Hello there!
Late August in Sweden always feels like the real start of the year. The evenings are drawing in and the calendar is filling up again. It has been a good summer with a lot of sun and some travelling, and I am looking forward to some time indoors and the projects that come with it.
A calmer stretch for announcements, but the August Windows update fixes a problem the July one caused, where newly built devices showed up as non-compliant in Intune. Four servicing dates also land before mid-November, so it is worth a read.
Hope you have a good week.
/Daniel
Table of Contents
Some highlights
August Patch Tuesday fixes a compliance problem the July update caused. KB5121003 shipped on August 11, moving 24H2 to build 26100.9168 and 25H2 to 26200.9168. It addresses newly provisioned or recently restored devices running the July update or later that ended up incorrectly non-compliant after MDM enrollment and lost access to corporate resources. If you saw unexplained compliance failures on fresh builds in late July, the cause was on the Windows side rather than in your Intune configuration.
KB5121003 release notes
Registry inventory in Intune is documented, and the limits matter. A Properties catalog profile points at registry keys, the Microsoft Device Inventory Agent collects them, and results land in device inventory. HKEY_LOCAL_MACHINE only, 6 KB per value, 100 keys per device, up to 24 hours for the first collection. It retires a class of custom discovery scripts, but reporting is still per device rather than fleet-wide.
Collect device properties with Intune
MDOP is out of support, with no single replacement. Extended support ended on April 14, covering MBAM, App-V, DaRT, UE-V and AGPM. Microsoft is spreading the workloads rather than swapping products. BitLocker management goes to Intune with key escrow in Entra ID, App-V toward MSIX, and AGPM to the settings catalog with RBAC. DaRT is replaced by Windows RE and Quick Machine Recovery, and UE-V by Known Folder Move and Windows Backup for Organizations. Start with MBAM, since Intune is the most direct swap.
MDOP extended support announcement
What to do next with Microsoft Intune
News from Microsoft
How does Microsoft Intune support Agent 365?
Microsoft Learn
Microsoft updated this guidance on August 20, and it is worth a read even if agents are not on your plate yet, because it sets the direction Microsoft expects endpoint teams to take. Device posture becomes a governance signal. Conditional Access can require that agents run from compliant, Intune-managed devices, and app protection policies can keep corporate data out of unapproved AI tools.
Dates to plan around
Something new I am adding this edition, and keeping from now on. The dates that actually land on your change calendar, nearest first.
September 30, 2026
Configuration Manager 2503 reaches end of support. If you are still on 2503, move to 2509 or 2603. That is five weeks away and it is the most urgent item on this list.
October 13, 2026
A heavy Patch Tuesday. Windows 11 24H2 Home and Pro reach end of updates, the whole Office LTSC 2021 family reaches end of support, Windows 10 commercial ESU Year 1 ends, and Windows Server 2022 moves from mainstream to extended support.
October 31, 2026
Intune enforces Google’s updated Strong Integrity definition. Android 13 and later devices that have not had a security update in the past twelve months drop from Strong Integrity to Device Integrity. Compliance policies requiring Strong Integrity will start failing them, and Conditional Access will block them. Worth auditing your Android policies before then.
November 10, 2026
Windows 11 23H2 Enterprise, Education, IoT Enterprise and Enterprise multi-session reach end of updates. PowerShell 7.4 LTS and .NET 8 LTS end support the same day. 24H2 Enterprise and Education runs to October 2027, so the move to 25H2 has room if you start now.
Windows client supported versions
Products reaching end of support in 2026
On the radar with no date published yet. Windows 11 26H2 is confirmed to exist and will arrive as an enablement package, but Microsoft has not published a release date or any servicing dates for it. Configuration Manager 2609 is named as the first release on the new annual cadence, also with no date. And Intune moves to a minimum of iOS/iPadOS 18 and macOS 15 later this year, shortly after Apple ships iOS 27 and macOS 27, so an inventory pass on older Apple hardware is time well spent.
Intune updates from the community
Collecting Windows registry data
Peter van der Woude · @pvanderwoude
How to collect Windows registry data using Intune
Prajwal Desai · @PrajwalDesai
Two solid walkthroughs of the new registry collection capability from the highlight above, worth reading together. Peter covers the profile configuration and what the agent actually does on the device, and Prajwal is the faster read if you just want to get a profile deployed and see data.
Inside Intune’s new sync status window
Rudy Ooms · @Mister_MDM
The device Sync action now opens a live status pane that polls the service while the action runs. Rudy walks through why the counters do not map to Intune object types the way you would assume, with Scripts covering remediation scripts rather than platform scripts. Worth reading before your service desk starts treating those numbers as install counts.
Customizing the pinned folders in Start layout
Peter van der Woude · @pvanderwoude
Creating a Win32 app in Intune with PowerShell and Microsoft Graph
Ben Whitmore · @byteben
Walks through the full Graph flow in detail. Create the app record, add a content version and file entry, poll for the Azure Storage SAS URI, upload the encrypted payload in 4 MB blocks, commit with the encryption info, then patch the app to point at the committed version. The section on why the upload is the fragile part, and the honest treatment of how messy detection rules get in the real world, are the most useful parts if you are building or fixing an app pipeline.
