Daily Intune News
Track documentation and Message Center changes for Microsoft Intune.
Microsoft Learn documentation ↗What and why: Microsoft Intune will migrate Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA). This is an Intune service-side change that will happen automatically.
Intune will migrate Windows Health Attestation from Device Health Attestation to Microsoft Azure Attestation by early 2027. Organizations must ensure network access to Azure Attestation endpoints to maintain compliance evaluation for Windows 11 devices using health-based policies, or risk compliance failures.
The China endpoints documentation now lists `https://graph.chinacloudapi.cn` instead of `https://graph.chinacloudapi.us`.
The planning guide now links to `integrate-windows-update-client-policies.md` instead of the previous `integrate-windows-update-for-business-windows-10.md` article.
The page now recommends limiting script assignments, avoiding resource-intensive or frequent schedules, and using stable, actionable detection-script results to reduce device performance impact.
The page adds upcoming features including MHS authentication for protected app activities, declarative VPP downloads, deployment plans, Defender launch during Android setup, bulk eSIM actions, new Apple settings, and Quick Machine Recovery policies. It also documents future macOS and iOS/iPadOS support changes and the September 2609 single-device page default.
The iOS app protection settings reference updated the Screen capture entry, documenting that Block prevents capture of work or school data, while Allow is the default and permits capture and sharing without restrictions.
The servicing information page changed the callout from Caution to Important; its message about impacts to updates, reliability, security mitigations, and feature enablement remains the same.
The prerequisites now list RHEL 10.1 with Podman 5.8.2 as the default and explain that the ip_tables kernel module must be manually loaded before Tunnel installation.
The page now documents version 20260818.1, agent and server image digests, minor bug fixes, and package and security updates for the August 18, 2026 release.
The Configure baselines documentation now links to the Windows 365 for Agents security baseline settings reference.
A new article explains how to trigger and cancel remote enhanced log collection on supervised macOS 27+, iOS 27+, and iPadOS 27+ devices. Logs are sent directly to Apple for support analysis.
The Intune client and host service endpoint entry now includes 150.171.109.0/24 and 150.171.110.0/24.
The VPP token settings now include a Management type option: MDM (default) or DDM. DDM applies to app deployment and configuration on iOS/iPadOS 18 and later, and supports only Required or Uninstall assignments.
The security baselines overview now links to the Windows 365 for Agents security baseline, including its Version 24H1 settings reference.
The reference now includes Ben for Intune, Calven, Heijmans, Notability, Notion, SDP - On Premises | Intune, and Superhuman Mail, with descriptions and app links.
Intune now documents the Windows 365 for Agents security baseline version 24H1, including default settings for Cloud PCs running agentic workloads across Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint.
The documentation now lists Chrome, Edge, and Samsung browser as supported for web-based enrollment. The note about phone-call MFA potentially breaking enrollment and its workaround was removed.
The page now states that the listed eSIM features are rolling out and might not yet be available to all tenants. The page date and authoring metadata were also updated.
The article now documents additional Android settings, including work profile inactivity, eSIM removal during wipes, screen power behavior, and separate device and work profile locks, with supported enrollment types, platform versions, defaults, and value requirements.
Intune now documents the Apple DDM App Settings configuration for supervised iOS/iPadOS 27+ and macOS 27+ devices, including allowed or denied apps, binaries, and managed-app allowances.
The osVersion property is now documented as deprecated. New assignment filters can’t use it, while existing filters continue to work; operatingSystemVersion is the replacement.
The page date changed from July 27 to August 21, 2026, and the section describing a planned Audit value for the Microsoft Defender Antivirus template for Linux was removed.
The documentation adds activation and removal of eSIM plans on supported Android Enterprise corporate-owned devices, including supported Android versions, activation-code and ICCID requirements, device-view steps, and required permissions.
The documentation now lists Accessibility appearance for iOS/iPadOS 17 and later and Liquid Glass for iOS/iPadOS 27 and later.
