Monday, 27 July 2026

Defender controlled configuration preview makes Intune authoritative for all applicable settings

Most of the 15 entries are documentation maintenance, but the most consequential Intune update documents Controlled Configuration for Microsoft Defender settings (preview). In the Windows Security experience Antivirus profile, the setting makes Intune—or Defender for Endpoint security settings management—the exclusive authority for configured Defender settings and applies secure defaults to unconfigured settings, addressing conflicts with Group Policy, Configuration Manager, third-party tools, and local scripts. The period also adds important Configuration Manager 2603 proxy guidance and expands the documented scope of the Properties Catalog and Windows Sync behavior. Controlled Configuration is explicitly marked preview; no supplied Message Center announcements, retirements, or general-availability notices change that status.

• Intune · Device security

  Controlled Configuration (Device) extends Defender protection beyond tamper protection

  The antivirus policy guidance now documents Controlled Configuration for Microsoft Defender settings (preview) in the Windows Security experience profile, under Defender, as the Controlled Configuration (Device) setting. It locks all applicable settings to Intune-configured values, while unconfigured settings use secure platform defaults. The documented values are Not configured, Off (Default), Tamper Protection (On), and Controlled Configuration (On); the last gives Intune-delivered settings exclusive precedence.

• Intune · Windows

  Properties Catalog guidance expands to registry values and application signals

  The revised article changes the documented scope from hardware information to device properties. It describes collecting selected Windows registry key values, such as configuration settings, application state, and security-posture signals, alongside hardware details, configuration data, and application signals. The prerequisites now state that the feature supports Windows devices managed by Intune, co-managed with Configuration Manager, Microsoft Entra joined, or Microsoft Entra hybrid joined.

• Configuration Manager · Windows

  Configuration Manager 2603 proxy validation requires Local System WinINET

  For Configuration Manager version 2603, Microsoft Entra token validation through MISE runs in the system (Local System) context using the .NET Framework HTTP stack. A management point using a proxy must therefore use the Local System account's WinINET settings. The updated guidance explicitly says that site-system proxy settings and a machine-wide WinHTTP proxy set with netsh winhttp set proxy are not used, and identifies ProxyEnable, ProxyServer, and optional ProxyOverride values or system-context Internet Options

• Intune · General

  Windows Sync is documented as a multi-workload on-demand action

  The Sync article now describes Windows synchronization as covering compliance evaluation, configuration policy processing, app detection and deployment-state updates, script and remediation processing, and other device-management signals. Administrators can track progress through the Device sync status tab. The article explicitly limits this described behavior and tab to Windows devices, making this a documentation clarification rather than evidence of a new sync command.

• Intune · Fundamentals

  Intune servicing guidance warns against blocking ECS communication

  The servicing page now explains that Intune uses Experimentation and Configuration Service (ECS) for service configurations, controlled feature rollouts, and experimentation data. It cautions that disabling required Microsoft cloud-service communication can affect critical service updates, reliability improvements, security mitigations, and feature enablement. The page also states that Intune currently uses controlled feature rollout rather than experimental testing, with a Message Center announcement if that later

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.