Friday, 7 August 2026

The documentation now states that apps targeting Android Enterprise fully managed (COBO) and corporate-owned personally enabled (COPE) devices can use Available assignments for either user or device groups, alongside the existing Win32 exception.

The article now only directs administrators to the iOS app configuration policy guidance; the Sophos Intercept X for Mobile iOS reference link was removed.

The Android managed apps documentation now describes the Azure Information Protection mobile apps without the Google Play link.

The BlackBerry Intune integration page no longer includes the link to BlackBerry UES documentation.

The protected apps reference no longer includes the Klaxoon for Intune listing.

The licensing documentation now explains that eligible shared-device and no-user-affinity enrollment scenarios support device-targeted management through a device-only subscription. It also states that an unlicensed signed-in user doesn't prevent device-targeted policies, apps, or management actions from processing.

The macOS ADE guidance warns not to target profiles that enable PSSO registration during Setup Assistant to userless ADE devices, because this can cause unexpected enrollment behavior and loss of expected device affinity.

The guidance now links to the general Android and iOS store-app instructions without including direct CylancePROTECT Play Store or App Store URLs.

The documentation now states that enrollment time grouping is available for iOS/iPadOS and macOS, along with the new Apple enrollment policies experience.

The Microsoft Tunnel MAM for Android page updates links for MAM certificate trust APIs, including the MAMCertTrustWebViewClient reference link.

The setup page removes the direct link to BlackBerry UES integration instructions and now tells administrators to sign in with Microsoft Entra and complete setup.

The prerequisites now list RHEL 9.8 with Podman 5.8.2 or later as the default and explain that the ip_tables kernel module must be loaded manually before Tunnel installation.

The documentation now notes that registry key inventory uses existing Device Inventory permissions and may expose sensitive device configuration information.

The Remediations link now includes the `.md` file extension in its relative path.

The government service page now includes Remediations with a value of “n/a” in its table.

The documentation now covers MAA enforcement for delegated actions and app-authenticated Microsoft Graph API calls, clarifies approver permissions and direct group membership, and documents per-policy enterprise application exclusions. Exclusions apply only to app-auth calls, allow up to 50 applications, require second-admin approval, and are audited.

The documentation now describes missing approval headers as returning HTTP 400, and pending approval as HTTP 412 with a Graph `BadRequest` code and `x-msft-approval-code` header. It also instructs callers to retain the original request details for resubmission.

The sync documentation now says to turn on the “Preview new device view” toggle in the Intune admin center to see new device sync improvements. The “Compliance policy evaluation” item was also removed from the documented sync behavior.

The documentation adds Windows settings catalog entries for Windows App, custom Microsoft Store package removal, disabling Get Started, several OneDrive behaviors, and the Disable Model Context Protocol Visual Studio policy.

The permissions table now lists Android Enterprise’s “Manage zero touch enrollment” permission for managing or changing the Google Zero-Touch Enrollment portal connection.

The PKCS profiles documentation now states that device configuration profiles containing PKCS certificate profiles aren't supported on Microsoft Teams devices running AOSP. The page date was also updated.

The documentation now lists new blob storage URLs for each region and directs administrators to Tenant Status in endpoint.microsoft.com to identify their tenant’s geo and data center.

The page title capitalization was updated, and its description now states that administrators can gather hardware hashes and import, edit, and delete device records in the Intune admin center.

The three metadata tag lines on the Add devices page were reverted to their previous formatting.

The documented endpoint list changed from lgmsape*.blob.core.windows.net destinations to ams* lmsas.blob.core.windows.net destinations.

The page date was updated, and the SQL Server note now states that SQLSysClrTypes.msi and SharedManagementObjects.msi are no longer included. It also documents the move from deprecated SQL Server 2014 versions to SQL Server 2025 versions (SMO 17).

The service connection tool example adds port 8080 to the proxy server URI and updates the heading accordingly.

The documentation now refers to the CMG SUP server instead of the CGM SUP server when describing boundary group configuration.

The guide no longer instructs administrators to set `oauth2AllowIdTokenImplicitFlow` to `true` in the app manifest. The page date was also updated.

The documentation now clarifies that SQL Server Management Objects and SQL Server CLR Types use SQL Server 2025 versions (SMO 17), and that the related MSI files are no longer included in Configuration Manager media.

The documentation now states that deployment must use an Azure subscription associated with the same Entra ID tenant as Intune.

The title capitalization was standardized, and the description now highlights installing apps, software updates, and Windows upgrades, plus the required Software Center setting.