Intune Remote Help, the deep dive now that it is included in your E5
Simon Skotheimsvik
Good timing given the Intune Suite capabilities that rolled into E3 and E5 in July. If Remote Help is now something you already pay for, this is the walkthrough for turning it on properly rather than just enabling the toggle.
Part 1: using Active Directory information on cloud-only devices to map printers and shares
Sascha Stumpler · @SasStu
Part 2: running a scheduled task only when Active Directory is actually reachable
Sascha Stumpler · @SasStu
A good treatment of a problem plenty of organizations still have, where the devices are Entra-joined but the file servers and print servers are not going anywhere.
Rather than hardcoding a mapping table, the AD group itself carries the mapping instructions in its info attribute. Adding a share becomes a directory task instead of a repackaging task.
Part 2 solves the timing problem. It uses the NetworkListManager CSP to earn the Domain firewall profile through TLS endpoint validation, then triggers on firewall event 2010 rather than at logon. Read the prerequisites carefully, because the whole design rests on picking an internal HTTPS endpoint that cannot be reached from outside.
The Autopilot readiness check Microsoft should have built
Steve Weiner · @getrubix
Governing Intune device wipes with Multi Admin Approval
Ketan Kamble
Multi Admin Approval turns a device wipe into a two-person action. Admin A raises the request with a justification and Admin B approves it, but the wipe does not run until Admin A goes back into My requests and completes it, which is the step people miss. Selective wipe and Autopilot reset are not covered, and requests expire after about three days.
How to create scope tags in Microsoft Intune
Prajwal Desai · @PrajwalDesai
Originally published in September 2025 and refreshed on August 11, so it is a returning reference rather than news. Still the guide to send someone when they are setting up RBAC scoping for the first time.
Windows updates from the community
Windows 11 KB5121003, the August 2026 Patch Tuesday update
Prajwal Desai · @PrajwalDesai
The practical write-up of this month’s update, including the build numbers and the MDM compliance fix covered in the highlights above.
Other updates from the community
Windows 365 Wednesdays, Windows 365 and Windows Autopatch
Jeroen Burgerhout · @BurgerhoutJ
Windows 365 Enterprise Cloud PCs are supported by Windows Autopatch, and registration can be enabled directly in the provisioning policy. Two things are worth knowing. The Learn documentation is inconsistent about what that section is called. And enabling it in a provisioning policy replaces any existing Autopatch configuration for those Cloud PCs, so check the registration status of your current estate rather than assuming a policy edit covers everything. The option is not available for Windows 365 Flex in shared mode.
Edge management service, extension monitoring
Jörgen Nilsson · @ccmexec
Monitoring in the Edge Management Service is now generally available and free, managed from the Microsoft 365 admin center rather than Intune. It gives you installed extension inventory, the extensions your users have requested, and Edge version reporting with recommended updates by channel. Reporting is off by default, so you need to turn on the monitoring and version toggles yourself. Data is Windows-only, it is not available to GCC tenants, and the security update alerts inside the dashboard are still in public preview. Check the page URL sharing option against your own privacy requirements before enabling that part.
Guide to prepare Windows 365 Cloud Apps using file paths of any application
Vaishnav K · @vaishnavk93
Walkthrough of registering applications as Cloud Apps by specifying the file path directly, rather than relying on Start menu discovery. Useful for line-of-business apps and internal tools that never registered a shortcut.
PowerShell 7.6.5 released
Andres Bohren · @andresbohren
7.6.5 landed on August 14. The headline fix is dot-sourcing behavior for pwsh -file with advanced-function scripts, plus build and packaging updates. Andres covers the MSI install and confirms the M365PSProfile module still works against it.
Find Entra P1 accounts to license for Conditional Access
Tony Redmond · @12Knocksinna
PowerShell that walks your enabled Conditional Access policies and resolves included and excluded users through group and directory role membership. It then compares that set against accounts holding an enabled Entra P1 or P2 service plan. Tony is careful to point out that this does not prove compliance, since Microsoft has not published a precise definition of Conditional Access license consumption. Useful if the Entra admin center has started flagging a licensing gap at you.
Seen on X
@rnabmitra posted a reminder that Intune’s Apple support keeps tracking newer iOS and macOS releases. Worth pairing with the minimum-version change in the dates section above.
Gary Blok published his first PowerShell Gallery module, OEMWrapPS. It wraps Dell management functions covering Dell Command Update install, invoke and manage, BIOS settings, device details and BIOS updates, plus some HP Softpaq functions. He flags bugs as likely and documentation as pending, so treat it as early days.
@tamai_pc pointed out that RDCMan (Remote Desktop Connection Manager) v3.20 can now connect to Azure Virtual Desktop and Windows 365. A small thing that quietly removes a workaround for anyone still living in RDCMan.
Vaishnav K highlighted that Windows 11 Enterprise Developer Configuration now includes Intelligent Terminal and Coreutils in public preview, aimed at getting development workloads running on Windows 365.