Endpoint Management Newsletter – April 20 – May 10, 2026

Introduction

Hello,

May has properly arrived in Sweden. The light is staying late, the trees are finally green again, and Walpurgis weekend feels like a long time ago already. It has been three weeks since the last edition, so this one is a bit fuller than usual.

One item worth calling out from this period:

Hotpatch flips on with the May 2026 security update (Microsoft Tech Community) Starting with this month’s security update, Windows Autopatch enables hotpatch security updates by default for eligible devices. The April baseline was the prerequisite. The tenant-wide opt-out has been in the Intune admin center since April 1, and per-device control is via quality update policies. Review the Hotpatch quality updates report in Intune before the rollout reaches your fleet.

https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-news-you-can-use-april-2026/4516352

Hope you have a good week.

/Daniel

News from Microsoft

• What’s New in Microsoft Intune – April https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-april/4493135
  
• Windows 365 and Azure Virtual Desktop: Expanding access https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-365-and-azure-virtual-desktop-expanding-access/4515931
  
• Public preview: User-initiated provisioning for Windows 365 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/public-preview-user-initiated-provisioning-for-windows-365/ba-p/4512474
  
• Protect your estate: Reassess your Windows update policies https://techcommunity.microsoft.com/t5/windows-it-pro-blog/protect-your-estate-reassess-your-windows-update-policies/ba-p/4515228
  
• Dynamically remove apps from managed Windows 11 devices https://techcommunity.microsoft.com/blog/windows-itpro-blog/dynamically-remove-apps-from-managed-windows-11-devices/4516291
  
• Speed where it matters: How Microsoft Intune helps IT prioritize time-sensitive actions https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/speed-where-it-matters-how-microsoft-intune-helps-it-prioritize-time-sensitive-a/4515942
  
• Unpacking Endpoint Management is back https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/unpacking-endpoint-management-is-back—and-we%E2%80%99ve-got-a-lot-to-talk-about/4514599
  
• What’s new in version 2603 of Configuration Manager current branch https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/changes/whats-new-in-version-2603
  
• Migrating frontline mobile devices: Aligning stakeholders before real-world testing https://techcommunity.microsoft.com/blog/IntuneCustomerSuccess/migrating-frontline-mobile-devices-aligning-stakeholders-before-real-world-testi/4516511

Intune updates from the community

• Introducing cross-tenant support for MAM on Windows devices – Peter van der Woude @pvanderwoude https://petervanderwoude.nl/post/introducing-cross-tenant-support-for-mam-on-windows-devices/
  
  The cross-tenant MAM story closes a long-standing gap. You can now run multiple browser profiles on a single Windows device, each MAM-enrolled into a different tenant, with downloads steered into the correct home tenant. If you have MSP, contractor, or BYOD scenarios that previously forced full enrolment, this is the post to read first.
  
• Protecting downloads in MAM enrolled profiles on managed Windows devices – Peter van der Woude @pvanderwoude https://petervanderwoude.nl/post/protecting-downloads-in-mam-enrolled-profiles-on-managed-windows-devices/
  
• Locking down Windows devices by suppressing key combinations – Peter van der Woude @pvanderwoude https://petervanderwoude.nl/post/locking-down-windows-devices-by-suppressing-key-combinations/
  
• Microsoft Intune All Apps Now in Device View Simplifies App Troubleshooting for IT Admins – Anoop C Nair @anoopmannur https://www.anoopcnair.com/microsoft-intune-all-apps-now-in-device-view/
  
• Set Up and View App Inventory Data in Intune – Jorgeasaurus @Jorge2990 https://jorgeasaur.us/set-up-and-view-app-inventory-data-in-intune
  
• May the Apps Be With You: Intune’s New Enhanced App Inventory Dashboard – Kevin Malinoski https://malinoski.me/2026/05/06/may-the-apps-be-with-you-intunes-new-enhanced-app-inventory-dashboard/
  
• App Inventory in Intune just got a serious Upgrade – Joost Gelijsteen https://joostgelijsteen.com/app-inventory-in-intune-just-got-a-upgrade/
  
• App Discovery in Intune: a closer look at the modern app inventory – Michael Frank https://michaelsendpoint.com/intune/ModernApp.html
  
• IntuneAutomate now released and available – Andy Jones https://move2modern.uk/index.php/2026/04/23/intuneautomate-now-released-and-available/
  
• Wrap any PowerShell script to add or remove programs – Mr T-Bone https://www.tbone.se/2026/04/30/wrap-any-powershell-script-to-add-remove-programs/
  
