Daily Intune NewsThe strongest updates clarify the operating guidance for Intune Multi Admin Approval: delegated actions and app-authenticated Microsoft Graph calls are now explicitly covered, with bounded and audited enterprise-application exclusions. A related API article documents the approval response codes and resubmission requirements. Other consequential updates record a manually loaded ip_tables prerequisite for Microsoft Tunnel on RHEL 9.8, a PSSO warning for userless macOS ADE devices, and Configuration Manager 2603 media changes affecting SQL components. The remaining entries are targeted documentation corrections and clarifications.
Intune · FundamentalsThe guidance now documents MAA enforcement for delegated actions and app-authenticated Microsoft Graph API calls. It clarifies approver permissions and direct group membership, while per-policy enterprise application exclusions apply only to app-authenticated calls, allow up to 50 applications, require second-admin approval, and are audited.
Intune · FundamentalsMissing approval headers are documented as HTTP 400. A request pending approval returns HTTP 412 with a Graph BadRequest code and an x-msft-approval-code header; callers are instructed to retain the original request method, URL, and body for resubmission.
Intune · Device securityThe prerequisites list RHEL 9.8 with Podman 5.8.2 or later as the default and state that the ip_tables kernel module must be loaded manually before Tunnel installation.
Intune · Device enrollmentThe Setup Assistant guidance warns administrators not to target userless ADE devices with profiles that enable PSSO registration. That combination can cause unexpected enrollment behavior and loss of expected device affinity.
Configuration Manager · GeneralThe version 2603 guidance states that SQL Server Management Objects and SQL Server CLR Types use SQL Server 2025 versions, identified as SMO 17, and that SQLSysClrTypes.msi and SharedManagementObjects.msi are no longer included in Configuration Manager media.
Review Multi Admin Approval coverage for service principals, scripts, and third-party applications; check approver-group assignments and exclusions against the documented limits. Update Graph integrations to handle HTTP 400 and 412 approval responses while retaining the original request method, URL, and body. On RHEL 9.8, load ip_tables before installing Tunnel. For macOS ADE, avoid targeting userless devices with profiles that enable PSSO registration during Setup Assistant. For Configuration Manager, validate packaging and required components if deployments depend on SQLSysClrTypes.msi or SharedManagementObjects.msi.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now states that apps targeting Android Enterprise fully managed (COBO) and corporate-owned personally enabled (COPE) devices can use Available assignments for either user or device groups, alongside the existing Win32 exception.
The article now only directs administrators to the iOS app configuration policy guidance; the Sophos Intercept X for Mobile iOS reference link was removed.
The Android managed apps documentation now describes the Azure Information Protection mobile apps without the Google Play link.
The BlackBerry Intune integration page no longer includes the link to BlackBerry UES documentation.
The protected apps reference no longer includes the Klaxoon for Intune listing.
The licensing documentation now explains that eligible shared-device and no-user-affinity enrollment scenarios support device-targeted management through a device-only subscription. It also states that an unlicensed signed-in user doesn't prevent device-targeted policies, apps, or management actions from processing.
The macOS ADE guidance warns not to target profiles that enable PSSO registration during Setup Assistant to userless ADE devices, because this can cause unexpected enrollment behavior and loss of expected device affinity.
The guidance now links to the general Android and iOS store-app instructions without including direct CylancePROTECT Play Store or App Store URLs.
The documentation now states that enrollment time grouping is available for iOS/iPadOS and macOS, along with the new Apple enrollment policies experience.
The Microsoft Tunnel MAM for Android page updates links for MAM certificate trust APIs, including the MAMCertTrustWebViewClient reference link.
The setup page removes the direct link to BlackBerry UES integration instructions and now tells administrators to sign in with Microsoft Entra and complete setup.
The prerequisites now list RHEL 9.8 with Podman 5.8.2 or later as the default and explain that the ip_tables kernel module must be loaded manually before Tunnel installation.
The documentation now notes that MDM-managed Firewall Rules and Attack Surface Reduction Rules policies report only policy-level status, unlike most Endpoint Security policies that support per-setting reporting.
The documentation now notes that registry key inventory uses existing Device Inventory permissions and may expose sensitive device configuration information.
The Remediations link now includes the `.md` file extension in its relative path.
The government service page now includes Remediations with a value of “n/a” in its table.
The documentation now covers MAA enforcement for delegated actions and app-authenticated Microsoft Graph API calls, clarifies approver permissions and direct group membership, and documents per-policy enterprise application exclusions. Exclusions apply only to app-auth calls, allow up to 50 applications, require second-admin approval, and are audited.
The documentation now describes missing approval headers as returning HTTP 400, and pending approval as HTTP 412 with a Graph `BadRequest` code and `x-msft-approval-code` header. It also instructs callers to retain the original request details for resubmission.
The sync documentation now says to turn on the “Preview new device view” toggle in the Intune admin center to see new device sync improvements. The “Compliance policy evaluation” item was also removed from the documented sync behavior.
The documentation adds Windows settings catalog entries for Windows App, custom Microsoft Store package removal, disabling Get Started, several OneDrive behaviors, and the Disable Model Context Protocol Visual Studio policy.
The permissions table now lists Android Enterprise’s “Manage zero touch enrollment” permission for managing or changing the Google Zero-Touch Enrollment portal connection.
The PKCS profiles documentation now states that device configuration profiles containing PKCS certificate profiles aren't supported on Microsoft Teams devices running AOSP. The page date was also updated.
The documentation now states that MDM-managed Firewall Rules and Attack Surface Reduction Rules policies provide policy-level status only, without per-setting reporting statuses.
The documentation now lists new blob storage URLs for each region and directs administrators to Tenant Status in endpoint.microsoft.com to identify their tenant’s geo and data center.
The page title capitalization was updated, and its description now states that administrators can gather hardware hashes and import, edit, and delete device records in the Intune admin center.
The three metadata tag lines on the Add devices page were reverted to their previous formatting.
The documented endpoint list changed from lgmsape*.blob.core.windows.net destinations to ams* lmsas.blob.core.windows.net destinations.
The page date was updated, and the SQL Server note now states that SQLSysClrTypes.msi and SharedManagementObjects.msi are no longer included. It also documents the move from deprecated SQL Server 2014 versions to SQL Server 2025 versions (SMO 17).
The service connection tool example adds port 8080 to the proxy server URI and updates the heading accordingly.
The documentation now refers to the CMG SUP server instead of the CGM SUP server when describing boundary group configuration.
The guide no longer instructs administrators to set `oauth2AllowIdTokenImplicitFlow` to `true` in the app manifest. The page date was also updated.
The documentation now clarifies that SQL Server Management Objects and SQL Server CLR Types use SQL Server 2025 versions (SMO 17), and that the related MSI files are no longer included in Configuration Manager media.
The documentation now states that deployment must use an Azure subscription associated with the same Entra ID tenant as Intune.
The title capitalization was standardized, and the description now highlights installing apps, software updates, and Windows upgrades, plus the required Software Center setting.
