Edit

What's new in Microsoft Intune

  • Article

Learn what's new each week in Microsoft Intune.

You can also read:

Note

Each monthly update may take up to three days to rollout and will be in the following order:

  • Day 1: Asia Pacific (APAC)
  • Day 2: Europe, Middle East, Africa (EMEA)
  • Day 3: North America
  • Day 4+: Intune for Government

Some features may roll out over several weeks and might not be available to all customers in the first week.

For a list of upcoming Intune feature releases, see In development for Microsoft Intune. For new information about Autopilot, see Windows Autopilot What's new.

You can use RSS to be notified when this page is updated. For more information, see How to use the docs.

Week of May 22, 2023 (Service release 2305)

App management

Update to macOS shell scripts maximum running time limit

Based on customer feedback, we're updating the Intune agent for macOS (version 2305.019) to extend the maximum script run time to 60 minutes. Previously, the Intune agent for macOS only allowed shell scripts to run for up to 15 minutes before reporting the script as a failure. The Intune agent for macOS 2206.014 and higher supports the 60-minute timeout.

Assignment filters support app protection policies and app configuration policies

Assignment filters support MAM app protection policies and app configuration policies. When you create a new filter, you can fine tune MAM policy targeting using the following properties:

  • Device Management Type
  • Device Manufacturer
  • Device Model
  • OS Version
  • Application Version
  • MAM Client Version

Important

All new and edited app protection policies that use Device Type targeting are replaced with assignment filters.

For more information on filters, go to Use filters when assigning your apps, policies, and profiles in Microsoft Intune.

Update to MAM reporting in Intune

MAM reporting has been simplified and overhauled, and now leverages Intune's newest reporting infrastructure. Benefits of this include improved data accuracy and instantaneous updating. You can find these streamlined MAM reports in the Microsoft Intune admin center by selecting Apps > Monitor. All MAM data available to you is contained within the new App protection status report and App configuration status report.

Global quiet time app policy settings

The global quiet time settings allow you to create policies to schedule quiet time for your end users. These settings automatically mute Microsoft Outlook email and Teams notifications on iOS/iPadOS and Android platforms. These policies can be used to limit end user notifications received after work hours. For more information, see Quiet time notification policies.

Device configuration

Remote Help administrators will be able to reference audit log sessions

For Remote Help, in addition to existing session reports, administrators can now reference audit logs sessions created in Intune. This enables administrators to reference past events for troubleshooting and analyzing log activities.

For more information on Remote Help, go to Remote Help.

Applies to:

  • Windows 10
  • Windows 11

Turn on/off Personal data encryption on Windows 11 devices using the settings catalog

The settings catalog includes hundreds of settings that you can configure and deploy to your devices.

In the settings catalog, you can turn on/off Personal data encryption (PDE). PDE is a security feature introduced in Windows 11 version 22H2 that provides more encryption features for Windows.

PDE is different than BitLocker. PDE encrypts individual files and content, instead of whole volumes and disks. You can use PDE with other encryption methods, such as BitLocker.

For more information on the settings catalog, go to:

This feature applies to:

  • Windows 11

Visual Studio ADMX settings are in the Settings Catalog and Administrative Templates

Visual Studio settings are included in the Settings Catalog and Administrative Templates (ADMX). Previously, to configure Visual Studio settings on Windows devices, you imported them with ADMX import.

For more information on these policy types, go to:

Applies to:

  • Windows 10
  • Windows 11

Group policy analytics supports scope tags

In Group Policy analytics, you import your on-premises GPO. The tool analyzes your GPOs and shows the settings that can (and can't) be used in Intune.

When you import your GPO XML file in Intune, you can select an existing scope tag. If you don't select a scope tag, then the Default scope tag is automatically selected. Previously, when you imported a GPO, the scope tags assigned to you were automatically applied to the GPO.

Only admins within that scope tag can see the imported policies. Admins not in that scope tag can't see the imported policies.

Also, admins within their scope tag can migrate the imported policies that they have permissions to see. To migrate an imported GPO into a Settings Catalog policy, a scope tag must be associated with the imported GPO. If a scope tag isn't associated, then it can't migrate to a Settings Catalog policy. If no scope tag is selected, then a default scope tag is automatically applied.

For more information on scope tags and Group Policy analytics, go to:

Introducing Intune integration with the Zebra Lifeguard Over-the-Air service (public preview)

Now available in public preview, Microsoft Intune supports integration with Zebra Lifeguard Over-the-Air service, which allows you to deliver OS updates and security patches over-the-air to eligible Zebra devices that are enrolled with Intune. You can select the firmware version you want to deploy, set a schedule, and stagger update downloads and installs. You can also set minimum battery, charging status, and network conditions requirements for when the update can happen.

Available for Android Enterprise Dedicated and Fully Managed Zebra devices that are running Android 8 or later, and requires an account with Zebra.

New Google domain allow-list settings for Android Enterprise personally owned devices with a work profile

On Android Enterprise personally owned devices with a work profile, you can configure settings that restrict device features and settings.

Currently, there is an Add and remove accounts setting that can allow Google accounts be added to the work profile. For this setting, when you select Allow all accounts types, you can also configure:

  • Google domain allow-list: Restricts users to add only certain Google account domains in the work profile. You can import a list of allowed domains or add them in the admin center using the contoso.com format. When left blank, by default, the OS might allow adding all Google domains in the work profile.

For more information on the settings you can configure, go to Android Enterprise device settings list to allow or restrict features on personally owned devices using Intune.

Applies to:

  • Android Enterprise personally owned devices with a work profile

Renaming Proactive remediation to Remediations and moving to a new location

Proactive remediations is now Remediations and is available from Devices > Remediations. You will still be able to find Remediations in both the new location and the existing Reports > Endpoint Analytics location until the next Intune service update.

Remediations are currently not available in the new Devices experience preview.

Applies to:

  • Windows 10
  • Windows 11

Remediations are now available in Intune for US Government GCC High and DoD

Remediations (previously known as proactive remediations) are now available in Microsoft Intune for US Government GCC High and DoD

Applies to:

  • Windows 10
  • Windows 11

Create inbound and outbound network traffic rules for VPN profiles on Windows devices

You can create a device configuration profile that deploys a VPN connection to devices (Devices > Configuration profiles > Create profile > Windows 10 and later for platform > Templates > VPN for profile type).

In this VPN connection, you can use the Apps and Traffic rules settings to create network traffic rules.

There's a new Direction setting you can configure. Use this setting to allow Inbound and Outbound traffic from the VPN connection:

  • Outbound (default): Allows only traffic to external networks/destinations to flow using the VPN. Inbound traffic is blocked from entering the VPN.
  • Inbound: Allows only traffic coming from external networks/ sources to flow using the VPN. Outbound traffic is blocked from entering the VPN.

For more information on the VPN settings you can configure, including the network traffic rule settings, go to Windows device settings to add VPN connections using Intune.

Applies to:

  • Windows 10 and later

New settings available in the macOS settings catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

A new setting is available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > macOS for platform > Settings catalog for profile type.

Microsoft Defender > Antivirus engine:

  • Scanning inside archive files
  • Enable file hash computation

Applies to:

  • macOS

For more information about configuring Settings Catalog profiles in Intune, go to Create a policy using settings catalog.

Wipe device action and new obliteration behavior setting available for macOS

You can now use the Wipe device action instead of Erase for macOS devices. Additionally, you can configure the Obliteration Behavior setting as part of the Wipe action.

This new key allows you to control the wipe fallback behavior on Macs that have Apple Silicon or the T2 Security Chip. To find this setting, navigate to Devices > macOS > [Select a device] > Overview > Wipe in the Device action area.

For more information on the Obliteration Behavior setting, go to Apple's Platform Deployment site Erase Apple devices - Apple Support.

Applies to:

  • macOS

Device enrollment

Account driven Apple User Enrollment available for iOS/iPadOS 15+ devices (public preview)

Intune supports account driven user enrollment, a new and improved variation of Apple User Enrollment for iOS/iPadOS 15+ devices. Now available for public preview, the new option utilizes just-in-time registration, which eliminates the need for the Company Portal app during enrollment. Device users can initiate enrollment directly in the Settings app, resulting in a shorter and more efficient onboarding experience. You can continue to target iOS/iPadOS devices using the existing profile-based user enrollment method that uses Company Portal. Devices running iOS/iPadOS, version 14.8.1 and earlier remain unaffected by this update and can continue to use the existing method. For more information, see Set up account driven Apple User Enrollment.

Device security

New security baseline for Microsoft 356 Office Apps

We’ve released a new security baseline to help you manage security configurations for M365 Office Apps. This new baseline uses an updated template and experience that leverages the unified settings platform seen in the Intune settings catalog. You can view the list of settings in the new baseline at Microsoft 365 Apps for Enterprise baseline settings (Office).

The new Intune security baseline format aligns the presentation of settings that are available to those found in the Intune settings catalog. This alignment helps resolve past issues for setting names and implementations for settings that could create conflicts. The new format also improves the reporting experience for baselines in the Intune admin center.

The M365 Office Apps baseline can help you rapidly deploy configurations to your Office Apps that meet the security recommendations of the Office and security teams at Microsoft. As with all baselines, the default baseline represents the recommended configurations and you’ll be free to modify the default baseline to meet the requirements of your organization.

To learn more, see Security baselines overview.

Applies to:

  • Windows 10
  • Windows 11

Security baseline update for Microsoft Edge version 112

We’ve released a new version of the Intune security baseline for Microsoft Edge, version 112. In addition to releasing this new version for Microsoft Edge, the new baseline uses an updated template experience that leverages the unified settings platform seen in the Intune settings catalog. You can view the list of settings in the new baseline at Microsoft Edge baseline settings (version 112 and higher).