• Cleanup Remediations: The Forgotten Half of Endpoint Hygiene – Simon Hartmann Eriksen https://www.simsenblog.dk/2026/05/05/cleanup-remediations-the-forgotten-half-of-endpoint-hygiene/
  
• Closing Intune’s macOS MAM Gap: A Cyber Essentials BYOD Guide – Andy Jones https://move2modern.uk/index.php/2026/04/28/managing-macos-byod-devices-with-intune-closing-the-mam-gap-for-cyber-essentials/
  
• Apple’s Stricter TLS Requirements Are Coming, Here’s Why Intune Admins Can Relax – Somesh Pathak https://intuneirl.com/apples-stricter-tls-requirements-are-coming-heres-why-intune-admins-can-relax/
  
• Automatically populate an Entra device group based on a registry key – Damien Van Robaeys @syst_and_deploy https://www.systanddeploy.com/2026/04/automatically-populate-devices-group.html
  
• Guest device join type, surfaced via Log Analytics KQL – Jóhannes Geir Kristjánsson https://johannesblog.com/2026/05/01/guest-device-join-type/
  
• Microsoft 365 Agents Explained: What Agents 365 Means – Jannik Reinhard https://jannikreinhard.com/2026/05/05/microsoft-365-agents-explained-what-agents-365-means/
  
• Blocking Bring Your Own Copilot (BYOC) on work documents – Ewelina Paczkowska https://www.welkasworld.com/post/blocking-bring-your-own-copilot-byoc-on-work-documents

ConfigMgr updates from the community

• ConfigMgr CB2509 Hotfix Rollup KB36949461 released with important bug fixes – Juerg Koller @juergkoller https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2509/36949461
  
• ConfigMgr 2603 Introduces New Early Update Enrollment Process – Anoop C Nair @anoopmannur https://www.anoopcnair.com/configmgr-2603-introduces-new-early-update/
  
  ConfigMgr 2603 went live in the Early Update Ring on May 5. Opt-in is via the EnableEarlyUpdateRing2603.ps1 PowerShell script and only applies to environments running 2409 or later. If you plan to roll forward this summer, this is the entry point to start your evaluation.
  
• SCCM 2603 Upgrade: A Step-by-Step Guide – Prajwal Desai https://www.prajwaldesai.com/sccm-2603-upgrade/

Windows updates from the community

• Azure Virtual Desktop Hybrid Explained – Dieter Kempeneers https://kempeneers.eu/2026/05/06/azure-virtual-desktop-hybrid-explained/
  
• Using a Windows 365 Cloud PC via a USB-C connected iPhone – Niall Brady https://www.niallbrady.com/2026/04/26/using-a-windows-365-cloud-pc-via-a-usb-c-connected-iphone/
  
• Migrate your Apple devices in minutes and not hours – Jan Mulder https://wolkenman.wordpress.com/2026/05/03/migrate-your-apple-devices-in-minutes-and-not-hours/
  
• Enable Defender updates during OOBE – Jan Mulder https://wolkenman.wordpress.com/2026/04/28/enable-defender-updates-during-oobe/
  
• Securing the DaaS environment: Protecting the management platform – Dominiek Verham https://dominiekverham.com/securing-the-daas-environment-protecting-the-management-platform/

Powershell updates from the community

• InTUI v1.0.1: A TUI for Intune reporting via Microsoft Graph – Jorgeasaurus @Jorge2990 https://github.com/jorgeasaurus/InTUI

A clean PowerShell-based terminal UI for Intune reports, app assignments, and policy views. Worth a look if you live in the console.

Seen on X (Twitter)

• Microsoft Intune interactive click-through guides Useful for onboarding new admins or refreshing your own knowledge. A click-through walkthrough of the Intune admin center, free to use. @scdudes https://regale.cloud/microsoft/play/2980/intune-home#/0/1
  
• App Discovery / Enhanced App Inventory dominated the period The new App Discovery dashboard via the Properties catalog is the standout Intune change. Multiple community voices (Jorgeasaurus, Michael Frank, Kevin Malinoski, Joost Gelijsteen) published walkthroughs and troubleshooting tips within days of each other. If you have not yet enabled the new device configuration policy that triggers more frequent uploads, that is the first step.
  
• ConfigMgr 2603 in Early Update Ring (May 5) Opt-in only via EnableEarlyUpdateRing2603.ps1, and only available to 2409 and later environments. Compliance check service deprecation is flagged for October 2026, so this update needs to land before then on co-managed environments.
  
• ABM, ABE, and Business Connect are now Apple Business Reminder for everyone managing Apple devices via Intune: Apple consolidated Apple Business Manager, Apple Business Essentials, and Apple Business Connect under the new Apple Business brand. Documentation and onboarding guides may need updating.