The macOS setup documentation now lists the Liquid Glass pane as skippable for macOS 27.0 and later.
The device details documentation now covers ICCID, EID, phone number, carrier, activation state, and SIM origin for supported Android Enterprise corporate-owned devices, including Android version requirements.
The documentation adds capabilities including unattended Remote Help for physical Windows devices, DDM for Apple VPP apps, additional protected apps, and new Android and Apple settings catalog controls.
The archive now documents EPM support for AVD single-session VMs, a Lenovo Device Orchestration link, four protected apps, and additional Windows settings catalog policies for Edge, Chrome, Windows AI, Firewall, and other components.
The documentation now explains that eSIMs are preserved by default on specified Android Enterprise corporate-owned devices and can be removed during a single-device wipe using the new device view.
The documentation now distinguishes Android unattended control, which requires a dedicated Intune-enrolled device, and adds Windows unattended remote sign-in for targeted physical corporate-owned devices. Both permissions must be explicitly assigned and scoped.
The monitoring guidance now lists log collection status—completed, failed, or in progress—instead of an Incident ID. It also says Microsoft can use logs collected after reproducing an issue during verbose log collection for investigation.
The endpoints documentation now states that Remote Sign-in for Remote Help on Windows requires Azure Virtual Desktop session host endpoints.
The prerequisites page no longer lists `powerlift-frontdesk.acompli.net` as a Diagnostic Endpoint.
The documentation now explains that Yes disables and No enables catch-up scans because the settings are named “Disable catch-up...”. Full-scan catch-up is disabled when not configured, while quick-scan catch-up is enabled by default; the scan triggers after two missed scheduled scans are also specified.
The documentation now states that a tenant can submit up to 1,000 Delete actions per day, cumulatively across individual actions, bulk actions, and Microsoft Graph requests. The limit also applies when Delete triggers Retire or Wipe.
The documentation now states that a tenant can submit up to 1,000 Retire actions per day, cumulative across individual, bulk, and Microsoft Graph API requests.
The documentation now states that individual, bulk, and Microsoft Graph Wipe requests share a cumulative tenant-wide daily limit of 500 actions.
The documentation now lists tenant-wide daily limits of 500 Wipe actions and 1,000 each for Retire and Delete. Counts are cumulative across individual, bulk, and Microsoft Graph submissions.
The new Intune single device page, offering a consolidated device management view, will become the default in the September (2609) release, replacing the legacy page. All management features remain, but admins should update documentation and familiarize themselves with the new interface beforehand.
The documentation now directs administrators to the “Personal Devices on Android Management API” report under Devices > Monitor and clarifies that reporting is not shown in the policy’s device assignment status or the device configuration tab.
The documentation now states that Sync from Windows Settings or the Intune admin center initiates both MDM and IME check-ins, including policy, app, script, and remediation processing. Sync progress can be viewed in the Device sync status tab.
The sync documentation now explains that selecting Sync triggers multiple workloads, including policy processing, app state updates, and scripts/remediations. Admins can monitor progress in the Device sync status tab. This behavior applies to iOS/iPadOS and Windows devices.
The sync behavior and Device sync status tab are documented as applying to Windows and iOS/iPadOS devices, rather than Windows only. The Preview new device view toggle remains required to see the described improvements.
Microsoft Intune will require iOS/iPadOS 18 or higher after Apple releases iOS/iPadOS 27 later this year. Organizations should check device compatibility and Intune reports to identify affected devices. Userless devices via Automated Device Enrollment have specific OS version requirements. Use Intune controls to manage OS versions.
Intune will support macOS 15 and later after macOS Golden Gate 27 release this year. Existing devices on macOS 14.x or below remain enrolled but new enrollments on these versions won't be allowed. Organizations should identify and upgrade affected macOS devices in Intune before the change.
