Table of Contents
Introduction
June is just around the corner here in Sweden and it is starting to feel like summer is finally arriving. This has been one of the more eventful periods in a while for endpoint management. ConfigMgr 2603 went globally available, and while the release itself is relatively quiet in terms of new features, the bigger news is that Microsoft has confirmed the move to an annual release cadence starting with version 2609. ConfigMgr is clearly entering a more stable, maintenance-focused phase, and I think that is actually a good thing. In my work I am seeing more and more customers who still need deep ConfigMgr competency, particularly in larger environments like factories and industrial settings where cloud-only management is simply not an option yet. That kind of solid infrastructure knowledge does not go away. If anything, it becomes more valuable as organizations navigate long migrations to modern management, not less.
Elsewhere this period: hotpatch is now the default for Autopatch-managed devices, Intune’s enhanced app inventory is generally available, and Secure Boot certificates start expiring in June. That last one is a concrete action item that should not wait.
Hope you have a good week.
/Daniel
News from Microsoft
Agent 365 generally available – Intune is part of the governance story
Microsoft made Agent 365 generally available on May 1. From an endpoint management perspective, the key part is the new local AI agent inventory. Starting with OpenClaw, Intune can now detect which managed Windows devices are running it via a new Shadow AI page in the Microsoft 365 admin center. Admins can apply Intune policies to block common execution methods. Defender will add asset context mapping in June 2026, covering MCP server connections and reachable cloud resources. Microsoft plans to expand detection to 18 agent types by June 2026, including GitHub Copilot CLI and Claude Code. This positions endpoint management as a central part of AI governance in the enterprise, not just something for the security team.
https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/
Microsoft 365 pricing changes effective July 1, 2026
Pricing and packaging updates for select Microsoft 365 commercial suites and standalones take effect July 1. Existing customers stay on current pricing until renewal and will receive at least 30 days notice in Message Center before packaging changes arrive in their tenant.
https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates
Intune updates
Enhanced App Inventory now generally available
Intune’s enhanced app inventory is now generally available for Windows. This is the long-term replacement for the older Discovered Apps experience. Where Discovered Apps had a seven-day refresh cycle and limited metadata, the new app inventory collects richer data including install paths, file sizes, uninstall commands, install dates, and architecture, and syncs multiple times per day. It is opt-in and requires a Properties Catalog policy to enable collection. Graph API support is planned but not yet available, making it portal-only for now.
Worth noting: the new inventory can also detect local AI agents like OpenClaw on managed devices, feeding into the Agent 365 Shadow AI page in the Microsoft 365 admin center.
https://learn.microsoft.com/en-us/intune/whats-new/
Hotpatch enabled by default for Windows Autopatch
Starting with the May 2026 Windows security update, hotpatch is enabled by default for all eligible devices managed through Windows Autopatch. Hotpatch installs security updates without requiring a restart, meaning faster protection and less disruption. If your organization is not ready, a tenant-level opt-out setting has been available in the Intune admin center since April 1.
https://learn.microsoft.com/en-us/intune/whats-new/
New device page in the Intune admin center (public preview)
A redesigned device detail page is available for preview in the Intune admin center. It consolidates device activity, tools, reports, properties, and hardware details into a single tabbed layout. Device actions are grouped consistently across platforms, with destructive actions separated and requiring confirmation. Enable it by toggling “Preview new device view” under Devices > All Devices.
https://learn.microsoft.com/en-us/intune/whats-new/
Windows 11 25H2 and Microsoft Edge v139 security baselines
Two new security baselines are available in Intune. The Windows 11 25H2 baseline reflects current Microsoft security recommendations with new settings, updated defaults, and retired settings. The Microsoft Edge version 139 baseline is also now available. Existing profiles do not update automatically.
https://learn.microsoft.com/en-us/intune/whats-new/
Autopatch update risk visibility report
A new Autopatch update risk visibility report extends the security update status dashboard. It classifies devices as Current, Exposed, or Critical and surfaces which policies are contributing to risk, helping admins identify and remediate gaps faster.
https://learn.microsoft.com/en-us/intune/whats-new/
macOS: Platform SSO during Automated Device Enrollment
On macOS devices enrolled with ADE, you can now run Platform SSO during device registration. Users get access to Entra ID resources immediately at the desktop rather than completing SSO setup separately after enrollment. Requires macOS 26 and Company Portal 5.2604.0 or newer.
