Microsoft 365 E3 and E5 start receiving bundled Intune Suite capabilities

The consequential item is a gradual rollout of selected Intune Suite capabilities into commercial Microsoft 365 E3 and E5: eligible tenants are automatically provisioned, with a Microsoft 365 admin center notice 30 days beforehand and no action required. The other meaningful items are documentation clarifications: Configuration Manager now spells out baseline first-evaluation conditions and Graph consent for Azure service-secret renewal, while Android web-enrollment guidance retains passkey and phone-call MFA limitations. No retirements or Message Center announcements were recorded; the remaining edits are low-impact Apple naming and macOS Company Portal procedure changes.

• Intune Suite · General

  Intune Suite capabilities are being added to commercial E3 and E5

  Microsoft says Microsoft 365 E3 receives Remote Help, Advanced Analytics, and Intune Plan 2 through the included EMS E3 entitlement. Intune Plan 2 includes Microsoft Tunnel for mobile application management, specialty device management, and firmware over-the-air updates for supported devices. Microsoft 365 E5 adds Endpoint Privilege Management, Enterprise Application Management, and Microsoft Cloud PKI. The rollout is gradual, eligible tenants are automatically provisioned, and no action is required; Education and6

• Configuration Manager · Compliance

  Configuration Manager clarifies when a baseline first evaluates

  The Deploy Configuration Baselines page now says that, after the first evaluation on a client, computer-targeted deployments are evaluated within a two-hour randomization window of each scheduled start time. The first evaluation on a Windows client also requires the device to be powered above the low-battery threshold and the user to be idle. This is a documentation clarification, not evidence of a product behavior change this week.

• Configuration Manager · General

  Azure Services Wizard guidance specifies Graph consent for 2409 renewal

  The updated guidance says that, starting in Configuration Manager 2409, Azure services use Microsoft Graph. Renewing the secret key requires consent for Microsoft Graph Directory.Read.All, which the Cloud Application Administrator role can't grant. Administrators must use Global Administrator or another role that can grant admin consent for Microsoft Graph permissions. The change documents the 2409 prerequisite rather than announcing a new rollout.

• Intune · Device enrollment

  Android web-enrollment guidance retains the passkey-only limitation

  The Personal work profile page removes statements that the limitation will be resolved in a future update, but still says users can't complete web enrollment when passkeys are the only accepted authentication method. It continues to advise against enabling web enrollment until passkey support is announced. The phone-call MFA caveat and the secondary-device or SMS workaround remain; no support date or behavior change is announced.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.