The new Intune security baseline format aligns the presentation of settings that are available to those found in the Intune settings catalog. This alignment helps resolve past issues for setting names and implementations for settings that could create conflicts. The new format also improves the reporting experience for baselines in the Intune admin center.

Now that the new baseline version is available, all new profiles you create for Microsoft Edge will use the new baseline format and version. While the new version becomes the default baseline version, you can continue to use the profiles you’ve previously created for older versions of Microsoft Edge, but not create new profiles for those older versions of Microsoft Edge.

To learn more, see Security baselines overview.

Applies to:

  • Windows 10
  • Windows 11

Intune apps

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune:

  • Achievers by Achievers Inc.
  • Board.Vision for iPad by Trusted Services PTE. LTD.
  • Global Relay by Global Relay Communications Inc.
  • Incorta (BestBuy) by Incorta, Inc. (iOS)
  • Island Enterprise Browser by Island (iOS)
  • Klaxoon for Intune by Klaxoon (iOS)

For more information about protected apps, see Microsoft Intune protected apps.

Week of May 8, 2023

Device configuration

Device Firmware Configuration Interface (DFCI) supports Dynabook devices

For Windows 10/11 devices, you can create a DFCI profile to manage UEFI (BIOS) settings. In Microsoft Intune admin center, select Devices > Configuration profiles > Create profile > Windows 10 and later for platform > Templates > Device Firmware Configuration Interface for profile type.

Some Dynabook devices running Windows 10/11 are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices.

For more information about DFCI profiles, go to:

Applies to:

  • Windows 10
  • Windows 11

eSIM bulk activation for Windows PCs via download server is now available on the Settings Catalog

You can now perform at-scale configuration of Windows eSIM PCs using the Settings Catalog. A download server (SM-DP+) is configured using a configuration profile.

Once the devices receive the configuration, they automatically download the eSIM profile. For more information go to eSIM configuration of a download server

Applies to:

  • Windows 11
  • eSIM capable devices

Week of May 1, 2023

App management

macOS shell scripts maximum running time limit

We have fixed an issue that caused Intune tenants with long-running shell scripts to not report back on the script run status. macOS shell scripts that are running for longer than 15 minutes will be stopped by the macOS Intune agent and report as failed. The new behavior is enforced from macOS Intune agent version 2305.019.

DMG app installation for macOS

The DMG app installation feature for macOS is now generally available. Intune supports required and uninstall assignment types for DMG apps. The Intune agent for macOS is used to deploy DMG apps. For related information, see Deploy DMG-type applications to managed macOS devices.

Deprecation of Microsoft Store for Business and Education

The Microsoft Store for Business connector is no longer accessible in the Microsoft Intune admin center. Apps added from the Microsoft Store for Business or Microsoft Store for Education will no longer sync with Intune. Apps that have previously synced will continue to be available and deploy to devices and users.

It is now also possible to delete Microsoft Store for Business apps from the Apps pane in the Microsoft Intune admin center so that you can clean up your environment as you move to the new Microsoft Store app type.

For related information, see Plan for Change: Ending support for Microsoft Store for Business and Education apps for upcoming dates when Microsoft Store for Business apps will no longer deploy and Microsoft Store for Business apps will be removed.

Device configuration

Remote Help now supports conditional access capability

Administrators can now utilize conditional access capability when setting up policies and conditions for Remote Help. For example, multi-factor authentication, installing security updates, and locking access to Remote Help for a specific region or IP addresses.

For more information, go to:

Device security

Updated settings for Microsoft Defender in endpoint security Antivirus policy

We’ve updated the available settings in the Microsoft Defender Antivirus profile for endpoint security Antivirus policy. You can find this profile in the Intune admin center at Endpoint security > Antivirus > Platform: Windows 10, Windows 11, and Windows Server > Profile: Microsoft Defender Antivirus.

  • The following settings have been added:

    • Metered Connection Updates
    • Disable Tls Parsing
    • Disable Http Parsing
    • Disable Dns Parsing
    • Disable Dns Over Tcp Parsing
    • Disable Ssh Parsing
    • Platform Updates Channel
    • Engine Updates Channel
    • Security Intelligence Updates Channel
    • Allow Network Protection Down Level
    • Allow Datagram Processing On Win Server
    • Enable Dns Sinkhole

    For more information about these settings, see the Defender CSP. The new settings are also available through the Intune Settings Catalog.

  • The following setting has been deprecated:

    • Allow Intrusion Prevention System

    This setting now appears with the Deprecated tag. If this deprecated setting was previously applied on a device, the setting value is updated to NotApplicable and has no effect on the device. If this setting is subsequently set on a device, there will be no effect on the device.

Applies to:

  • Windows 10
  • Windows 11

Week of April 17, 2023 (Service release 2304)

App management

Changes to iCloud app backup and restore behavior on iOS/iPadOS and macOS devices

As an app setting, you can select to Prevent iCloud app backup for iOS/iPadOS and macOS devices. You have the option to not back up managed App Store apps and line-of-business (LOB) apps on iOS/iPadOS, as well as managed App Store apps on macOS devices (macOS LOB apps won’t support this feature), for both user and device licensed VPP/non-VPP apps. This update includes both new and existing App Store/LOB apps sent with and without VPP that are being added to Intune and targeted to users and devices.

Preventing the backup of the specified managed apps will ensure that these apps can be properly deployed via Intune when the device is enrolled and restored from backup. If the admin configures this new setting for new or existing apps in their tenant, managed apps can and will be re-installed for devices, but Intune will no longer allow them to be backed up.

This new setting appears in Microsoft Intune admin center by modifying the properties of an app. For an existing app, you can select Apps > iOS/iPadOS or macOS > select the app > Properties > Assignment Edit. If no group assignment has been set, click Add group to add a group. Modify either the setting under VPN, Uninstall on device removal, or Install as removable. Then, select Prevent iCloud app backup. The Prevent iCloud app backup setting is used to prevent backup of app data for the application. Set to No to allow the app to be backed up by iCloud.

For more information, see Changes to applications’ backup and restore behavior on iOS/iPadOS and macOS devices and Assign apps to groups with Microsoft Intune.

Prevent automatic updates for Apple VPP apps

You can control the automatic update behavior for Apple VPP at the per-app assignment level using the Prevent automatic updates setting. This setting is available in Microsoft Intune admin center by selecting Apps > iOS/iPadOS or macOS > Select a volume purchase program app > Properties > Assignments > Select an AAD group > App settings.

Applies to:

  • iOS/iPadOS
  • macOS

Device configuration

Updates to the macOS Settings Catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

A new setting is available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > macOS for platform > Settings catalog for profile type.

The new setting is located under:

Microsoft AutoUpdate (MAU) > [targeted app]:

  • Update channel override

The following settings have been deprecated:

Microsoft AutoUpdate (MAU) > [targeted app]:

  • Channel Name (Deprecated)

Privacy > Privacy Preferences Policy Control > Services > Listen Event or Screen Capture:

  • Allowed

Applies to:

  • macOS

For more information about configuring Settings Catalog profiles in Intune, go to Create a policy using settings catalog.

The Microsoft Enterprise SSO plug-in for Apple devices is now generally available

In Microsoft Intune, there's a Microsoft Enterprise SSO plug-in. This plug-in provides single sign-on (SSO) to iOS/iPadOS and macOS apps and websites that use Microsoft Azure AD for authentication.

This plug-in is now generally available (GA).

For more information about configuring the Microsoft Enterprise SSO plug-in for Apple devices in Intune, go to Microsoft Enterprise SSO plug-in in Microsoft Intune.

Applies to:

  • iOS/iPadOS
  • macOS

Disable Activation Lock device action for supervised macOS devices

You can now use the Disable Activation Lock device action in Intune to bypass Activation Lock on Mac devices without requiring the current username or password. This new action is available in Devices > macOS > select one of your listed devices > Disable Activation Lock.

More information on managing Activation Lock is available at Bypass iOS/iPadOS Activation Lock with Intune or on Apple's website at Activation Lock for iPhone, iPad, and iPod touch - Apple Support.

Applies to:

  • macOS 10.15 or later

ServiceNow Integration is now Generally Available (GA)

Now generally available, you can view a list of ServiceNow incidents associated with the user you've selected in the Intune Troubleshooting workspace. This new feature will be available under Troubleshooting + Support > select a user > ServiceNow Incidents. The list of incidents shown have a direct link back to the source incident and show key information from the incident. All incidents listed will link the "Caller" identified in the incident with the user selected for Troubleshooting.

For more information go to Use the troubleshooting portal to help users at your company.

Additional permissions to support administrators in controlling delivery of organization messages

With additional permissions administrators can control delivery of content created and deployed from Organizational messages as well as the delivery of content from Microsoft to users.

The Update organizational message control RBAC permission for organizational messages, determines who can change the Organizational Messages toggle to allow or block Microsoft direct messages. This permission is also added to the Organizational Messages Manager built-in role.

Existing custom roles for managing Organizational Messages must be modified to add this permission for users to modify this setting.

Device management

Endpoint security firewall rules support for ICMP type

You can now use the IcmpTypesAndCodes setting to configure inbound and outbound rules for Internet Control Message Protocol (ICMP) as part of a firewall rule. This setting is available in the Microsoft Defender Firewall rules profile for the Windows 10, Windows 11, and Windows Server platform.

