What's New in Microsoft Intune, October 2026 (18 Changes You Need to Know)

Eighteen changes landed in Microsoft Intune in October 2026: four weekly drops (October 5, 12, 19 and 26) and service release 2610, with fourteen changes on its own. A few of them need you to act. Here’s every one, sorted into three groups: act now, worth knowing and quick hits.

Microsoft rolls each release out gradually, over several days to a week, so if something isn’t in your tenant yet, give it a little time. Source for everything below: What’s new in Microsoft Intune on Microsoft Learn.

Act now

Administrator protection for Windows 11

Administrator protection is a Windows 11 feature built on least privilege. Even a local admin works with a standard token. When something needs admin rights, like installing software, Windows asks the user to approve it with Windows Hello. A hidden, system-managed account then creates a separate admin token just for that task, and the token is gone when the app closes.

Intune added the two settings that control it: the type of Admin Approval Mode (which turns it on) and the elevation prompt behavior. They’re in endpoint security Account protection policies, and in the settings catalog for Windows 11 24H2 and 25H2.

The part to watch: if you apply Microsoft’s Windows security baselines through Group Policy, the October 2026 Windows security update turns Administrator protection on by default. The Intune security baseline for 26H2 doesn’t include this setting, so on Intune-only devices nothing changes until you configure it. Either way, it takes effect after a restart.

Microsoft lists places where it shouldn’t be enabled today, like Windows 365 Cloud PCs, Azure Virtual Desktop session hosts, devices that need Hyper-V and devices managed with LAPS. See Administrator protection for the full list, and test with a pilot group first.

Security baseline for Windows 11, version 26H2

New settings, updated defaults and revised guidance. Existing baseline profiles don’t update themselves: create a new profile, or update an existing one to the latest version, and review your customizations first. Configure NetBIOS settings is left out on purpose because it only works on Insider builds today.

Scoped permissions for role-based access control (GA)

Until now, when one admin group had two role assignments in the same permission category, Intune merged them. Example: App Admins with read-only access to apps tagged Headquarters and full control of apps tagged Regional Office ended up with full control in Headquarters too. With scoped permissions on, each assignment’s permissions stay inside its own scope tag.

Two things before you switch it on: run the Permissions Assessment Report (Tenant administration > Roles > Settings) to see which groups would lose access, and know that enabling it is one-way. See scope tags and scoped permissions.

Apple: Setup Assistant (legacy) retired

For automated device enrollment with user affinity on iPhone, iPad and Mac, Setup Assistant (legacy) is gone. Existing profiles that used it were switched to Setup Assistant with modern authentication, and devices that are already enrolled stay enrolled. Worth testing the modern flow so you know what new users see.

Apple: legacy MDM software update workloads removed

Apple removed the old MDM software update commands in OS 27, so Intune removed those workloads. Apple updates now go through declarative device management (DDM), which supports iOS/iPadOS 17 and later and macOS 14 and later. See Apple software updates.

Windows: faster script delivery and a new firewall endpoint

Intune now uses push notifications when a Windows script changes, so devices check in sooner instead of waiting for the normal polling interval. Push connectivity also improved for device actions, Win32 apps, PowerShell scripts and remediations. Microsoft recommends allowing this endpoint in your firewall: *.trouter.communications.svc.cloud.microsoft.

Worth knowing

• Certificate connector health. The admin center now shows the health of the Certificate Connector for Intune (Active, Warning, Action required) with guidance for problems like the connector not reaching your certification authority or missing permissions. See the connector overview.
• STIG audit baselines in commercial tenants. Audit only: Windows devices are checked against the Windows 11 STIG (197 rules) with pass or fail per setting and device, and nothing is changed. It needs Intune Advanced Analytics, which is licensed beyond Intune Plan 1; check Intune licensing.
• AI agent runtime protection. The endpoint security template is generally available, plus a new AI agent runtime inspection setting. Defender for Endpoint inspects what local AI agents read and do (for example hidden prompt-injection instructions) and audits or blocks the action. See AI agent runtime protection.
• Enforce Routes in Apple VPN profiles. Choose Include all networks and Exclude local networks, and Intune works out the Enforce Routes value, so traffic doesn’t slip around the tunnel. It applies to device-wide VPN, not per-app VPN.
• Apple OS 27 device inventory. More DDM status data, like hardware component health, content cache status, enrollment type and lockdown mode.
• Unlimited VPP licenses. Volume purchase program apps can be assigned with unlimited licenses from Apple Business and Apple School Manager.

Quick hits

• Bulk eSIM activation on corporate-owned Android Enterprise devices (fully managed, dedicated and corporate-owned work profile), up to 100 devices at a time on Android 15 and later. A bulk wipe keeps eSIM data plans unless you choose to remove them.
• Referenced apps on AOSP: manage apps already on the device by package name. Required unhides the app, Uninstall hides it.
• MEFERI OEMConfig app supported on Android Enterprise.
• Remote Help for Windows 5.2.1210.0, with stability and observability improvements.

Your October to-do

1. Decide on Administrator protection and pilot it.
2. Move to the Windows 11 26H2 security baseline.
3. Run the Permissions Assessment Report before you turn on scoped permissions.
4. Test Setup Assistant with modern authentication for Apple ADE.
5. Move Apple software updates to DDM.
6. Allow *.trouter.communications.svc.cloud.microsoft in your firewall.

Which of these eighteen changes affects your tenant most? Tell me in the comments on the video.