Configuration Manager 2603 adds internet access for Entra token validation

The week was mostly documentation maintenance, but several changes have direct administrative consequences. Configuration Manager 2603 introduces a management-point internet prerequisite for Microsoft Entra token validation, while Intune begins gradually rolling out Multiple Managed Accounts and changes the configuration path for the Managed Home Screen exit password. Configuration Manager also adds SQL Server 2025 support, and its integrated Connected Cache is slated for future deprecation. A Cloud PKI page now lists a lower CA maximum, but the supplied evidence does not establish that the service-side quota changed.

• Configuration Manager · General

  ConfigMgr 2603 introduces a management point network prerequisite

  Starting in version 2603, Microsoft Identity Service Essentials validates Entra tokens and the management point requires internet access when the site supports Entra-joined users and devices and clients authenticate with Entra tokens, typically through a cloud management gateway. The guidance names https://login.microsoftonline.com and https://sts.windows.net; if a proxy is used, it must be configured at the system level.

• Intune · General

  Managed Home Screen moves exit-password configuration to device profiles

  For Android Enterprise corporate-owned fully managed and dedicated devices, the Managed Home Screen exit lock task mode password can no longer be configured through an app configuration policy. Admins must create or update a device configuration profile to set or rotate the password.

• Intune · App management

  Multiple Managed Accounts begins a gradual Teams iOS and iPadOS rollout

  The new Intune MAM capability lets users manage multiple work or school accounts in one supported app, with app protection enforced independently for each account. Current support is Microsoft Teams on iOS/iPadOS version 8.10.0 or later. One account can be MDM+MAM managed, additional accounts must be MAM-only, and multiple MDM management isn't supported.

• Configuration Manager · General

  Configuration Manager Connected Cache integration is headed for deprecation

  Microsoft Connected Cache integration in Configuration Manager will be deprecated in a future release. After deprecation, it will receive no further feature development or updates within Configuration Manager, and Microsoft advises customers to transition to the standalone version. No retirement date is supplied.

• Cloud PKI · General

  Cloud PKI documentation now lists three certificate authorities per tenant

  The updated Cloud PKI index changes the documented maximum from six CAs to three for both licensed and trial tenants. It also retains the limitation that trial-created CAs use software-backed keys and cannot be converted to HSM-backed keys. This is evidence of a documentation change, not definitive proof of a service-side quota change.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.