Applies to:

  • Windows 11 and later

Manage Windows LAPS with Intune polices (public preview)

Now available in a public preview, manage Windows Local Administrator Password Solution (Windows LAPS) with Microsoft Intune Account protection policies. To get started, see Intune support for Windows LAPS.

Windows LAPS is a Windows feature that allows you to manage and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices.

To manage LAPS, Intune configures the Windows LAPS configuration service provider (CSP) that is built-in to Windows devices, and which takes precedence over other sources of Windows LAPS configurations, like GPOs or the Microsoft Legacy LAPS tool. Some of the capabilities you can use when Intune to manages Windows LAPS include:

  • Define password requirements like complexity and length that apply to the local administrator accounts on a device.
  • Configure devices to rotate their local admin account passwords on a schedule, and backup the account and password in your Azure Active Directory or on-premises Active Directory.
  • Use an Intune device action from the admin center to manually rotate the password for an account on your own schedule.
  • View account details from within the Intune admin center, like the account name and password. This can help you recover devices that are otherwise inaccessible.
  • Use Intune reports to monitor your LAPS policies, and when devices last rotated passwords manually or by schedule.

Applies to:

  • Windows 10
  • Windows 11

New settings available for macOS software update policies

MacOS software update policies now include the following settings to help manage when updates install on a device. These are available when the All other updates update type is configured to Install later:

  • Max User Deferrals: When the All other updates update type is configured to Install later, this setting allows you to specify the maximum number of times a user can postpone a minor OS update before it’s installed. The system prompts the user once a day. Available for devices running macOS 12 and later.

  • Priority: When the All other updates update type is configured to Install later, this setting allows you to specify values of Low or High for the scheduling priority for downloading and preparing minor OS updates. Available for devices running macOS 12.3 and later.

For more information, see Use Microsoft Intune policies to manage macOS software updates.

Applies to:

  • macOS

Introducing the new partner portals page

You can now manage hardware specific information on your HP or Surface devices from our partner portals page.

The HP link will take you to HP Connect where you can update, configure, and secure the BIOS on your HP devices. The Microsoft Surface link will take you to the Surface Management Portal where you can get insights into device compliance, support activity, and warranty coverage.

To access the Partner portals page, you must enable the Devices pane preview and then navigate to Devices > Partner Portals.

Windows Update compatibility reports for Apps and Drivers are now generally available

The following Microsoft Intune reports for Windows Update compatibility are out of preview and now generally available:

  • Windows feature update device readiness report - This report provides per-device information about compatibility risks that are associated with an upgrade or update to a chosen version of Windows.

  • Windows feature update compatibility risks report - This report provides a summary view of the top compatibility risks across your organization for a chosen version of Windows. You can use this report to understand which compatibility risks impact the greatest number of devices in your organization.

These reports can help you plan an upgrade from Windows 10 to 11, or for installing the latest Windows feature update.

Device security

Microsoft Intune Endpoint Privilege Management is generally available

Microsoft Endpoint Privilege Management (EPM) is now generally available and no longer in preview.

With Endpoint Privilege Management, admins can set policies that allow standard users to perform tasks normally reserved for an administrator. To do so, you configure policies for automatic and user-confirmed workflows that elevate the run-time permissions for apps or processes you select. You then assign these policies to users or devices that have end users running without Administrator privileges. After policy is received by a device, EPM brokers the elevation on behalf of the user, allowing them to elevate approved applications without needing full administrator privileges. EPM also includes built-in insights and reporting.

Now that EPM is out of preview, it requires an additional license to use. You can choose between a stand-alone license that adds only EPM, or license EPM as part of the Microsoft Intune Suite. For more information, see Use Intune Suite add-on capabilities.

While Endpoint Privilege Management is now generally available, the reports for EPM will transition to a feature in preview, and will receive some additional enhancements before being removed from preview.

Support for WDAC Application ID tagging with Intune Firewall Rules policy

Intune's Microsoft Defender Firewall Rules profiles, which are available as part of endpoint security Firewall policy, now include the Policy App Id setting. This setting is described by the MdmStore/FirewallRules/{FirewallRuleName}/PolicyAppId CSP and supports specifying a Windows Defender Application Control (WDAC) Application ID tag.

With this capability, you’ll be able to scope your firewall rules to an application or a group of applications and rely on your WDAC policies to define those applications. By using tags to link to and rely on WDAC policies, your Firewall Rules policy won’t need to rely on the firewall rules option of an absolute file path or use of a variable file path that can reduce security of the rule.

Use of this capability requires you to have WDAC policies in place that include AppId tags that you can then specify in your Intune Microsoft Defender Firewall Rules.

For more information, see the following articles in the Windows Defender Application Control documentation:

Applies to:

  • Windows 10/11

New App and browser isolation profile for Intune’s endpoint security Attack Surface Reduction policy

We have released a new experience creating new App and Browser Isolation profiles for endpoint security Attack Surface Reduction policy. The experience for editing your previously created App and Browser isolation policies remains the same, and you can continue to use them. This update applies only for the new App and Browser Isolation policies you create for the Windows 10 and later platform.

This update is part of the continuing rollout of new profiles for endpoint security policies, which began in April 2022.

Additionally, the new profile includes the following changes for the settings it includes:

Intune apps

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune:

  • ixArma by INAX-APPS (iOS)
  • myBLDNG by Bldng.ai (iOS)
  • RICOH Spaces V2 by Ricoh Digital Services
  • Firstup - Intune by Firstup, Inc. (iOS)

For more information about protected apps, see Microsoft Intune protected apps.

Role-based access control

New Assign (RBAC) permissions for organizational messages

The Assign RBAC permissions for organizational messages determines who can assign target Azure AD groups to an organizational message. To access RBAC permissions, sign in to the Microsoft Intune admin center and go to Tenant administration > Roles.

This permission is also added to the Organizational Messages Manager built-in role. Existing custom roles for managing Organizational Messages must be modified to add this permission for users to modify this setting.

Tenant administration

Delete organizational messages

You can now delete organizational messages from Microsoft Intune. After you delete a message, it's removed from Intune and no longer appears in the admin center. You can delete a message anytime, regardless of its status. Intune automatically cancels active messages after you delete them. For more information, see Delete organizational messages.

Review audit logs for organizational messages

Use audit logs to track and monitor organizational message events in Microsoft Intune. To access the logs, sign in to the Microsoft Intune admin center and go to Tenant administration > Audit logs. For more information, see Audit logs for Intune activities.

Week of April 10, 2023

Device configuration

User configuration support for Windows 10 multi-session VMs is now GA

You can now:

  • Configure user scope policies using Settings catalog and assign to groups of users.
  • Configure user certificates and assign to users.
  • Configure PowerShell scripts to install in the user context and assign to users.

Applies to:

Week of April 3, 2023

Device configuration

Add Google accounts to Android Enterprise personally owned devices with a work profile

On Android Enterprise personally owned devices with a work profile, you can configure settings that restrict device features and settings. Currently, there's an Add and remove accounts setting. This setting prevents accounts from being added in the work profile, including preventing Google accounts.

This setting changed. You can now add Google accounts. The Add and remove accounts setting options are:

  • Block all accounts types: Prevents users from manually adding or removing accounts in the work profile. For example, when you deploy the Gmail app into the work profile, you can prevent users from adding or removing accounts in this work profile.

  • Allow all accounts types: Allows all accounts, including Google accounts. These Google accounts are blocked from installing apps from the Managed Google Play Store.

    This setting requires:

    • Google Play app version 80970100 or higher

  • Allow all accounts types, except Google accounts (default): Intune doesn't change or update this setting. By default, the OS might allow adding accounts in the work profile.

For more information on the settings you can configure, go to Android Enterprise device settings list to allow or restrict features on personally owned devices using Intune.

Applies to:

  • Android Enterprise personally owned devices with a work profile

Week of March 27, 2023

App management

Update macOS DMG apps

You can now update apps of type macOS apps (DMG) deployed using Intune. Edit a DMG app that is already created in Intune by uploading the update for the app with the same bundle identifier as the original DMG app. For related information, see Add a macOS DMG app to Microsoft Intune.

Install required apps during pre-provisioning

A new toggle is available in the Enrollment Status Page (ESP) profile that allows you to select whether you want to attempt to install required applications during the pre-provisioning (white glove) technician phase. We understand that installing as many applications as possible during pre-provisioning is desired to reduce the end user setup time. If there's an app install failure, ESP continues except for the apps specified in the ESP profile. To enable this function, you need to edit your Enrollment Status Page profile by selecting Yes on the new setting entitled Only fail selected apps in technician phase. This setting only appears if you have blocking apps selected. For information about ESP, go to Set up the Enrollment Status Page.

Week of March 20, 2023 (Service release 2303)

App management

Additional minimum OS versions for Win32 apps

Intune supports additional minimum operating system versions for Windows 10 and 11 when installing Win32 apps. In Microsoft Intune admin center, select Apps > Windows > Add > Windows app (Win32). In the Requirements tab next to Minimum operating system, select one of the available operating systems. Additional OS options include:

  • Windows 10 21H2
  • Windows 10 22H2
  • Windows 11 21H2
  • Windows 11 22H2

Managed apps permission is no longer required to manage VPP apps

You can view and manage VPP apps with only the Mobile apps permission assigned. Previously, the Managed apps permission was required to view and manage VPP apps. This change doesn't apply to Intune for Education tenants who still need to assign the Managed apps permission. More information about permissions in Intune is available at Custom role permissions.

Device configuration

New settings and setting options available in the macOS Settings Catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

New settings are available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > macOS for platform > Settings catalog for profile type.

