Welcome back, and I hope you got some proper summer. I have been away a fair bit myself, including a trip to Hungary to watch the F1 at the Hungaroring, which was a fantastic experience. The sound and the pace simply do not come across on a screen. The rest of the summer went to plenty of activities with the family, so I kept the newsletter quiet while the sun was out. This is a longer catch-up edition covering mid July into early August. A calmer stretch for big announcements, but the July servicing and a couple of dates worth planning around make it worth a read.
Some highlights:
- The July Intune release (2607) is out, with a better sync and macOS compliance. Full on-demand sync for Windows now pulls policy, apps and scripts in a single check-in and triggers both the MDM and the Intune Management Extension check-in, which is handy for incident response. The per-device sync view in the admin center also shows live progress now, so you can see where a sync is instead of guessing. Custom compliance settings for macOS reached general availability, and there is now more control over Samsung firmware updates through a new Knox E-FOTA integration. https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-july/4537392
- Microsoft also shared a good efficiency story worth knowing about. The new Export API for compliance reporting turns a bulk compliance pull into one job instead of one Graph call per device. In Microsoft’s own example, a 50,000-device nightly compliance job dropped from about two and a half hours to 15 minutes, cutting roughly 100,000 API calls down to about 15, with the same output schema so nothing downstream needs to change. Worth checking if your own reporting scripts still loop device by device. https://techcommunity.microsoft.com/blog/intunecustomersuccess/from-hours-to-minutes-rethinking-microsoft-intune-compliance-reporting-with-the-/4540554
- Windows now has an admin control for the new SSO sign-in prompt. The AutoAcceptSsoPermission policy, a registry value under HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD, auto-accepts the “Continue to sign in?” prompt on managed, Entra-joined devices. It is most relevant if you have users in the EEA, who are the ones actually seeing the prompt. It needs Windows 11 24H2 or 25H2 with the July security update, and since there is no Settings Catalog entry for it yet, you will deploy it via a remediation script, a Win32 app, or Group Policy/Configuration Manager instead. https://techcommunity.microsoft.com/blog/windows-itpro-blog/now-available-admin-control-for-sso-prompts-in-windows/4534613
- Windows 11 25H2 remains the version to standardize on. It has been the standard feature release for existing devices since last September, and Microsoft has not yet confirmed a date for 26H2, which is expected later this year as another low-effort enablement package from 24H2 or 25H2. If your rings are not on 25H2 yet, now is the time: it keeps you clear of the 23H2 end-of-servicing date below and keeps fall servicing simple. https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
Looking ahead to the fall
A few things are already worth putting on the planning board before they turn into last-minute work.
- The near-term servicing date for enterprise estates is 10 November 2026, when Windows 11 23H2 Enterprise and Education reach end of updates. If you still have 23H2 in the field, plan the move to 25H2 before then. 24H2 Enterprise and Education runs on until October 2027, so there is no pressure there.
- If you still run Configuration Manager, version 2609 arrives in September as the first release under the new annual cadence, so plan that upgrade with the 18-month support window in mind. The quieter one to watch is a deprecation in October of an internal service used for device compliance checks. In co-managed setups where Intune owns the Compliance workload, Software Center compliance checks can start failing after that, so apply 2603 or later before October and you avoid it.
- Fall is also budget season. With Intune Suite capabilities rolled into Microsoft 365 E3 and E5 since July, it is worth auditing what you already have turned on before you sign off on anything for next year. I keep finding tenants paying for tools that now overlap with something already in the license.
Hope you have a good week.
/Daniel
Table of Contents
Intune updates from the community
AutoAcceptSsoPermission: the Continue to Sign In prompt fix https://call4cloud.nl/continue-to-sign-in-prompt-autoacceptssopermission/ Rudy Ooms
Digs into exactly what the setting changes, including how Windows’ region-based sign-in rules factor into when the prompt shows up in the first place.
Taking back control: managing the new Entra SSO prompt via Intune https://osddeployment.tech/2026/07/17/taking-back-control-managing-the-new-entra-sso-prompt-in-windows-via-intune/ Per Larsen
Per deploys AutoAcceptSsoPermission as an Intune Proactive Remediation, a detection-and-remediation script pair that suppresses the prompt on managed devices only, which is the practical way to roll this out until it gets a proper Settings Catalog entry.
