Actions menu. This is a procedural and terminology clarification rather than evidence of a product behavior change.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.