The documentation for collecting device properties now states that registry key inventory uses existing Device Inventory permissions and may expose sensitive device configuration information. It identifies this as an accepted risk and calls for reviewing security and privacy implications.
The page metadata date changed from 08/02/2024 to 08/10/2026. No substantive documentation or product changes are shown.
The page’s metadata date changed from August 2, 2024, to August 10, 2026. No substantive content change is shown.
The guidance now links to the general Android and iOS store-app instructions without including direct CylancePROTECT Play Store or App Store URLs.
The article now only directs administrators to the iOS app configuration policy guidance; the Sophos Intercept X for Mobile iOS reference link was removed.
The documentation now states that apps targeting Android Enterprise fully managed (COBO) and corporate-owned personally enabled (COPE) devices can use Available assignments for either user or device groups, alongside the existing Win32 exception.
The BlackBerry Intune integration page no longer includes the link to BlackBerry UES documentation.
The documentation now notes that registry key inventory uses existing Device Inventory permissions and may expose sensitive device configuration information.
The documentation now lists new blob storage URLs for each region and directs administrators to Tenant Status in endpoint.microsoft.com to identify their tenant’s geo and data center.
The setup page removes the direct link to BlackBerry UES integration instructions and now tells administrators to sign in with Microsoft Entra and complete setup.
The permissions table now lists Android Enterprise’s “Manage zero touch enrollment” permission for managing or changing the Google Zero-Touch Enrollment portal connection.
The sync documentation now says to turn on the “Preview new device view” toggle in the Intune admin center to see new device sync improvements. The “Compliance policy evaluation” item was also removed from the documented sync behavior.
The Remediations link now includes the `.md` file extension in its relative path.
The government service page now includes Remediations with a value of “n/a” in its table.
The documentation now states that enrollment time grouping is available for iOS/iPadOS and macOS, along with the new Apple enrollment policies experience.
The documentation adds Windows settings catalog entries for Windows App, custom Microsoft Store package removal, disabling Get Started, several OneDrive behaviors, and the Disable Model Context Protocol Visual Studio policy.
The licensing documentation now explains that eligible shared-device and no-user-affinity enrollment scenarios support device-targeted management through a device-only subscription. It also states that an unlicensed signed-in user doesn't prevent device-targeted policies, apps, or management actions from processing.
The Microsoft Tunnel MAM for Android page updates links for MAM certificate trust APIs, including the MAMCertTrustWebViewClient reference link.
The Android managed apps documentation now describes the Azure Information Protection mobile apps without the Google Play link.
The prerequisites now list RHEL 9.8 with Podman 5.8.2 or later as the default and explain that the ip_tables kernel module must be loaded manually before Tunnel installation.
The protected apps reference no longer includes the Klaxoon for Intune listing.
The macOS ADE guidance warns not to target profiles that enable PSSO registration during Setup Assistant to userless ADE devices, because this can cause unexpected enrollment behavior and loss of expected device affinity.
The PKCS profiles documentation now states that device configuration profiles containing PKCS certificate profiles aren't supported on Microsoft Teams devices running AOSP. The page date was also updated.
The documentation now covers MAA enforcement for delegated actions and app-authenticated Microsoft Graph API calls, clarifies approver permissions and direct group membership, and documents per-policy enterprise application exclusions. Exclusions apply only to app-auth calls, allow up to 50 applications, require second-admin approval, and are audited.
The documentation now describes missing approval headers as returning HTTP 400, and pending approval as HTTP 412 with a Graph `BadRequest` code and `x-msft-approval-code` header. It also instructs callers to retain the original request details for resubmission.
Updated Microsoft Intune documentation in intune/device-configuration/endpoint-security/firewall.md.
Updated Microsoft Intune documentation in intune/device-configuration/monitor-device-profile.md.
Updated Microsoft Intune documentation in intune/whats-new/in-development.md.
Updated Microsoft Intune documentation in intune/device-security/microsoft-tunnel/prerequisites.md.