Auto-accepting the “Continue to sign in” SSO prompt with Intune https://sastu-insights.com/posts/Auto-Accepting-the-Continue-to-Sign-in-SSO-Prompt-with-Intune/ Sastu Insights
Covers the same policy with a second deployment option worth knowing: a Win32 app that applies the setting to new Autopilot devices before first sign-in, alongside the remediation-script route for existing ones.
What’s new for Android Enterprise in Microsoft Intune 2607 https://www.nickydewestelinck.be/2026/08/07/whats-new-for-android-enterprise-in-microsoft-intune-2607-july-2026-highlights/ Nicky De Westelinck
Beyond passwords: certificate-based authentication for Android Enterprise https://www.nickydewestelinck.be/2026/07/23/beyond-passwords-certificate-based-authentication-for-android-enterprise/ Nicky De Westelinck
Certificate-based authentication on Windows with Cloud PKI https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/ Nicky De Westelinck
Nicky’s been on a passwordless-authentication streak this period, covering Cloud PKI certificate-based auth on Windows, the same approach for Android Enterprise, and a broader look at what else landed for Android Enterprise in the July release.
Intune Multi Admin Approval now enforced on Graph API calls https://jannikreinhard.com/intune-multi-admin-approval-graph-api/ Jannik Reinhard
If you run any app-based Graph automation, read this first. Multi Admin Approval now intercepts app-authenticated Graph calls too, returning a 403 with error code ApprovalRequired until the approval flow completes or the app is excluded, so pipelines can start failing until you account for it.
Enterprise App Management auto-update is now generally available https://jannikreinhard.com/intune-enterprise-app-management-auto-update/ Jannik Reinhard
Custom compliance comes to macOS, going beyond the built-in policy https://intuneirl.com/custom-compliance-comes-to-macos-going-beyond-the-built-in-policy/ Somesh Pathak
A deeper look at the custom compliance settings for macOS that reached general availability this period (see the highlight above): discovery scripts, JSON rules, and a CIS Benchmark Level 1 example covering 26 macOS security checks.
Intune assignment filters for every in-support Windows build https://msendpointmgr.com/2026/08/01/intune-assignment-filters-windows-builds/ Ben Whitmore
Pulls every in-support Windows build straight from Microsoft Graph and generates Intune assignment filters from it, so you are not maintaining build numbers by hand.
Intune – you can now view live Windows device synchronization status https://blog.hametbenoit.info/2026/08/05/intune-you-can-now-view-live-windows-device-synchronization-status/ Benoit Hamet
A hands-on look at the live sync-progress view that shipped in the July release, useful to see in action before you rely on it during an incident.
Intune – you can now inventory registry keys https://blog.hametbenoit.info/2026/08/07/intune-you-can-now-inventory-registry-keys/ Benoit Hamet
Walks through the new Registry Inventory capability in the Properties Catalog: point it at up to 100 keys or values, no custom discovery script required, and the results land in Device Inventory for troubleshooting and compliance checks.
Nobody talks about Intune application migration https://www.systemcenterdudes.com/nobody-talks-about-intune-applications-migration/ Benoit Lecours
A good reminder that the hard part of an SCCM-to-Intune migration is usually the app estate, not device enrollment. Worth a read if app migration is still ahead of you.
How to configure Intune Remote Help (step-by-step guide) https://www.systemcenterdudes.com/how-to-configure-intune-remote-help-step-by-step-guide/ Benoit Lecours
Bulk reprovisioning of Windows 365 Cloud PCs in grace period using Intune https://www.anoopcnair.com/bulk-reprovisioning-of-windows-365-intune/ Vaishnav K
Lets you select multiple Cloud PCs in grace period and reprovision them in one action instead of one at a time, a useful bit of cleanup before deprovisioning.
First look at agents, part 5: the Security Store https://gerryhampsoncm.blogspot.com/2026/07/my-first-look-at-agents-part5-security.html Gerry Hampson
Gerry’s series shifts from native Intune agents to the Microsoft Security Store, a marketplace for third-party agents that plug into Sentinel, Entra and Defender.