https://learn.microsoft.com/en-us/intune/whats-new/
Intune RBAC roles now inherit Copilot access automatically
When Intune is enabled as a data source in Security Copilot, built-in and custom Intune RBAC roles now automatically inherit Security Copilot contributor access. The Intune Administrator role gets owner access. This removes the need for separate role assignments in Security Copilot.
https://learn.microsoft.com/en-us/intune/whats-new/
Direct Android LOB app management
Admins can now upload APK files directly to Intune and deploy them to Android Enterprise fully managed and dedicated devices without publishing through Managed Google Play. Applies to COBO and COSU enrollment types.
https://learn.microsoft.com/en-us/intune/whats-new/
Ubuntu 26.04 LTS support
Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Enrolled devices on 22.04 remain enrolled, but users should be notified to upgrade.
https://learn.microsoft.com/en-us/intune/whats-new/
Intune Management Extension minimum version updated
Windows devices must now run Intune Management Extension version 1.58.103.0 or later. Devices on older versions will no longer receive configurations dependent on IME, including Win32 apps, PowerShell scripts, and remediations. The extension updates automatically for devices that can sync with Intune.
https://learn.microsoft.com/en-us/intune/whats-new/
From the community
Set Up and View App Inventory Data in Intune @Jorge2990 https://jorgeasaur.us/set-up-and-view-app-inventory-data-in-intune
App inventory gives you richer Windows app data in Intune, but it is not enabled by default. This post walks through the Properties Catalog policy you need to configure and how to read the results in the portal, a practical first step for anyone enabling the feature.
Maintenance Windows for Intune Remediations Using Detection Scripts John Marcum @PJ_Marcum https://powerstacks.com/blog/intune-maintenance-windows-detection-script/
Using Sensitivity Labels for Protecting Labeled Content in Microsoft 365 Online Apps Peter van der Woude @pvanderwoude https://petervanderwoude.nl/post/using-sensitivity-labels-for-protecting-labeled-content-in-microsoft-365-online-apps/
ConfigMgr updates
ConfigMgr 2603 globally available
Configuration Manager 2603 became globally available on May 27, 2026. This release focuses on security hardening, stability, and hybrid management improvements rather than major new features.
Notable fixes include:
- EDR policy now applying correctly for tenant-attach-only devices (a regression from 2503)
- SQL Server Management Objects updated from deprecated SQL Server 2014 to SQL Server 2025 (SMO 17)
- ARM64 support corrected in the Import-CMDriver PowerShell cmdlet
- Client push installation failures on Windows 11 ARM64 devices resolved
To upgrade, your site must be running version 2409 or later.
Microsoft also confirmed ConfigMgr is moving to an annual release cadence starting with version 2609 in September 2026. So 2603 is effectively the last update before that model kicks in. Each version continues to receive 18 months of support.
Windows updates
May 2026 Patch Tuesday – KB5089549 and KB5087420
Microsoft released the May 2026 cumulative updates on May 12, patching 120 vulnerabilities. KB5089549 covers Windows 11 versions 25H2 and 24H2, while KB5087420 covers version 23H2. Both require a restart.
https://support.microsoft.com/en-gb/topic/may-12-2026-hotpatch-kb5089466-os-builds-26200-8390-and-26100-8390-8a0dd60b-c2fb-45d6-95f2-2609df309a9a
May 2026 Hotpatch – KB5089466
Hotpatch KB5089466 was released May 12 for Windows 11 Enterprise 25H2 and 24H2, including Arm64. This is the first month hotpatch is generally available for Arm64. The update covers the same security vulnerabilities as the cumulative update, without requiring a restart.
https://support.microsoft.com/en-gb/topic/may-12-2026-hotpatch-kb5089466-os-builds-26200-8390-and-26100-8390-8a0dd60b-c2fb-45d6-95f2-2609df309a9a
Secure Boot certificates expiring in June 2026
Windows devices with Secure Boot enabled and the older 2011-era certificates will start seeing those certificates expire in June 2026. The expiration does not block booting, but it removes early boot security protections. This also affects Azure Virtual Desktop session hosts, Windows 365 Cloud PCs, and gold images built on Secure Boot-enabled VMs. The fix can be deployed via an Intune settings catalog profile targeting the three Secure Boot settings, or via a registry key on gold images. If you have not addressed this yet, now is the time.
