Microsoft Intune: Week of September 28, 2026 (Service release 2609)

Advanced capabilities (formerly "Microsoft Intune Suite")

Microsoft Cloud PKI support for US Government GCC High

Microsoft Cloud PKI is now available for Microsoft Intune tenants in the Microsoft Government Community Cloud High (GCC High) environment. You can create and manage a cloud-based public key infrastructure that automates certificate issuance, renewal, and revocation for Intune-managed devices without deploying an on-premises certification authority, Network Device Enrollment Service, or Intune Certificate Connector for device certificate delivery. Use these certificates for certificate-based authentication to organizational resources such as Wi-Fi, VPN, and applications. Support includes managed Windows, Android, iOS/iPadOS, and macOS devices. Cloud PKI isn't currently supported in the Department of Defense environment.

For more information, see Overview of Microsoft Cloud PKI for Microsoft Intune.

Remote Help support for GCCH environments

Remote Help is now available in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants.

IT support staff can establish Remote Help sessions with users on enrolled devices to provide real-time troubleshooting. Remote Help uses role-based access controls through Intune, and both helpers and sharers must sign in with their organization's Microsoft Entra ID accounts. DoD environments aren't supported.

For more information, see Planning for Remote Help.

App management

Faster delivery of Win32 apps

Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Win32 apps. Managed devices can check in sooner after app changes, reducing delivery and refresh delays compared with waiting for normal polling intervals. This update improves Win32 app deployment responsiveness without requiring a new admin workflow.

Newly available protected app for Intune

Microsoft Dragon Copilot by Microsoft Corporation is now available as a protected app for Microsoft Intune. You can apply Intune app protection policies to the app on supported Android and iOS/iPadOS devices, helping protect organizational data while clinicians use its AI-assisted documentation capabilities.

For more information, see Microsoft Intune protected apps.

Require Managed Home Screen authentication for protected app activities

Microsoft Intune now helps prevent users from bypassing Managed Home Screen (MHS) authentication when they access protected activities in MAM-integrated apps. If MHS requires sign-in or a session PIN, the app redirects the user to MHS before allowing access to protected content. Assign an Intune app protection policy to both the app and the signed-in user; no specific app protection policy setting is required.

For more information, see Configure the Microsoft Managed Home Screen app for Android Enterprise.

Faster Win32 app delivery after Windows enrollment

Microsoft Intune Management Extension now checks for Windows app assignments immediately after the Enrollment Status Page (ESP) completes. This reduces the delay before required Win32 apps that weren't installed during ESP begin installing on newly enrolled devices.

For more information, see Intune Management Extension for Windows.

Device configuration

New Apple settings in the Settings Catalog for iOS/iPadOS and macOS

Microsoft Intune now includes new Apple Settings Catalog options for supported iOS/iPadOS and macOS devices. You can configure additional controls for areas such as app settings, Apple Intelligence, network and web-content filtering, and the macOS login window by using the same Settings Catalog policy workflow in the Microsoft Intune admin center.

For more information, see Create a policy using settings catalog.

Assignment filters for Android Settings Catalog policies

Microsoft Intune now supports assignment filters for Android Enterprise and Android Open Source Project (AOSP) Settings Catalog policies. You can include or exclude specific devices based on device properties, giving you more granular control over policy deployments and helping apply the right settings to the right Android devices.

For more information, see Use assignment filters in Microsoft Intune.

Windows 11, version 26H2 Settings Catalog update

Microsoft Intune provides day-zero support for validated Windows policy settings introduced with Windows 11, version 26H2 in the Settings Catalog. Admins can use the new and updated settings to manage Windows endpoints with the latest 26H2 capabilities.

For more information, see Microsoft Intune Settings Catalog updated to support Windows 11, version 26H2.

Device enrollment

Automatically launch Microsoft Defender for Endpoint during Android Enterprise device setup

Microsoft Intune now supports automatically opening Microsoft Defender for Endpoint during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions, and assign the Defender app as required, enable the experience from Endpoint security > Defender for Endpoint. Intune opens Defender during enrollment so users can complete its initial configuration as part of device setup. If configuration isn't completed, the Intune setup step remains available so users can open Defender again.

For setup-time availability, assign Defender for Endpoint to user groups or all devices before enrollment. Assignment processing for a specific device group might not complete early enough for Defender to be available during setup.

Skip the Device Features Tour during Apple enrollment

Microsoft Intune now includes the Device features tour Apple OS 27 Setup Assistant skip key in Automated Device Enrollment profiles. You can hide this pane to reduce setup interactions and provide a more streamlined enrollment experience on supported iPhone and iPad devices.

For more information, see Set up automated device enrollment for iOS/iPadOS.

Upgrade an existing Android Enterprise connection to a managed Google domain

Microsoft Intune now supports an optional upgrade for tenants that connected Android Enterprise with a Gmail account. You can link the enterprise to a managed Google domain and manage the Google-Intune connection with your Microsoft Entra work account instead. Start at Devices > Enrollment, select Android, and under Prerequisites, select Managed Google Play.

For more information, see Connect your Intune account to your managed Google Play account.

Device management

Updated minimum supported version for iOS and iPadOS

Microsoft Intune now requires iOS/iPadOS 18 or later for standard device-management, Company Portal, and app-protection scenarios. Administrators should identify and upgrade affected devices. Userless devices enrolled through Automated Device Enrollment have a separate support statement.

New single device page becomes the default experience in the Intune admin center

Microsoft Intune now uses the new single device page as the default experience for all admins, and the previous device page is no longer available. In Devices > All devices, select a device to view details and properties, monitor activity, access tools and reports, and perform supported actions from a consistent layout across platforms. Existing device-management capabilities remain available.

For more information, see See device details in Microsoft Intune.

Device security

Configure MDE AI agent runtime protection for Windows

Microsoft Intune now includes Microsoft Defender for Endpoint AI agent runtime protection settings in the new endpoint security template for Windows. You can use Audit mode to detect and alert on unsafe AI agent activity without blocking it, or Block mode to stop threats before they execute. These settings support Windows devices managed through Intune or MDE security settings management.

For more information, see AI agent runtime protection with Microsoft Defender for Endpoint.

Onboard MDM compliance partners with new self-service functionality

Microsoft Intune now supports bring-your-own connector functionality for MDM compliance partners. Partners can build, test, and onboard compliance connectors using Intune documentation, contracts, and validation hooks. As an admin, you can opt in to a partner connector by providing the vendor's information in the Microsoft Intune admin center, speeding partner onboarding and expanding the compliance solutions available to your organization.

For more information, see Self-service onboarding for compliance partners.