Daily Intune NewsThe week of 3 August 2026 was quiet in release terms: all 34 recorded items were documentation updates, with no new, removed, or Message Center entries. Most edits were wording, links, examples, or navigation, but several clarified consequential reporting limits, enrollment risks, data sensitivity, API handling, and infrastructure prerequisites. The evidence supports documentation clarification and operational guidance—not a new Intune launch, general-availability announcement, or retirement.
Intune · Device securityThe Firewall page adds an IMPORTANT note that per-setting reporting is available for most Endpoint Security policies, but Firewall Rules and Attack Surface Reduction (ASR) Rules policies managed through MDM provide only policy-level status and no per-setting reporting statuses. Viewing per-setting status requires devices to be enrolled with Defender for Endpoint security settings management. This is a reporting-scope clarification, so align monitoring expectations accordingly.
Intune · Device enrollmentThe Automated Device Enrollment guidance warns against targeting userless ADE devices with PSSO configuration profiles that enable PSSO registration during Setup Assistant. Doing so can cause unexpected enrollment behavior and loss of expected device affinity. Review assignments and exclude userless ADE devices from these profiles.
Collect Device Properties now states that collected registry key data is accessible through existing Device Inventory permissions and may expose sensitive device configuration information. Review the security and privacy implications of those permissions and the registry data being collected; the update does not describe a new permission model.
Intune · FundamentalsThe Microsoft Graph guidance now specifies HTTP 400 when approval headers are missing. A pending approval returns HTTP 412 (Precondition Failed), a Microsoft Graph BadRequest code, and an x-msft-approval-code header. Integrations should preserve the original method, URL, and request body so the request can be resubmitted after approval.
Intune · Device securityThe prerequisites page now lists Red Hat Enterprise Linux 9.8 with Podman 5.8.2 or later as the default and notes that RHEL 9.8 does not automatically load the ip_tables kernel module. Administrators installing Microsoft Tunnel on RHEL 9.8 should manually load ip_tables before installation.
Prioritize review of MDM Firewall Rules and ASR reporting expectations, registry inventory access, userless macOS ADE profile assignments, Multi Admin Approval integrations, and Microsoft Tunnel installation prerequisites. Apply administrator action only where the updated guidance states a concrete requirement; the supplied records do not establish broader product availability changes.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now states that apps targeting Android Enterprise fully managed (COBO) and corporate-owned personally enabled (COPE) devices can use Available assignments for either user or device groups, alongside the existing Win32 exception.
The article now only directs administrators to the iOS app configuration policy guidance; the Sophos Intercept X for Mobile iOS reference link was removed.
The Android managed apps documentation now describes the Azure Information Protection mobile apps without the Google Play link.
The BlackBerry Intune integration page no longer includes the link to BlackBerry UES documentation.
The protected apps reference no longer includes the Klaxoon for Intune listing.
The licensing documentation now explains that eligible shared-device and no-user-affinity enrollment scenarios support device-targeted management through a device-only subscription. It also states that an unlicensed signed-in user doesn't prevent device-targeted policies, apps, or management actions from processing.
The macOS ADE guidance warns not to target profiles that enable PSSO registration during Setup Assistant to userless ADE devices, because this can cause unexpected enrollment behavior and loss of expected device affinity.
The guidance now links to the general Android and iOS store-app instructions without including direct CylancePROTECT Play Store or App Store URLs.
The documentation now states that enrollment time grouping is available for iOS/iPadOS and macOS, along with the new Apple enrollment policies experience.
The Microsoft Tunnel MAM for Android page updates links for MAM certificate trust APIs, including the MAMCertTrustWebViewClient reference link.
The setup page removes the direct link to BlackBerry UES integration instructions and now tells administrators to sign in with Microsoft Entra and complete setup.
The prerequisites now list RHEL 9.8 with Podman 5.8.2 or later as the default and explain that the ip_tables kernel module must be loaded manually before Tunnel installation.
Updated Microsoft Intune documentation in intune/device-configuration/endpoint-security/firewall.md.
The documentation now notes that registry key inventory uses existing Device Inventory permissions and may expose sensitive device configuration information.
The Remediations link now includes the `.md` file extension in its relative path.
The government service page now includes Remediations with a value of “n/a” in its table.
The documentation now covers MAA enforcement for delegated actions and app-authenticated Microsoft Graph API calls, clarifies approver permissions and direct group membership, and documents per-policy enterprise application exclusions. Exclusions apply only to app-auth calls, allow up to 50 applications, require second-admin approval, and are audited.
The documentation now describes missing approval headers as returning HTTP 400, and pending approval as HTTP 412 with a Graph `BadRequest` code and `x-msft-approval-code` header. It also instructs callers to retain the original request details for resubmission.
The sync documentation now says to turn on the “Preview new device view” toggle in the Intune admin center to see new device sync improvements. The “Compliance policy evaluation” item was also removed from the documented sync behavior.
The documentation adds Windows settings catalog entries for Windows App, custom Microsoft Store package removal, disabling Get Started, several OneDrive behaviors, and the Disable Model Context Protocol Visual Studio policy.
The permissions table now lists Android Enterprise’s “Manage zero touch enrollment” permission for managing or changing the Google Zero-Touch Enrollment portal connection.
The PKCS profiles documentation now states that device configuration profiles containing PKCS certificate profiles aren't supported on Microsoft Teams devices running AOSP. The page date was also updated.
Updated Microsoft Intune documentation in intune/device-configuration/monitor-device-profile.md.
The documentation now lists new blob storage URLs for each region and directs administrators to Tenant Status in endpoint.microsoft.com to identify their tenant’s geo and data center.
The page title capitalization was updated, and its description now states that administrators can gather hardware hashes and import, edit, and delete device records in the Intune admin center.
The three metadata tag lines on the Add devices page were reverted to their previous formatting.
The documented endpoint list changed from lgmsape*.blob.core.windows.net destinations to ams* lmsas.blob.core.windows.net destinations.
The page date was updated, and the SQL Server note now states that SQLSysClrTypes.msi and SharedManagementObjects.msi are no longer included. It also documents the move from deprecated SQL Server 2014 versions to SQL Server 2025 versions (SMO 17).
The service connection tool example adds port 8080 to the proxy server URI and updates the heading accordingly.
The documentation now refers to the CMG SUP server instead of the CGM SUP server when describing boundary group configuration.
The guide no longer instructs administrators to set `oauth2AllowIdTokenImplicitFlow` to `true` in the app manifest. The page date was also updated.
The documentation now clarifies that SQL Server Management Objects and SQL Server CLR Types use SQL Server 2025 versions (SMO 17), and that the related MSI files are no longer included in Configuration Manager media.
The documentation now states that deployment must use an Azure subscription associated with the same Entra ID tenant as Intune.
The title capitalization was standardized, and the description now highlights installing apps, software updates, and Windows upgrades, plus the required Software Center setting.