New settings include:

Microsoft Defender > Tamper protection:

  • Enforcement level

Microsoft Office > Microsoft OneDrive:

  • Automatic upload bandwidth percentage
  • Automatically and silently enable the Folder Backup feature (aka Known Folder Move)
  • Block apps from downloading online-only files
  • Block external sync
  • Disable automatic sign in
  • Disable download toasts
  • Disable personal accounts
  • Disable tutorial
  • Display a notification to users once their folders have been redirected
  • Enable Files On-Demand
  • Enable simultaneous edits for Office apps
  • Force users to use the Folder Backup feature (aka Known Folder Move)
  • Hide dock icon
  • Ignore named files
  • Include ~/Desktop in Folder Backup (aka Known Folder Move)
  • Include ~/Documents in Folder Backup (aka Known Folder Move)
  • Open at login
  • Prevent users from using the Folder Backup feature (aka Known Folder Move)
  • Prompt users to enable the Folder Backup feature (aka Known Folder Move)
  • Set maximum download throughput
  • Set maximum upload throughput
  • SharePoint Prioritization
  • SharePoint Server Front Door URL
  • SharePoint Server Tenant Name

Applies to:

  • macOS

For more information about configuring Settings Catalog profiles in Intune, go to Create a policy using settings catalog.

Add custom Bash scripts to configure Linux devices

In Intune, you can add existing Bash scripts to configure Linux devices (Devices > Linux > Configuration Scripts).

When you create this script policy, you can set the context that the script runs in (user or root), how frequently the script runs, and how many times execution should retry.

For more information on this feature, go to Use custom Bash scripts to configure Linux devices in Microsoft Intune.

Applies to:

  • Linux Ubuntu Desktops

Device enrollment

Support for the await final configuration setting for iOS/iPadOS Automated device enrollment (public preview)

Now in public preview, Intune supports a new setting called Await final configuration in eligible new and existing iOS/iPadOS automated device enrollment profiles. This setting enables an out-of-the-box locked experience in Setup Assistant to prevent device users from accessing restricted content or changing settings on the device until most Intune device configuration policies are installed. You can configure the setting in an existing automated device enrollment profile, or in a new profile (Devices > iOS/iPadOS > iOS/iPadOS enrollment > Enrollment program tokens > Create profile). For more information, see Create an Apple enrollment profile.

New setting gives Intune admins control over device-to-category mapping

Control visibility of the device category prompt in Intune Company Portal. You can now hide the prompt from end users and leave the device-to-category mapping up to Intune admins. The new setting is available in the admin center under Tenant Administration > Customization > Device Categories. For more information, see Device categories.

Support for multiple enrollment profiles and tokens for fully managed devices

Create and manage multiple enrollment profiles and tokens for Android Enterprise fully managed devices. With this new functionality, you can now use the EnrollmentProfileName dynamic device property to automatically assign enrollment profiles to fully managed devices. The enrollment token that came with your tenant remains in a default profile. For more information, see Set up Intune enrollment of Android Enterprise fully managed devices.

New Azure AD frontline worker experience for iPad (public preview)

This capability will begin to roll out to tenants in mid-April.

Intune now supports a frontline worker experience for iPhones and iPads using Apple automated device enrollment. You can now enroll devices that are enabled in Azure AD shared mode via zero-touch. For more information about how to configure automated device enrollment for shared device mode, see Set up enrollment for devices in Azure AD shared device mode.

Applies to:

  • iOS/iPadOS

Device management

Endpoint security firewall policy support for log configurations

You can now configure settings in endpoint security Firewall policy that configure firewall logging options. These settings can be found in the Microsoft Defender Firewall profile template for the Windows 10 and later platform, and are available for the Domain, Private, and Public profiles in that template.

Following are the new settings, all found in the Firewall configuration service provider (CSP):

  • Enable Log Success Connections
  • Log File Path
  • Enable Log Dropped Packets
  • Enable Log Ignored Rules

Applies to:

  • Windows 10
  • Windows 11

Endpoint security firewall rules support for Mobile Broadband (MBB)

The Interface Types setting in endpoint security Firewall policy now include the option for Mobile Broadband. Interface Types is available in the Microsoft Defender Firewall Rules profile for all platforms that support Windows. For information about the use of this setting and option, see Firewall configuration service provider (CSP).

Applies to:

  • Windows 10
  • Windows 11

Endpoint security firewall policy support for network list manager settings

We've added a pair of network list manager settings to endpoint security Firewall policy. You can use the network list manager settings to help determine when an Azure AD device is or isn't on your on-premises domain subnets so firewall rules can properly apply.

The following settings are found in a new category named Network List Manager, that's available in the Microsoft Defender Firewall profile template for the Windows 10, Windows 11, and Windows Server platform:

  • Allowed Tls Authentication Endpoints
  • Configured Tls Authentication Network Name

For information about Network Categorization settings, see NetworkListManager CSP.

Applies to:

  • Windows 10
  • Windows 11

Improvements to Devices area in admin center (public preview)

The Devices area in the admin center now has a more consistent UI, with more capable controls and an improved navigation structure so you can find the information you need faster. To opt in to the public preview and try out the new experience, go to Devices and flip the toggle at the top of the page. Improvements include:

  • A new scenario-focused navigation structure.
  • New location for platform pivots to create a more consistent navigation model.
  • A reduction in journey, helping you get to your destination faster.
  • Monitoring and reports are within the management workflows, giving you easy access to key metrics and reports without having to leave the workflow.
  • A consistent way across list views to search, sort, and filter data.

For more information about the updated UI, see Try new Devices experience in Microsoft Intune.

Device security

Microsoft Intune Endpoint Privilege Management (public preview)

As a public preview, you can now use Microsoft Intune Endpoint Privilege Management. With Endpoint Privilege Management, admins can set policies that allow standard users to perform tasks normally reserved for an administrator. Endpoint Privilege Management can be configured in the Intune admin center at Endpoint security > Endpoint Privilege Management.

With the public preview, you can configure policies for automatic and user-confirmed workflows that elevate the run-time permissions for apps or processes you select. You then assign these policies to users or devices that have end users running without Administrator privileges. Once policy is received, Endpoint Privilege Management will broker the elevation on behalf of the user, allowing them to elevate approved applications without needing full administrator privileges. The preview also includes built-in insights and reporting for Endpoint Privilege Management.

To learn how to activate the public preview and use Endpoint Privilege Management policies, start with Use Endpoint Privilege Management with Microsoft Intune. Endpoint Privilege Management is part of the Intune Suite offering, and free to try while it remains in public preview.

Intune apps

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune:

  • EVALARM by GroupKom GmbH (iOS)
  • ixArma by INAX-APPS (Android)
  • Seismic | Intune by Seismic Software, Inc.
  • Microsoft Viva Engage by Microsoft (formally Microsoft Yammer)

For more information about protected apps, see Microsoft Intune protected apps.

Monitor and troubleshoot

Diagnostic data collection for Endpoint Privilege Management

To support the release of Endpoint Privilege Management, we've updated Collect diagnostics from a Windows device to include the following data, which is collected from devices enabled for Endpoint Privilege Management:

  • Registry keys:

    • HKLM\SOFTWARE\Microsoft\EPMAgent

  • Commands:

    • %windir%\system32\pnputil.exe /enum-drivers

  • Log files:

    • %ProgramFiles%\Microsoft EPM Agent\Logs\*.*
    • %windir%\system32\config\systemprofile\AppData\Local\mdm\*.log

View status for pending and failed organizational messages

We've added two more states to organizational message reporting details to make it easier to track pending and failed messages in the admin center.

  • Pending: The message has not been scheduled yet and is currently in progress.
  • Failed: The message failed to schedule due to a service error.

For information about reporting details, see View reporting details for organizational messages.

You can now view information for tenant attach devices in the existing antivirus reports under the Endpoint Security workload. A new column differentiates between devices managed by Intune and devices managed by Configuration Manager. This reporting information is available in Microsoft Intune admin center by selecting Endpoint security > Antivirus.

Week of March 13, 2023

Device management

Meta Quest 2 and Quest Pro are now in Open Beta (US only) on Microsoft Intune for Android Open Source Devices

Microsoft Intune for Android open source project devices (AOSP) has welcomed Meta Quest 2 and Quest Pro into Open Beta for the US market.

For more information, go to Operating systems and browsers supported by Microsoft Intune

Applies to:

  • Microsoft Intune (AOSP)

App management

Trusted Root Certificates Management for Intune App SDK for Android

If your Android application requires SSL/TLS certificates issued by an on-premises or private certificate authority to provide secure access to internal websites and applications, the Intune App SDK for Android now has support for certificate trust management. For more information and examples, see Trusted Root Certificates Management.

System context support for UWP apps

In addition to user context, you can deploy Universal Windows Platform (UWP) apps from the Microsoft Store app (new) in system context. If a provisioned .appx app is deployed in system context, the app auto-installs for each user that logs in. If an individual end user uninstalls the user context app, the app still shows as installed because it's still provisioned. In addition, the app must not already be installed for any users on the device. Our general recommendation is to not mix install contexts when deploying apps. Win32 apps from the Microsoft Store app (new) already support system context.

Week of March 6, 2023

App management

Deploy Win32 apps to device groups

You can now deploy Win32 apps with Available intent to device groups. For more information, see Win32 app management in Microsoft Intune.

Device management

New URL for Microsoft Intune admin center

The Microsoft Intune admin center has a new URL: https://intune.microsoft.com. The previously used URL, https://endpoint.microsoft.com, continues to work but will redirect to the new URL in late 2023. We recommend taking the following actions to avoid issues with Intune access and automated scripts:

  • Update login or automation to point to https://intune.microsoft.com.
  • Update your firewalls, as needed, to allow access to the new URL.
  • Add the new URL to your favorites and bookmarks.
  • Notify your helpdesk and update IT administrator documentation.

