Microsoft Intune: Week of October 26, 2026 (Service release 2610)

App management

Manage referenced apps on AOSP devices

Microsoft Intune now supports AOSP referenced app type that lets you identify an app by package name instead of uploading an APK on AOSP devices. You can assign Required or Uninstall intent to OEM, preloaded, or externally deployed apps that already exist on supported AOSP devices. Required makes an existing app unhidden, while Uninstall hides it. You'll also be able to target referenced apps with JSON-based app configuration policies; Configuration designer and Connected Apps won't be supported. This capability will help organizations manage device-resident apps without adding a new app distribution path.

Device configuration

Enforce Routes capability in Apple VPN profiles

Microsoft Intune now supports Apple's Enforce Routes capability in iOS/iPadOS and macOS VPN profiles. Admins define routing behavior with Include all networks and Exclude local networks, and Intune automatically derives the appropriate Enforce Routes configuration. This helps reduce VPN traffic bypass and de-cloaking risks while keeping routing behavior consistent with Apple's platform semantics.

For more information, see Add VPN settings to Apple devices in Microsoft Intune.

Legacy Apple MDM software update workloads removed from Intune

Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. Admins should use Apple declarative device management update policies to continue managing software updates. This keeps Intune UI, Graph, and documentation aligned with supported Apple capabilities and provides a clearer path for future update deployments.

For more information, see Move to declarative device management for Apple software updates.

Add support for the MEFERI OEMConfig app on Android Enterprise

Microsoft Intune now supports the MEFERI OEMConfig app (com.meferi.oemconfig) for Android Enterprise devices. Admins can use the existing Intune OEMConfig workflow to deploy settings exposed by MEFERI's OEM-provided schema, expanding supported device management options without custom workarounds. Add the app from Managed Google Play, assign it, and create an OEMConfig profile for the bundle.

For more information, see Use OEMConfig on Android Enterprise devices in Microsoft Intune.

Device enrollment

Setup Assistant legacy deprecation for Apple enrollment profiles

Intune has ended support for Setup Assistant (legacy) authentication for iOS/iPadOS and macOS automated device enrollment (ADE) with user affinity to align with modern authentication standards. Existing profiles are automatically updated to Setup Assistant with modern authentication, and the legacy option is no longer available when creating or editing profiles; already-enrolled devices remain enrolled and aren't affected.

Device management

Administrator protection settings in Account protection policies

Microsoft Intune now includes two Administrator protection settings in endpoint security Account protection policies. On supported Windows 11 versions, admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior for Administrator protection.

For more information, see Account protection policy.

Push notification support update for Windows devices

We've improved connectivity for scenarios that rely on push notifications including Device actions, Win32 apps, PowerShell scripts and Remediations. For the best experience, we recommend updating firewall rules to include this new endpoint:

• *.trouter.communications.svc.cloud.microsoft

For the current list of required network endpoints, see Network requirements for PowerShell scripts and Win32 apps and Windows Push Notification Services (WNS) dependencies in the Intune endpoints documentation.

Apple OS 27 DDM status data added to device inventory

Microsoft Intune now adds Apple OS 27 declarative device management status data to device inventory. Admins can review new inventory for: device health for hardware components, enhanced logging sessions, content cache status, and Apple MDM and security states such as enrollment type, awaiting configuration, and lockdown mode. Values depend on supported OS, hardware, enrollment, and DDM capabilities.

Device security

Updated Windows support for Administrator protection settings

Microsoft Intune now supports two Administrator protection settings in the settings catalog on Windows 11 versions 24H2 and 25H2. Admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior used with Administrator protection.

For more information, see Settings catalog.

Agent runtime protection settings are generally available

Microsoft Intune's endpoint security template for Microsoft Defender for Endpoint agent runtime protection settings is now generally available. Administrators can use the template to manage supported runtime protection settings for Windows devices without the preview designation, aligning Intune policy management with the Microsoft Defender for Endpoint general availability release. We have also added a new setting called AI agent runtime inspection to be configured in the template.

Monitor and troubleshoot

Certificate connector health monitoring in the Microsoft Intune admin center

The Certificate Connector for Microsoft Intune now surfaces health and status signals in the Microsoft Intune admin center, so you can spot certificate-issuance problems early. Clear indicators call out common failure conditions — such as the connector being unable to reach the certification authority (CA), the connector's service account lacking permission to issue or revoke certificates, or certificate requests being rejected because of a template mismatch with your PKCS profile. Each signal includes guidance to help you investigate and remediate before devices relying on certificate-based authentication hit access, sign-in, or compliance issues.

For more information, see Certificate Connector for Microsoft Intune.

Role-based access control

Scoped permissions for role-based access control are generally available

Microsoft Intune scoped permissions for role-based access control are now generally available. Permissions from role assignments with different scope tags are applied independently instead of being merged, giving admins the intended access within each scope. Use the Permissions Assessment Report before enabling scoped permissions to review how access will change.

For more information, see Permission behavior across role assignments.

Scripts

Faster delivery of Windows scripts

Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Windows scripts. Managed devices can check in sooner after script changes, reducing delivery and refresh delays compared with waiting for the normal polling interval. This update improves script deployment responsiveness without requiring a new admin workflow.