Updated Microsoft Intune documentation in intune/device-security/microsoft-tunnel/upgrade.md.
Updated Microsoft Intune documentation in intune/whats-new/index.md.
Updated Microsoft Intune documentation in intune/whats-new/archive.md.
The message recommends installing the Windows cumulative update KB5101684 Preview to fully remediate the issue from IT1431577. This update provides a client fix and platform improvements. Organizations should deploy this update following their usual update and validation procedures.
Updated Microsoft Intune documentation in intune/solutions/azure-virtual-desktop.md.
Updated Microsoft Intune documentation in intune/device-configuration/collect-device-properties.md.
Updated Microsoft Intune documentation in intune/fundamentals/role-based-access-control/create-custom-role.md.
Updated Microsoft Intune documentation in intune/device-security/endpoint-security-policies.md.
Updated Microsoft Intune documentation in intune/fundamentals/endpoints-china.md.
Updated Microsoft Intune documentation in intune/device-security/microsoft-defender/security-settings-management.md.
Updated Microsoft Intune documentation in intune/device-configuration/endpoint-security/antivirus.md.
Updated Microsoft Intune documentation in intune/device-security/overview.md.
Updated Microsoft Intune documentation in intune/fundamentals/servicing-information.md.
Updated Microsoft Intune documentation in intune/fundamentals/tenant-administration/add-groups.md.
Updated Microsoft Intune documentation in intune/device-configuration/assign-device-profile.md.
Updated Microsoft Intune documentation in intune/app-management/deployment/assign-groups.md.
Updated Microsoft Intune documentation in intune/fundamentals/filters/performance-recommendations.md.
Updated Microsoft Intune documentation in intune/device-security/mobile-threat-defense/blackberry.md.
Added Microsoft Intune documentation in intune/fundamentals/choose-targeting-method.md.
Updated Microsoft Intune documentation in intune/app-management/configuration/configure-company-portal.md.
Updated Microsoft Intune documentation in intune/device-security/mobile-threat-defense/setup-blackberry.md.
Updated Microsoft Intune documentation in intune/solutions/education/tutorial-school-deployment/grouping-and-targeting.md.
Added Microsoft Intune documentation in intune/device-updates/android/setup-samsung-knox.md.
Updated Microsoft Intune documentation in intune/device-updates/android/manage-fota.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/manage-devices-tokens-apple.md.
Updated Microsoft Intune documentation in intune/fundamentals/filters/overview.md.
Updated Microsoft Intune documentation in intune/fundamentals/planning-guide.md.
Updated Microsoft Intune documentation in intune/solutions/cloud-native-endpoints/planning-guide.md.
Updated Microsoft Intune documentation in intune/fundamentals/scale-guidelines.md.
Updated Microsoft Intune documentation in intune/fundamentals/role-based-access-control/multi-admin-approval.md.
Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/tutorial-group-policy-migration.md.
Updated Microsoft Intune documentation in intune/device-updates/android/setup-zebra-lifeguard.md.
Updated Microsoft Intune documentation in intune/fundamentals/endpoints-china.md.
Updated Microsoft Intune documentation in intune/device-configuration/templates/ref-device-restrictions-android-enterprise.md.
Updated Microsoft Intune documentation in intune/device-security/compliance/ref-macos-settings.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-tv-os.md.
Updated Microsoft Intune documentation in intune/device-enrollment/apple/setup-automated-vision-os.md.
Updated Microsoft Intune documentation in intune/app-management/deployment/add-microsoft-store.md.
Updated Microsoft Intune documentation in intune/developer/app-sdk/android-phase-4.md.
Updated Microsoft Intune documentation in intune/developer/app-sdk/android-phase-7.md.
Updated Microsoft Intune documentation in intune/device-security/compliance/create-policy.md.
Updated Microsoft Intune documentation in intune/device-security/compliance/overview.md.
Updated Microsoft Intune documentation in intune/fundamentals/endpoints-us-government.md.