Tenant administration

Add CMPivot queries to Favorites folder

You can add your frequently used queries to a Favorites folder in CMPivot. CMPivot allows you to quickly assess the state of a device managed by Configuration Manager via Tenant Attach and take action. The functionality is similar to one already present in the Configuration Manager console. This addition helps you keep all your most used queries in one place. You can also add tags to your queries to help search and find queries. The queries saved in the Configuration Manager console aren't automatically added to your Favorites folder. You need to create new queries and add them to this folder. For more information about CMPivot, see Tenant attach: CMPivot usage overview.

Device enrollment

New Microsoft Store apps now supported with the Enrollment Status Page

The Enrollment Status Page (ESP) now supports the new Microsoft store applications during Windows Autopilot. This update enables better support for the new Microsoft Store experience and should be rolling out to all tenants starting with Intune 2303. For related information, see Set up the Enrollment Status Page.

Week of February 27, 2023

Device configuration

Support for Locate device on Android Enterprise corporate owned fully managed and Android Enterprise corporate owned work profile devices

You can now use "Locate device" on Android Enterprise corporate owned fully managed and Android Enterprise corporate owned work profile devices. With this feature, admins are able to locate lost or stolen corporate devices on-demand.

In Microsoft Intune admin center, you need to turn the feature on using Device Restrictions in Device Configuration for Android Enterprise.

Select Allow on the Locate device toggle for fully managed and corporate owned work profile devices and select applicable groups. Locate device is available when you select Devices, and then select All devices. From the list of devices you manage, select a supported device, and choose the Locate device remote action.

For information on locating lost or stolen devices with Intune, go to:

Applies to:

  • Android Enterprise corporate owned fully managed
  • Android Enterprise corporate owned dedicated devices
  • Android Enterprise corporate owned work profile

Intune add-ons

Microsoft Intune Suite provides mission-critical advanced endpoint management and security capabilities into Microsoft Intune.

You can find add-ons to Intune in the Microsoft Intune admin center under Tenant administration > Intune add-ons.

For detailed information, see Use Intune Suite add-on capabilities.

View ServiceNow Incidents in the Intune Troubleshooting workspace (Preview)

In public preview, you can view a list of ServiceNow incidents associated with the user you've selected in the Intune Troubleshooting workspace. This new feature is available under Troubleshooting + Support > select a user > ServiceNow Incidents. The list of incidents shown have a direct link back to the source incident and show key information from the incident. All incidents listed link the "Caller" identified in the incident with the user selected for Troubleshooting.

For more information, go to Use the troubleshooting portal to help users at your company.

Device security

Microsoft Tunnel for MAM is now generally available

Now out of preview and generally available, you can add Microsoft Tunnel for Mobile Application Management to your tenant. Tunnel for MAM supports connections from unenrolled Android and iOS devices. This solution provides your tenant with a lightweight VPN solution that allows mobile devices access to corporate resources while adhering to your security policies.

In addition, MAM Tunnel for iOS now supports Microsoft Edge.

Previously, Tunnel for MAM for Android and iOS was in public preview and free for use. With this release as generally available, this solution now requires an add-on license for its use.

For licensing details, see Intune add-ons.

Applies to:

  • Android
  • iOS

Tenant administration

Organizational messages now support custom destination URLs

You can now add any custom destination URL to organizational messages in the taskbar, notifications area, and Get Started app. This feature applies to Windows 11. Messages created with Azure AD-registered domains that are in a scheduled or active state are still supported. For more information, see Create organizational messages.

Week of February 20, 2023 (Service release 2302)

App management

Latest iOS/iPadOS version available as minimum OS requirement for LOB and store apps

You can specify iOS/iPadOS 16.0 as the minimum operating system for line-of-business and store app deployments. This setting option is available in Microsoft Intune admin center by selecting Apps > iOS/iPadOS > iOS store app or Line-of-business app. For more information about managing apps, see Add apps to Microsoft Intune.

Newly available protected app for Intune

The following protected app is now available for Microsoft Intune:

  • Egnyte for Intune by Egnyte

For more information about protected apps, see Microsoft Intune protected apps.

Device configuration

Endpoint Manager admin center is renamed to Intune admin center

The Microsoft Endpoint Manager admin center is now called the Microsoft Intune admin center.

A new Associated Assignments tab for your filters

When you assign an app or policy, you can filter the assignment using different device properties, such as device manufacturer, model, and ownership. You can create and associate a filter with the assignment.

After you create a filter, there's a new Associated Assignments tab. This tab shows all the policy assignments, the groups that receive the filter assignments, and if the filter is using Exclude or Include:

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Devices > Filters > Select an existing filter > Associated Assignments tab.

For more information on filters, go to:

Size and generation included in iOS/iPadOS model information

You can view the size and generation for enrolled iOS/iPadOS devices as part of the Model attribute in Hardware device details.

Go to Devices > All devices > select one of your listed devices and select Hardware to open its details. For example, iPad Pro 11-inch (3rd generation) displays for the device model instead of iPad Pro 3. For more information, go to: See device details in Intune

Applies to:

  • iOS/iPadOS

Disable Activation Lock device action for supervised iOS/iPadOS devices

You can use the Disable Activation Lock device action in Intune to bypass Activation Lock on iOS/iPadOS devices without requiring the current username or password.

This new action is available under Devices > iOS/iPadOS > select one of your listed devices > Disable Activation Lock.

More information on managing Activation Lock is available at Bypass iOS/iPadOS Activation Lock with Intune or on Apple's website at Activation Lock for iPhone, iPad, and iPod touch - Apple Support.

Applies to:

  • iOS/iPadOS

Allow Temporary Enterprise Feature Control is available in the Settings Catalog

In on-premises group policy, there's an Enable features introduced via servicing that are off by default setting.

In Intune, this setting is known as Allow Temporary Enterprise Feature Control and is available in the Settings Catalog. This servicing adds features that off by default. When set to Allowed, these features are enabled and turned on.

For more information on this feature, go to:

The Windows features that enabled by this policy setting will be released later in 2023. Intune is releasing this policy setting now for your awareness and preparation, which is before any need to use the setting with future Windows 11 releases.

For more information on the settings catalog, go to Use the settings catalog to configure settings on Windows, iOS/iPadOS and macOS devices.

Applies to:

  • Windows 11

Device management

Device Control support for Printer Protection (Preview)

In public preview, Device Control profiles for Attack Surface Reduction policy now support reusable settings groups for Printer Protection.

Microsoft Defender for Endpoint Device Control Printer Protection enables you to audit, allow, or prevent printer with or without exclusions within Intune. It allows you to block users from printing via a non-corporate network printer or non-approved USB printer. This feature adds an additional layer of security and data protection for work from home and remote work scenarios.

Applies to:

  • Windows 10
  • Windows 11

Support to delete stale devices that are managed through Security Management for Microsoft Defender for Endpoint

You can now Delete a device that's managed through the Security Management for Microsoft Defender for Endpoint solution from within the Microsoft Intune admin center. The delete option appears along with other device management options when you view the device's Overview details. To locate a device managed by this solution, in the admin center go to Devices > All devices, and then select a device that displays either MDEJoined or MDEManaged in the Managed by column.

New settings and setting options available in the Apple Settings Catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

New settings are available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > iOS/iPadOS or macOS for platform > Settings catalog for profile type.

New settings include:

Login > Service Management - Managed Login Items:

  • Team Identifier

Microsoft Office > Microsoft Office:

  • Office Activation Email Address

Applies to:

  • macOS

Networking > Domains:

  • Cross Site Tracking Prevention Relaxed Domains

Applies to:

  • iOS/iPadOS

For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.

Device security

Use Endpoint security Antivirus policy to manage Microsoft Defender update behavior (Preview)

As part of a public preview for Endpoint security Antivirus policy, you can use the new profile Defender Update controls for the Windows 10 and later platform to manage update settings for Microsoft Defender. The new profile includes settings for the rollout release channel by which devices and users receive Defender Updates that are related to daily security intelligence updates, monthly platform updates, and monthly engine updates.

This profile includes the following settings, which are all directly taken from Defender CSP - Windows Client Management.

  • Engine Updates Channel
  • Platform Updates Channel
  • Security Intelligence Updates Channel

These settings are also available from the settings catalog for the Windows 10 and later profile.

Applies to:

  • Windows 10
  • Windows 11

Week of February 6, 2023

Tenant administration

Apply recommendations and insights to enrich the Configuration Manager site health and device management experience

You can now use the Microsoft Intune admin center to view recommendations and insights for your Configuration Manager sites. These recommendations can help you improve the site health and infrastructure and enrich the device management experience.

Recommendations include:

  • How to simplify your infrastructure
  • Enhance device management
  • Provide device insights
  • Improve the health of the site

To view recommendations, open the Microsoft Intune admin center and go to Tenant administration > Connectors and tokens > Microsoft Endpoint Configuration Manager, and select a site to view recommendations for that site. Once selected, the Recommendations tab displays each insight along with a Learn more link. This link opens details on how to apply that recommendation.

For more information, see Enable Microsoft Intune tenant attach - Configuration Manager.

Week of January 30, 2023

Device management

HTC Vive Focus 3 supported on Microsoft Intune for Android Open Source Devices

Microsoft Intune for Android open source project devices (AOSP) now supports HTC Vive Focus 3.

