Daily Intune NewsThe period’s most consequential guidance change concerns Security Copilot’s Vulnerability Remediation Agent: the agentic user must have an Intune license unless Allow admins without an Intune license is enabled under Tenant administration > Roles > Settings. Intune guidance also spells out tighter unattended-access role and endpoint prerequisites, replaces an Incident ID with log-collection status in Monitor, and removes one Diagnostic Endpoint from Microsoft Tunnel prerequisites.
Security Copilot · TroubleshootingSecurity Copilot guidance states that the agentic user must have an Intune license, unless Allow admins without an Intune license is enabled under Tenant administration > Roles > Settings. Check this prerequisite before relying on the agent.
Intune · FundamentalsThe Intune custom-role guidance distinguishes Android unattended control, which requires a dedicated Intune-enrolled device, and adds Windows unattended remote sign-in for targeted physical corporate-owned devices. Both permissions must be explicitly assigned and scoped.
Intune · FundamentalsThe Intune network-endpoints guidance now states that Remote Sign-in for Remote Help on Windows requires Azure Virtual Desktop session host endpoints. Administrators using unattended access should verify that these endpoints are permitted in their network configuration.
Intune · Device securityThe Monitor guidance now shows whether log collection is completed, failed, or in progress instead of displaying an Incident ID. It also says Microsoft can use logs collected after an issue is reproduced during verbose log collection for investigation.
Intune · Device securityThe Prerequisites page no longer lists `powerlift-frontdesk.acompli.net` as a Diagnostic Endpoint. Administrators maintaining local Microsoft Tunnel log-collection guidance should remove the endpoint from those references.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The monitoring guidance now lists log collection status—completed, failed, or in progress—instead of an Incident ID. It also says Microsoft can use logs collected after reproducing an issue during verbose log collection for investigation.
The prerequisites page no longer lists `powerlift-frontdesk.acompli.net` as a Diagnostic Endpoint.
The documentation now distinguishes Android unattended control, which requires a dedicated Intune-enrolled device, and adds Windows unattended remote sign-in for targeted physical corporate-owned devices. Both permissions must be explicitly assigned and scoped.
The endpoints documentation now states that Remote Sign-in for Remote Help on Windows requires Azure Virtual Desktop session host endpoints.
The documentation now states that the agentic user must have an Intune license unless Allow admins without an Intune license is enabled under Tenant administration > Roles > Settings.
