Endpoint Management Newsletter – March 9 – April 5, 2026

Introduction

Hello,

This edition is a little later than planned. I normally stick to a bi-weekly schedule, but due to some personal stuff I did not manage to publish after March 8, and instead I focused on the Easter newsletter. Back now with a slightly longer edition covering March 9 – April 5!

The one thing I want to highlight this time is Intune hardening. After the reported Stryker incident (where legitimate endpoint management actions were abused to cause major disruption), CISA also urged organizations to harden endpoint management systems. Treat Intune like critical infrastructure.

Microsoft’s 3-step checklist is a solid starting point:
1. Least-privilege roles built around real admin jobs (avoid broad Entra roles for daily work)
2. Phishing-resistant authentication + privileged access hygiene
3. Multi-Admin Approval for sensitive actions (start with wipe/retire/delete and role changes).

Relevant links:

• Microsoft Intune hardening best practices (Customer Success)
• CISA alert (endpoint management system hardening)
• Stryker coverage
• Intune Multi-Admin Approval (MAA) docs
• Intune RBAC
• Intune scope tags
• Microsoft Entra Privileged Identity Management (PIM)

Hope you have a good week!

/Daniel

Intune updates from the community

• How to Deploy Defender for Endpoint on macOS Using Intune – YouTube – Steve Weiner (@getrubix)
• Introducing Cloud Policy Preferences – MSEndpointMgr – Maurice Daly (@modaly_it)
• Intune Multi-Admin Approval: The Security Feature You Wish You’d Enabled Before Someone Pressed “Wipe All”! – Joymalya Basu Roy (@jbasuroy369)
• Intune Timing Demystified: The Truth About Intune Sync Intervals – Rudy Ooms (@Mister_MDM)
• Explore Microsoft Intune Multi Admin Approval MAA Scenarios | What is MAA in Intune? #msintune – YouTube – Vaishnav K (@vaishnavk93)
• Intune Multi Admin Approval | Protect WIPE, RETIRE & DELETE Actions – YouTube – Chander Mani Pandey (@Mani_CMPandey)
• Setup Intune Multi Admin Approval Email Notification – YouTube – Chander Mani Pandey (@Mani_CMPandey)
• Intune: Get Platform Script Output – René (@SirConfigmgr)
• Block Microsoft 365 Apps using Conditional Access Policy » Prajwal Desai (@PrajwalDesai)
• Configuring Copilot in Microsoft Edge using Intune » Prajwal Desai (@PrajwalDesai)
• Easy Method To Deploy Windows App Mob For IOS And IPadOS Using Intune HTMD Blog – Vaishnav K (@vaishnavk93)

Other updates from the community

• Handala Detection Pack v2: Pre-Positioning, PIM Gap, and Bulk Wipe Controls | ThreatHunter.ai – James McMurry
• Stryker attack wiped tens of thousands of devices, no malware needed – Ionut Ilascu (@Ionut_Ilascu)
• CISA Urges Organizations to Secure Microsoft Intune Environments Following Stryker Breach – Abinaya (@abinaya)
• Deploying Office Templates via Intune – The Full Picture :: HalfOnCloud – Radu Bogdan (@HeyRadu)
• Setting Adobe Acrobat Reader as the Default PDF Viewer via Intune :: HalfOnCloud – Radu Bogdan (@HeyRadu) (site may require verification)

Windows updates from the community

• All about Microsoft Intune | Understanding the profile assignment of multi-app kiosk mode on Windows 11 – Peter van der Woude (@pvanderwoude)
• All about Microsoft Intune | Restoring Windows during first sign-in – Peter van der Woude (@pvanderwoude)
• How to enable Intune Quick Machine Recovery – System Center Dudes – Benoit Lecours (@benoitlecours)
• How To Create Windows 365 Frontline Dedicated Cloud PCs Using Intune HTMD Blog – Vaishnav K (@vaishnavk93)
• How To Create Windows 365 Frontline Shared Cloud PC Using Intune HTMD Blog – Vaishnav K (@vaishnavk93)

Seen on X (Twitter)

• CMTrace Open 0.3.0 is out (DSRegCmd analysis, evidence bundle support, WHfB context) — Adam G (@AdamGell)
• Windows 365 recovery for Cloud PCs deprovisioned due to license expiration is now GA — Vaishnav K (@vaishnavk93)
• macOS LAPS: customize admin password rotation schedule (default 180 days) — @rnabmitra
• CMTrace Open v0.2.0 release thread — Adam G (@AdamGell)
• CISA endpoint management system hardening guidance checklist (MAA, RBAC, MFA) — Mike Walters (@CyberWalters)
• Driver Automation Tool 8 BETA has a home now (GitHub) — X post
• Driver Automation Tool v10.0.0 is coming (Intune package testing underway) — Maurice Daly (@modaly_it)
• CloudPolicyPreferences 1.0.11 (Tenant Data Encryption Keys) — Maurice Daly (@modaly_it)
• Apple Business Manager: new terms of service to accept April 14 — Jörgen Nilsson (@ccmexec)
• Intune Guardian: extended audit reporting (tool announcement) — Maurice Daly (@modaly_it)
• Secure Boot status not up to date script tip (WinCsFlags.exe /apply) — Trond Eirik Haavarstein