For more information, go to Operating systems and browsers supported by Microsoft Intune

Applies to:

  • Microsoft Intune (AOSP)

Introducing support for laser pointers in Remote Help

In Remote Help, you can now use a laser pointer when you're providing assistance on Windows.

For more information on Remote Help, go to Remote Help.

Applies to:

  • Windows 10/11

Week of January 23, 2023 (Service release 2301)

App management

Configure whether to show Configuration Manager apps in Windows Company Portal

In Intune, you can choose whether to show or hide Configuration Manager apps from appearing in the Windows Company Portal. This option is available in Microsoft Intune admin center by selecting Tenant administration > Customization. Next to Settings, select Edit. The option to Show or Hide the Configuration Manager applications are located in the App Sources section of the pane. For related information about configuring the Company Portal app, see How to configure the Intune Company Portal apps, Company Portal website, and Intune app.

Block pinning web pages to Managed Home Screen app

On Android Enterprise dedicated devices using Managed Home Screen, you can now use app configuration to configure the Managed Home Screen app to block pinning browser web pages to Managed Home Screen. The new key value is block_pinning_browser_web_pages_to_MHS. For more information, see Configure the Microsoft Managed Home Screen app for Android Enterprise.

Device management

Grace period status visible in Microsoft Intune app for Android

The Microsoft Intune app for Android now shows a grace period status to account for devices that don't meet compliance requirements but are still within their given grace period. Users can see the date by which devices must be compliant, and the instructions for how to become compliant. If they don't update their device by the given date, the device is marked as noncompliant. For more information, see the following docs:

Software update policies for macOS are now generally available

Software update policies for macOS devices are now generally available. This general availability applies to supervised devices running macOS 12 (Monterey) and later. We will continue to add improvements to this feature going forward.

For more information, see Use Microsoft Intune policies to manage macOS software updates.

Windows Autopilot device diagnostics

Windows Autopilot diagnostics is available to download in Microsoft Intune admin center from either in the Autopilot deployments monitor or Device Diagnostics monitor for an individual device.

Device enrollment

Enrollment notifications now generally available

Enrollment notifications are now generally available, and are supported on Windows, Apple, and Android devices. This feature is only supported with user-driven enrollment methods. For more information, see Set up enrollment notifications.

Skip or show Terms of Address pane in Setup Assistant

Configure Microsoft Intune to skip or show a new Setup Assistant pane called Terms of Address during Apple Automated Device Enrollment. The Terms of Address pane lets users on iOS/iPadOS and macOS devices personalize their device by selecting how the system addresses them: feminine, neutral, or masculine. The pane is visible during enrollment by default, and is available for select languages. You can hide it on devices running iOS/iPadOS 16 and later, and macOS 13 and later. For more information about the Setup Assistant screens supported in Intune, see:

Device security

Microsoft Tunnel for Mobile Application Management for iOS/iPadOS (Preview)

As a public preview, you can use the Mobile Application Management (MAM) to the Microsoft Tunnel VPN gateway for iOS/iPadOS. With this preview for iOS devices that haven't enrolled with Intune, supported apps on those unenrolled devices can use Microsoft Tunnel to connect to your organization when working with corporate data and resources. This feature includes VPN gateway support for:

  • Secure access to on-premises apps and resources using modern authentication
  • Single Sign On and conditional access

For more information, go to:

Applies to:

  • iOS/iPadOS

Attack surface reduction policy support for Security settings management for Microsoft Defender for Endpoint

Attack surface reduction policy is supported by devices managed through the MDE Security configuration scenario. To use this policy with devices that use Microsoft Defender for Endpoint but aren't enrolled with Intune:

  1. In the Endpoint Security node, create a new Attack surface reduction policy.
  2. Select Windows 10, Windows 11, and Windows Server as the Platform.
  3. Select Attack Surface Reduction Rules for the Profile.

Applies to:

  • Windows 10
  • Windows 11

SentinelOne – New mobile threat defense partner

You can now use SentinelOne as an integrated Mobile Threat Defense (MTD) partner with Intune. By configuring the SentinelOne connector in Intune, you can control mobile device access to corporate resources using conditional access that's based on risk assessment in your compliance policy. The SentinelOne connector can also send risk levels to app protection policies.

Device configuration

Device Firmware Configuration Interface (DFCI) supports Fujitsu devices

For Windows 10/11 devices, you can create a DFCI profile to manage UEFI (BIOS) settings (Devices > Configuration profiles > Create profile > Windows 10 and later for platform > Templates > Device Firmware Configuration Interface for profile type).

Some Fujitsu devices running Windows 10/11 are enabled for DFCI. Contact your device vendor or device manufacturer for eligible devices.

For more information about DFCI profiles, go to:

Applies to:

  • Windows 10
  • Windows 11

Support for Bulk Device Actions on devices running Android AOSP

You can now complete "Bulk Device Actions" for devices running Android AOSP. The bulk device actions supported on devices running AOSP are Delete, Wipe and Restart.

Applies to:

  • AOSP

Updated descriptions for iOS/iPadOS and macOS settings in the settings catalog

The settings catalog lists all the settings you can configure, and all in one place. For the iOS/iPadOS and macOS settings, for each setting category, the descriptions are updated to include more detailed information.

For more information on the settings catalog, go to:

Applies to:

  • iOS/iPadOS
  • macOS

New settings available in the Apple Settings Catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

New settings are available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > iOS/iPadOS or macOS for platform > Settings catalog for profile type.

New settings include:

Accounts > Subscribed Calendars:

  • Account Description
  • Account Host Name
  • Account Password
  • Account Use SSL
  • Account Username

Applies to:

  • iOS/iPadOS

Networking > Domains:

  • Cross Site Tracking Prevention Relaxed Domains

Applies to:

  • macOS

The following settings are also in Settings Catalog. Previously, they were only available in Templates:

File Vault:

  • User Enters Missing Info

Applies to:

  • macOS

Restrictions:

  • Rating Region

Applies to:

  • iOS/iPadOS

For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.

Filter app and policy assignments by the device's Azure AD Join type (deviceTrustType)

When you assign an app or policy, you can filter the assignment using different device properties, such as device manufacturer, operating system SKU, and more.

A new device filter property deviceTrustType is available for Windows 10 and later devices. With this property, you can filter app and policy assignments depending on the Azure AD Join type, with values of "Azure AD Joined", "Hybrid Azure AD Joined", and "Azure AD registered".

For more information on filters and the device properties you can use, go to:

Applies to:

  • Windows 10 and later

Monitor and troubleshoot

Download mobile app diagnostics in the Microsoft Intune admin center (public preview)

Now in public preview, access user-submitted mobile app diagnostics in the admin center, including app logs sent through Company Portal app for Android, AOSP, or Windows, with support for iOS, macOS, and Microsoft Edge for iOS coming at a later date. For more information about accessing mobile app diagnostics for Company Portal, see Configure Company Portal.

WinGet troubleshooting using diagnostic files

WinGet is a command line tool that enables you to discover, install, upgrade, remove, and configure applications on Windows 10 and Windows 11 devices. When working with Win32 app management in Intune, you can now use the following file locations to help troubleshoot WinGet:

  • %TEMP%\winget\defaultstate*.log
  • Microsoft-Windows-AppXDeployment/Operational
  • Microsoft-Windows-AppXDeploymentServer/Operational

Intune troubleshooting pane update

A new experience for the Intune Troubleshooting pane provides details about user's devices, policies, applications, and status. The troubleshooting pane includes the following information:

  • A summary of policy, compliance, and application deployment status.
  • Support for exporting, filtering, and sorting all reports.
  • Support to filter by excluding policies and applications.
  • Support to filter to a user's single device.
  • Details about available device diagnostics and disabled devices.
  • Details about offline devices that haven't checked-in to the service for three or more days.

You can find the troubleshooting pane in Microsoft Intune admin center by selecting Troubleshooting + support > Troubleshoot. To view the new experience during preview, select Preview upcoming changes to Troubleshooting and provide feedback to display the Troubleshooting preview pane, then select Try it now.

New report for devices without compliance policy (preview)

We've added a new report named Devices without compliance policy to the Device compliance reports you can access through the Reports node of the Microsoft Intune admin center. This report, which is in preview, uses a newer reporting format that provides for more capabilities.

To learn about this new organizational report, see Devices without compliance policy (Organizational).

An older version of this report remains available through the Devices > Monitor page of the admin center. Eventually, that older report version will be retired, though it remains available for now.

Service health messages for tenant issues that require administrative attention

The Service health and message center page in the Microsoft Intune admin center can now display messages for Issues in your environment that require action. These messages are important communications that are sent to a tenant to alert administrators about issues in their environment that might require action to resolve.

You can view messages for Issues in your environment that require action in the Microsoft Intune admin center by going to Tenant administration > Tenant status and then selecting the Service health and message center tab.

For more information about this page of the admin center, see View details about your Tenant on the Intune tenant status page.

Tenant administration

Improved UI experience for multiple certificate connectors

We've added pagination controls to the Certificate connectors view to help improve the experience when you have more than 25 certificate connectors configured. With the new controls, you can see the total number of connector records and easily navigate to a specific page when viewing your certificate connectors.

To view certificate connectors, in the Microsoft Intune admin center, go to Tenant administration > Connectors and tokens > Certificate connectors.

Intune apps

Newly available protected app for Intune

The following protected app is now available for Microsoft Intune:

  • Voltage SecureMail by Voltage Security

For more information about protected apps, see Microsoft Intune protected apps.

