Daily Intune NewsFor the week of 9 November 2026, the standout operational item is KB40345593 for Configuration Manager 2603. It fixes bulk registration token verification failures for non-Microsoft Entra-joined devices connecting through a CMG after KB39169655. Intune’s revised automated-authentication guidance directs affected account-driven Apple User Enrollment scenarios to Option 2, Setup Assistant with modern authentication, and says the other method blocks enrollment for targeted users. Most remaining changes are documentation clarifications covering Windows Autopilot enrollment procedures, macOS shell-script execution, and Configuration Manager update sequencing rather than a broad feature rollout.
Configuration Manager · GeneralThe fix applies to Configuration Manager version 2603 sites after KB39169655, covering non-Microsoft Entra-joined devices connecting through a CMG. Install it from Updates and Servicing; a site reset is required, existing secondary sites must be updated manually, and no computer restart is required.
Intune · Device enrollmentThe automated-authentication guidance explicitly directs administrators to Option 2: Setup Assistant with modern authentication for successful automated enrollments involving account-driven Apple User Enrollment. It says the other authentication method blocks enrollment for targeted users.
Intune · Endpoint analyticsThe revised guidance emphasizes a direct Internet requirement, run frequency, retries, and user context, while revising or removing some scope-tag, assignment, and retry-setting instructions. Administrators should check scripts against the updated execution guidance.
Windows Autopilot · Device enrollmentThe setup instructions now separate Windows selection from the Windows Autopilot > Enrollment Status Page navigation, and the previous automatic-enrollment step is no longer included. Administrators consulting the article should follow the revised sequence.
Configuration Manager · Endpoint analyticsThe article now explains starting updates at the top-level site, manually updating secondary sites, monitoring status, and staggering distribution point updates according to content-distribution settings. It also highlights that distribution points can go offline in batches.
For Configuration Manager 2603 sites with KB39169655, install KB40345593 from Updates and Servicing, plan for the required site reset, and manually update existing secondary sites; no computer restart is required. For affected account-driven Apple User Enrollment automated enrollments, use Option 2: Setup Assistant with modern authentication. Review the revised macOS shell-script execution guidance and Autopilot Enrollment Status Page navigation when using those procedures. Configuration Manager servicing plans should also account for manual secondary-site updates and distribution points going offline in batches.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article now explicitly directs administrators to use Option 2: Setup Assistant with modern authentication for successful automated enrollments involving account-driven Apple User Enrollment. It also clarifies Company Portal, MFA, and phishing-resistant MFA guidance.
The user-help page updates its wording, metadata, image descriptions, navigation links, and screenshots. It also adds guidance to sync when work apps behave slowly or unusually.
The page now uses updated wording, metadata, formatting, and image descriptions, with clearer guidance on finding work apps and pausing the work profile.
The page now uses revised title and description text, clarifies support and IT administrator definitions, and rephrases what organizations might see about Android network connections.
The FAQ was revised with capitalization, formatting, terminology, SDK guidance wording, and updated page metadata.
The page title, description, publication date, and wording were updated for clarity and consistency. The documented AOSP support statement and app guidance remain substantively unchanged.
The article updates its description, date, prerequisites, script behavior guidance, and setup wording. It now emphasizes run frequency, retries, and user context, while revising or removing some scope-tag, assignment, and retry-setting instructions.
The page now more clearly describes submitting export requests, checking job status, and downloading CSV or JSON data. Wording and examples were refined, the page date was updated, and the shown throttling-limit bullets were removed.
The page title capitalization and publication date were updated. Wording about password and biometric requirements and Company Portal passcode messages was streamlined.
The article was revised for clearer phrasing and terminology covering discovery scripts, JSON files, the Intune Management Extension, and compliance-status details.
The page received wording, capitalization, metadata, and structure updates. Enrollment Status Page setup now separates Windows selection from the Windows Autopilot > Enrollment Status Page navigation, and the previous automatic-enrollment step is no longer included.
The overview now emphasizes registration requirements before deployment, clarifies hardware hash capture and upload, updates terminology, and revises descriptions of vendor registration, Microsoft Entra objects, profiles, and registration terms.
The page description, scenario table formatting, punctuation, and terminology were updated for clearer presentation, including replacing “utilizes” with “uses.”
The article updates wording and navigation instructions for deleting devices from Intune and deregistering them from Windows Autopilot. The previous note about using Sync to accelerate deregistration was removed.
The tutorial updates wording, formatting, navigation steps, and examples. It also clarifies the recommendation to use separate assigned groups for different device preparation policies and refines service principal and PowerShell instructions.
The documentation now more clearly describes manual registration for VMs, legacy devices, and nonparticipant hardware. It also updates terminology, metadata, diagrams, registration-method references, and links to related registration guides.
The tutorial updates wording, punctuation, formatting, and descriptions for navigating Groups, selecting the service principal, authenticating with Microsoft Graph, and responding to permission prompts.
The FAQ received updated title and description wording, a refreshed publication date, grammar and terminology improvements, and minor link and sentence edits.
The article’s title and description were updated, and wording was clarified around device requirements, hardware-hash requests, the Convert all targeted devices to Autopilot setting, and the Windows Autopilot for existing devices scenario.
The page now clarifies CSP partner device registration through Partner Center, authorization and delegated-administration wording, PKID use instead of collecting hardware hashes, and Partner Center profile access.
The article updates its title and description, replaces “OEM” with “manufacturer” throughout, and refreshes its metadata. It continues to describe manufacturer registration, device guidelines, and Microsoft Entra Global Administrator approval.
The page date was updated to October 23, 2026, and the overview sentence and link text were shortened.
KB40345593 fixes bulk registration token verification failures for non-Microsoft Entra-joined devices connecting through a CMG after KB39169655 is installed.
The documentation now uses present-tense wording for enabling co-management, clarifies use of the saved enablement command, and simplifies the pilot collection instruction. The supported Azure clouds remain unchanged.
The article updates deployment and troubleshooting wording, formats log-file names, refreshes links, and clarifies the recommendation to disable NTLM fallback where possible.
The tutorial title and metadata date were updated, and several instructions, prerequisites, headings, and descriptions were rephrased for clarity and consistency. Guidance on Microsoft Entra Connect, Intune licensing, MDM authority, client settings, and auto-enrollment remains documented.
The page title, metadata, formatting, and wording were updated. Guidance now more clearly describes workload switching, Configuration Manager client settings after moving Windows Update, Windows Autopatch requirements, and resource access policy behavior.
The page received grammar, wording, and formatting updates, a new metadata date, and clearer descriptions of supported operating systems and onboarding paths for MDE Client, MMA, and Windows 8.1 devices.
The article now more clearly explains starting updates at the top-level site, manually updating secondary sites, monitoring status, and staggered distribution point updates based on content distribution settings.