Windows updates from the community
Windows 11 July 2026 Patch Tuesday: security fixes, quality improvements, and what IT admins need to know https://harjit.us/windows-11-july-2026-patch-tuesday-security-fixes-quality-improvements-and-what-it-admins-need-to-know/ Harjit Dhaliwal
Worth prioritizing: this update (KB5101650) addresses around 570 vulnerabilities, including two that were already being actively exploited, plus 59 rated critical. Get it deployed if you have not already.
Configuration Manager updates from the community
7-Zip updates without a third-party patching solution https://insideconfigmgr.wordpress.com/2026/07/26/7-zip-updates-without-3rd-party-patching-solution/ Praveen Gururaj
A PowerShell script that pulls the latest 7-Zip release straight from GitHub, ready to wire into a Configuration Manager application and detection method. The same script works for an Intune deployment too if you are not relying on 7-Zip’s own auto-update.
Other updates from the community
Following up on Windows 365 Reserve https://www.niallbrady.com/2026/07/30/following-up-on-windows-365-reserve/ Niall Brady
Niall’s follow-up after living with Windows 365 Reserve for a couple of weeks, reporting how the provisioning experience held up.
Entra ID enables blocking for nested security groups https://office365itpros.com/2026/08/03/blocking-for-nested-security-groups/ Tony Redmond
A new disableNesting property, settable only when a group is created, stops a group from being nested inside another or containing nested groups. It is Graph/PowerShell-only for now, but it is a useful way to keep membership in your privileged or sensitive-access groups explicit and auditable.
Offboarding from Microsoft Defender for Endpoint https://textslashplain.com/2026/07/22/offboarding-from-microsoft-defender-for-endpoint/ Eric Law
A gotcha worth knowing: removing a device from AD or Intune does not offboard it from Defender for Endpoint, and that status does not show up in the Windows Security app. Proper offboarding needs a signed offboarding script from the org, since Tamper Protection blocks manual registry cleanup.
Intune and AI, Shadow AI detection and prevention https://wolkenman.wordpress.com/2026/08/03/intune-and-ai-shadow-ai-detection/ Jan Mulder
Tests Microsoft’s Shadow AI detection (via the Microsoft 365 admin center) against a locally installed AI agent on a Windows 365 Cloud PC, including what Defender catches and an Intune-generated blocking baseline.
Seen on X
Andres Bohren 🇨🇭 (@andresbohren): new Microsoft Graph PowerShell modules, version 2.39.0, are out.
@rnabmitra: Microsoft Intune is ending support for the legacy “Setup Assistant” authentication method for Apple ADE. Switch to Setup Assistant with modern authentication.
@rnabmitra: A rundown of what shipped in Intune 2607 (July): updated Windows device sync, custom compliance for macOS, Samsung firmware updates, and multi-managed accounts for MAM/APP.
Maurice Daly [MVP] (@modaly_it): BIOS firmware updates done properly across both Configuration Manager and Intune, built with the Driver Automation Tool.
Nicky De Westelinck (@NDeWestelinck): Microsoft is quietly shipping a new “OneDrive Photos” app to Windows 11. He built a Proactive Remediation script to remove it from managed devices, with detection and remediation scripts on GitHub.
Imran Awan (@imran76awan): Windows Hello for Business can quietly fall back to a software key instead of a TPM if RequireSecurity is not set. New podcast episode on how to check for it and fix it.
Florian Salzmann [MVP] (@FlorianSLZ), built with Jannik Reinhard: a browser-based tool to read CMTrace logs, no install needed, try it at cmtrace.dev.
Windows Forum (@windowsforum): more on OneDrive Photos landing on managed Windows 11 Enterprise PCs without Intune’s blessing, and tripping up work accounts, see the full thread.
Adam Gell (@AdamGell): a free, open-source CMTrace replacement that parses ConfigMgr, Intune IME and Autopilot ESP logs plus .evtx files, with real-time tailing and error-code lookup, find it at CMTrace Open on GitHub.