Scripts

Preview PowerShell script package content in Endpoint Analytics

Admins can now see a preview of a PowerShell script's content for proactive remediations. The content is displayed in a grayed-out box with scrolling capability. Admins can't edit the content of the script in the preview. In Microsoft Intune admin center, select Reports > Endpoint analytics > Proactive remediations. For related information, see PowerShell scripts for Proactive remediations.

Week of January 16, 2023

App management

Win32 app supersedence GA

We have rolled out the feature set for Win32 app supersedence GA, which adds support for apps with supersedence during ESP and also allows supersedence and dependency relationships to be added in the same app subgraph. For more information, see Win32 app supersedence improvements. For information about Win32 app supersedence, see Add Win32 app supersedence.

Week of January 9, 2023

Device configuration

The Company Portal app enforces Password Complexity setting on Android Enterprise 12+ personally owned devices with a work profile

On Android Enterprise 12+ personally owned devices with a work profile, you can create a compliance policy and/or device configuration profile that sets the password complexity. Starting with the 2211 release, this setting is available in the Intune admin center:

  • Devices > Configuration profiles > Create profile > Android Enterprise for platform > Personally owned with a work profile
  • Devices > Compliance policies > Create policy > Android Enterprise for platform > Personally owned with a work profile

The Company Portal app enforces the Password complexity setting.

For more information on this setting and the other settings you can configure on personally owned devices with a work profile, go to:

Applies to:

  • Android Enterprise 12+ personally owned devices with a work profile

Week of December 19, 2022

Intune apps

Newly available protected app for Intune

The following protected app is now available for Microsoft Intune:

  • Appian for Intune by Appian Corporation (Android)

For more information about protected apps, see Microsoft Intune protected apps.

Week of December 12, 2022 (Service release 2212)

Device configuration

Remote Help client app includes a new option to disable chat functionality in the Tenant level setting

In the Remote Help app, admins can disable chat functionality from the new tenant level setting. Turning on the disable chat feature removes the chat button in the Remote Help app. This setting can be found in the Remote Help Settings tab under Tenant Administration in Microsoft Intune.

For more information, see Configure Remote Help for your tenant.

Applies to: Windows 10/11

New settings available in the macOS Settings Catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place.

New settings are available in the Settings Catalog. In the Microsoft Intune admin center, you can see these settings at Devices > Configuration profiles > Create profile > macOS for platform > Settings catalog for profile type.

New settings include:

File Vault > File Vault Options:

  • Block FV From Being Disabled
  • Block FV From Being Enabled

Restrictions:

  • Allow Bluetooth Modification

Applies to:

  • macOS

For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog.

There are default settings for SSO extension requests on iOS, iPadOS, and macOS devices

When you create a single sign-on app extension configuration profile, there are some settings you configure. The following settings use the following default values for all SSO extension requests:

  • AppPrefixAllowList key

    • macOS default value: com.microsoft.,com.apple.
    • iOS/iPadOS default value: com.apple.

  • browser_sso_interaction_enabled key

    • macOS default value: 1
    • iOS/iPadOS default value: 1

  • disable_explicit_app_prompt key

    • macOS default value: 1
    • iOS/iPadOS default value: 1

If you configure a value other than the default value, then the configured value overwrites the default value.

For example, you don't configure the AppPrefixAllowList key. By default, all Microsoft apps (com.microsoft.) and all Apple apps (com.apple.) are enabled for SSO on macOS devices. You can overwrite this behavior by adding a different prefix to the list, such as com.contoso..

For more information on the Enterprise SSO plug-in, go to Use the Microsoft Enterprise SSO plug-in on iOS/iPadOS and macOS devices in Microsoft Intune

Applies to:

  • iOS/iPadOS
  • macOS

Device enrollment

Enrollment token lifetime increases to 65 years for Android Enterprise dedicated devices

Now you can create an enrollment profile for Android Enterprise dedicated devices that's valid for up to 65 years. If you have an existing profile, the enrollment token still expires at whatever date you chose when you created the profile, but during renewal you can extend the lifetime. For more information about creating an enrollment profile, see Set up Intune enrollment for Android Enterprise dedicated devices.

Device management

Update policies for macOS now available for all supervised devices

Software update policies for macOS devices now apply to all macOS supervised devices. Previously, only those devices that enrolled through Automated Device Enrollment (ADE) would qualify to receive updates. For more information on configuring update policies for macOS, see Use Microsoft Intune policies to manage macOS software updates.

Applies to:

  • macOS

Policy and reports for Windows feature updates and expedited quality updates are now Generally Available

Both the policies and reports for managing feature updates and quality updates (expedited updates) for Windows 10 and later, are out of preview and now generally available.

For more information about these policies and reports, see:

Applies to:

  • Windows 10/11

Week of November 28, 2022

App management

Microsoft Store apps in Intune

You can now search, browse, configure, and deploy Microsoft Store apps within Intune. The new Microsoft Store app type is implemented using the Windows Package Manager. This app type features an expanded catalog of apps, which includes both UWP apps and Win32 apps. Roll out of this feature is expected to complete by December 2, 2022. For more information, see Add Microsoft Store apps to Microsoft Intune.

Tenant administration

Access policies for multiple Administrator Approval (public preview)

In public preview, you can use Intune access policies to require that a second Administrator Approval account be used to approve a change before the change is applied. This capability is known as multiple Administrator Approval (MAA).

You create an access policy to protect a type of resource, like App deployments. Each access policy also includes a group of users who are approvers for the changes protected by the policy. When a resource like an app deployment configuration is protected by an access policy, any changes that are made to the deployment, including creating, deleting, or modifying an existing deployment won't apply until a member of the approvers group for that access policy reviews and approves that change.

Approvers can also reject requests, and both the individual requesting a change and the approver can provide notes about the change, or why it was approved or rejected.

Access policies are supported for the following resources:

  • Apps – Applies to app deployments, but doesn't apply to app protection policies.
  • Scripts – Applies to deploying scripts to devices that run macOS or Windows.

For more information, see Use Access policies to require multiple administrative approval.

Device security

Microsoft Tunnel for Mobile Application Management for Android (Preview)

As a public preview, you can now use Microsoft Tunnel with unenrolled devices. This capability is called Microsoft Tunnel for Mobile Application Management (MAM). This preview supports Android, and without any changes to your existing Tunnel infrastructure, supports the Tunnel VPN gateway for:

  • Secure access to on-premises apps and resources using modern authentication
  • Single Sign On and conditional access

To use Tunnel MAM, unenrolled devices must install Microsoft Edge, Microsoft Defender for Endpoint, and the Company Portal. You can then use the Microsoft Intune admin center to configure the following profiles for the unenrolled devices:

  • An App configuration profile for managed apps, to configure Microsoft Defender on devices for use as the Tunnel client app.
  • A second App configuration profile for managed apps, to configure Microsoft Edge to connect to Tunnel.
  • An App protection profile to enable automatic start of the Microsoft Tunnel connection.

Applies to:

  • Android Enterprise

What's new archive

For previous months, see the What's new archive.

Notices

These notices provide important information that can help you prepare for future Intune changes and features.

Plan for Change: Ending support for Microsoft Store for Business and Education apps

In April 2023, we'll begin ending support for the Microsoft Store for Business experience in Intune. This occurs in several stages. For more information, see: Adding your Microsoft Store for Business and Education apps to the Microsoft Store in Intune

How does this affect you or your users?

If you're using Microsoft Store for Business and Education apps:

  1. On April 30, 2023, Intune will disconnect Microsoft Store for Business services. Microsoft Store for Business and Education apps won't be able to sync with Intune and the connector page will be removed from the Intune admin center.
  2. On June 15, 2023, Intune will stop enforcing online and offline Microsoft Store for Business and Education apps on devices. Downloaded applications remain on the device with limited support. Users may still be able to access the app from their device, but the app won't be managed. Existing synced Intune app objects remain to allow admins to view the apps that had been synced and their assignments. Additionally, you'll not be able to sync apps via the Microsoft Graph API syncMicrosoftStoreForBusinessApps and related API properties will display stale data.
  3. On September 15, 2023, Microsoft Store for Business and Education apps will be removed from the Intune admin center. Apps on the device remain until intentionally removed. The Microsoft Graph API microsoftStoreForBusinessApp will no longer be available about a month later.

Note that the retirement of Microsoft Store for Business and Education was announced in 2021. When the Microsoft Store for Business and Education portals are retired, admins will no longer be able to manage the list of Microsoft Store for Business and Education apps that are synced or download offline content from the Microsoft Store for Business and Education portals.

How can you prepare?

We recommend adding your apps through the new Microsoft Store app experience in Intune. If an app isn't available in the Microsoft Store, you need to retrieve an app package from the vendor and install it as a line-of-business (LOB) app or Win32 app. For instructions read the following articles:

Related information

Plan for Change: Ending support for Windows Information Protection

Microsoft Windows announced they're ending support for Windows Information Protection (WIP). The Microsoft Intune family of products will be discontinuing future investments in managing and deploying WIP. In addition to limiting future investments, we removed support for WIP without enrollment scenario at the end of calendar year 2022.

How does this affect you or your users?

If you have enabled WIP policies, you should turn off or disable these policies.

How can you prepare?

We recommend disabling WIP to ensure users in your organization do not lose access to documents that have been protected by WIP policy. Read the blog Support tip: End of support guidance for Windows Information Protection for more details and options for removing WIP from your devices.

Plan for Change: Ending support for Windows 8.1

Microsoft Intune will be ending support for devices running Windows 8.1 on October 21, 2022. Additionally, the sideloading key scenario for line-of-business apps will stop being supported since it's only applicable to Windows 8.1 devices.

Microsoft strongly recommends that you move to a supported version of Windows 10 or Windows 11, to avoid a scenario where you need service or support that is no longer available.

How does this affect you or your users?

If you're managing Windows 8.1 devices those devices should be upgraded to a supported version of Windows 10 or Windows 11. There is no impact to existing devices and policies, however, you'll not be able to enroll new devices if they are running Windows 8.1.

How can you prepare?

Upgrade your Windows 8.1 devices, if applicable. To determine which users’ devices are running Windows 8.1 navigate to Microsoft Intune admin center > Devices > Windows > Windows devices, and filter by OS.

Additional information

Update your certificate connector for Microsoft Intune

As of June 1, 2022, Intune certificate connectors earlier than version 6.2101.13.0 may no longer work as expected and stop connecting to the Intune service. For more information on the certificate connector lifecycle and support see, Certificate Connectors for Microsoft Intune.

How does this affect you or your users?

If you're impacted by this change, see MC393815 in the Message center.

How can you prepare?

Download, install, and configure the latest certificate connector. For more information see, Install the Certificate Connector for Microsoft Intune.

To check which version of the certificate connector you are using, follow these steps:

  1. On a Windows Server running the Intune Certificate Connector, launch "Add or Remove programs".
  2. A list of installed programs and applications will be displayed.
  3. Look for an entry related to the Microsoft Intune Certificate Connector. There will be a "Version" associated with the connector. Note that names for older connectors may vary.

Plan for change: Intune is moving to support macOS 11.0 and higher later this year

Apple is expected to release macOS 13 (Ventura) later this year, Microsoft Intune, the Company Portal app and the Intune mobile device management agent will be moving to support macOS 11.0 and later. Since the Company Portal app for iOS and macOS are a unified app, this change will occur shortly after the release of iOS/iPadOS 16.

How does this affect you or your users?

This change only affects you if you currently manage, or plan to manage, macOS devices with Intune. This change might not affect you because your users have likely already upgraded their macOS devices. For a list of supported devices, see macOS Big Sur is compatible with these computers.

Note

Devices that are currently enrolled on macOS 10.15 or earlier will continue to remain enrolled even when those versions are no longer supported. New devices will be unable to enroll if they are running macOS 10.15 or earlier.

How can you prepare?

Check your Intune reporting to see what devices or users might be affected. Go to Devices > All devices and filter by macOS. You can add more columns to help identify who in your organization has devices running macOS 10.15 or earlier. Ask your users to upgrade their devices to a supported OS version.

Plan for change: Intune is moving to support iOS/iPadOS 14 and later

Later this year, we expect iOS 16 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), will require iOS 14/iPadOS 14 and higher shortly after iOS 16’s release.

How does this affect you or your users?

If you're managing iOS/iPadOS devices, you might have devices that won't be able to upgrade to the minimum supported version (iOS/iPadOS 14).

Because Office 365 mobile apps are supported on iOS/iPadOS 14.0 and later, this change might not affect you. You've likely already upgraded your OS or devices.

To check which devices support iOS 14 or iPadOS 14 (if applicable), see the following Apple documentation:

Note

Userless iOS and iPadOS devices enrolled through Automated Device Enrollment (ADE) have a slightly nuanced support statement due to their shared usage. See https://aka.ms/ADE_userless_support for more information.

How can you prepare?

Check your Intune reporting to see what devices or users might be affected. For devices with mobile device management, go to Devices > All devices and filter by OS. For devices with app protection policies, go to Apps > Monitor > App protection status > App Protection report: iOS, Android.

To manage the supported OS version in your organization, you can use Microsoft Intune controls for both mobile device management and APP. For more information, see Manage operating system versions with Intune.

Plan for change: Intune is moving to support Android 8.0 and later in January 2022

Microsoft Intune will be moving to support Android version 8.0 (Oreo) and later for mobile device management (MDM) enrolled devices on or shortly after January 7, 2022.

How does this affect you or your users?

After January 7, 2022, MDM enrolled devices running Android version 7.x or earlier will no longer receive updates to the Android Company Portal or the Intune App. Enrolled devices will continue to have Intune policies applied but are no longer supported for any Intune scenarios. Company Portal and the Intune App will not be available for devices running Android 7.x and lower beginning mid-February; however, these devices won't be blocked from completing enrollment if the requisite app has been installed prior to this change. If you have MDM enrolled devices running Android 7.x or below, update them to Android version 8.0 (Oreo) or higher or replace them with a device on Android version 8.0 or higher.

Note

Microsoft Teams devices are not impacted by this announcement and will continue to be supported regardless of their Android OS version.

How can you prepare?

Notify your helpdesk, if applicable, of this upcoming change in support. You can identify how many devices are currently running Android 7.x or below by navigating to Devices > All devices > Filter. Then filter by OS and sort by OS version. There are two admin options to help inform your users or block enrollment.

Here's how you can warn users:

  • Create an app protection policy and configure conditional launch with a min OS version requirement that warns users.
  • Utilize a device compliance policy for Android device administrator or Android Enterprise and set the action for noncompliance to send an email or push notification to users before marking them noncompliant.

Here's how you can block devices running on versions earlier than Android 8.0:

  • Create an app protection policy and configure conditional launch with a min OS version requirement that blocks users from app access.
  • Utilize a device compliance policy for Android device administrator or Android Enterprise to make devices running Android 7.x or earlier noncompliant.
  • Set enrollment restrictions that prevent devices running Android 7.x or earlier from enrolling.

Note

Intune app protection policies are supported on devices running Android 9.0 and later. See MC282986 for more details.

Plan for change: Intune APP/MAM is moving to support Android 9 and higher

With the upcoming release of Android 12, Intune app protection policies (APP, also known as mobile application management) for Android will move to support Android 9 (Pie) and later on October 1, 2021. This change will align with Office mobile apps for Android support of the last four major versions of Android.

Based on your feedback, we've updated our support statement. We're doing our best to keep your organization secure and protect your users and devices, while aligning with Microsoft app lifecycles.

Note

This announcement doesn't affect Microsoft Teams Android devices. Those devices will continue to be supported regardless of their Android OS version.

How does this affect you or your users?

If you're using app protection policies (APP) on any device that's running Android version 8.x or earlier, or you decide to enroll any device that's running Android version 8.x or earlier, these devices will no longer be supported for APP.

APP policies will continue to be applied to devices running Android 6.x to Android 8.x. But if you have problems with an Office app and APP, support will request that you update to a supported Office version for troubleshooting. To continue to receive support for APP, update your devices to Android version 9 (Pie) or later, or replace them with a device on Android version 9.0 or later before October 1, 2021.

How can you prepare?

Notify your helpdesk, if applicable, about this updated support statement. You also have two admin options to warn users:

Upgrade to the Microsoft Intune Management Extension

We've released an upgrade to the Microsoft Intune Management Extension to improve handling of Transport Layer Security (TLS) errors on Windows 10 devices.

The new version for the Microsoft Intune Management Extension is 1.43.203.0. Intune automatically upgrades all versions of the extension that are earlier than 1.43.203.0 to this latest version. To check the version of the extension on a device, review the version for Microsoft Intune Management Extension in the program list under Apps & features.

For more information, see the information about security vulnerability CVE-2021-31980 in the Microsoft Security Response Center.

How does this affect you or your users?

No action is required. As soon as the client connects to the service, it automatically receives a message to upgrade.

Update to Endpoint Security antivirus Windows 10 profiles

We've made a minor change to improve the antivirus profile experience for Windows 10. There's no user effect, because this change affects only what you'll see in the UI.

How does this affect you or your users?

Previously, when you configured a Windows security profile for the Endpoint Security antivirus policy, you had two options for most settings: Yes and Not configured. Those settings now include Yes, Not configured, and a new option of No.

Previously configured settings that were set to Not configured remain as Not configured. When you create new profiles or edit an existing profile, you can now explicitly specify No.

In addition, the setting Hide the Virus and threat protection area in the Windows Security app has a child setting, Hide the Ransomware data recovery option in the Windows Security app. If the parent setting is set to Not configured and the child setting is set to Yes, both the parent and child settings are set to Not configured. That change takes effect when you edit the profile.

How can you prepare?

No action is needed. However, you might want to notify your helpdesk about this change.

Plan for change: Intune is ending Company Portal support for unsupported versions of Windows

Intune follows the Windows 10 lifecycle for supported Windows 10 versions. We're now removing support for the associated Windows 10 Company Portals for Windows versions that are out of the Modern Support policy.

How does this affect you or your users?

Because Microsoft no longer supports these operating systems, this change might not affect you. You've likely already upgraded your OS or devices. This change only affects you if you're still managing unsupported Windows 10 versions.

Windows and Company Portal versions that this change affects include:

  • Windows 10 version 1507, Company Portal version 10.1.721.0
  • Windows 10 version 1511, Company Portal version 10.1.1731.0
  • Windows 10 version 1607, Company Portal version 10.3.5601.0
  • Windows 10 version 1703, Company Portal version 10.3.5601.0
  • Windows 10 version 1709, any Company Portal version

We won't uninstall these Company Portal versions, but we will remove them from the Microsoft Store and stop testing our service releases with them.

If you continue to use an unsupported version of Windows 10, your users won't get the latest security updates, new features, bug fixes, latency improvements, accessibility improvements, and performance investments. You won't be able to co-manage users by using System Center Configuration Manager and Intune.

How can you prepare?

In the Microsoft Intune admin center, use the discovered apps feature to find apps with these versions. On a user's device, the Company Portal version is shown on the Settings page of the Company Portal. Update to a supported Windows and Company Portal version.