https://techcommunity.microsoft.com/blog/windows-itpro-blog/updated-secure-boot-status-report-in-windows-autopatch/4517920
HP BIOS updates causing boot loops
If you are pushing BIOS updates to HP devices as part of the Secure Boot certificate remediation, be aware of reported issues with HP commercial notebooks, desktops, and workstations. A BIOS update released in early April 2026 can trigger a BitLocker recovery screen on next boot. HP is investigating.
https://support.hp.com/us-en/document/ish_14914515-14914500-16
BitLocker Security Feature Bypass – CVE-2026-45585 “YellowKey”
Microsoft released a security update addressing CVE-2026-45585, a BitLocker Security Feature Bypass vulnerability. Worth tracking if you rely on BitLocker for device security.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
From the community
Managing Secure Boot Certificate Lifecycle with Intune Jon Towles @m0bilej0n https://mobile-jon.com/2026/05/28/managing-secure-boot-certificate-lifecycle-with-intune/
Updated Secure Boot Status Report in Windows Autopatch Jeroen Burgerhout @BurgerhoutJ https://techcommunity.microsoft.com/blog/windows-itpro-blog/updated-secure-boot-status-report-in-windows-autopatch/4517920
Secure Boot Certificates for Azure Virtual Desktop and Windows 365 Chris Cavazos @bigchrisatx https://bigchriscloud.com/2026/05/14/secure-boot-certificates-for-azure-virtual-desktop-and-windows-365/
Windows 365 updates
Autopilot Device Preparation Policies now GA for Windows 365
Autopilot Device Preparation Policies are now generally available for Windows 365, ensuring applications are installed and scripts run before a Cloud PC is considered provisioned.
https://learn.microsoft.com/en-us/windows-365/enterprise/whats-new
Windows 365 Boot: shared mode signs out on disconnect
Windows App (client 1.2.7207.0, May 26) now automatically signs users out when sessions disconnect in shared mode, ensuring Cloud PCs are properly released between users.
https://learn.microsoft.com/en-us/windows-app/whats-new
Windows 365 Business: 20% price cut and on-demand start
As of May 1, Microsoft reduced Windows 365 Business list prices by 20%. New subscriptions get the lower price immediately; existing subscriptions get it at next renewal. Cloud PCs now also stay powered on for one hour after sign-out or disconnect, reducing reconnect times within that window.
https://learn.microsoft.com/en-us/partner-center/announcements/2026-april
Windows Hybrid Benefit SKUs retired from sale
Windows 365 Business Windows Hybrid Benefit SKUs are no longer available for new purchase as of May 1. Existing customers can continue to renew their current subscriptions.
https://learn.microsoft.com/en-us/partner-center/announcements/2026-may
Free 50-hour Windows 365 for Agents trial
Microsoft is offering a free 50-hour trial of Windows 365 for Agents for building agents in Microsoft Copilot Studio.
https://m365accelerator.microsoft.com/blogs/windows-365-for-agents-AI-powered-workflows
From the community
Set Time Limit for Active But Idle Remote Desktop Services Sessions on Windows 365 Flex with Intune Vaishnav K @vaishnavk93 https://anoopcnair.com/set-time-limit-for-active-but-idle-intune/
Provisioning Windows 365 Frontline Shared Cloud PCs with Intune (video) Vaishnav K @vaishnavk93 https://youtu.be/Rg2IngKvAMw
Windows 365 Deployment and Licensing Options Travis Roberts @Ciraltos https://www.ciraltos.com/windows-365-licensing-explained-business-vs-enterprise-vs-frontline/
Seen on X (Twitter)
@PerLarsen1975 shared that Intune now supports inventory of local AI agents, building on the hardware and software inventory work of the last 15 months. A signal that AI governance is becoming a standard part of endpoint management.
@rnabmitra highlighted the new Local AI Agent Security Baseline for OpenClaw in Intune (preview), which applies firewall rules and runtime controls to limit how unauthorized local AI agents execute on managed devices.
@modaly_it flagged a timing issue worth watching: if you are pushing BIOS updates to HP devices for the Secure Boot deadline, some HP commercial devices are hitting boot loops. Check before you deploy broadly.
@scdudes pointed to click-through interactive guides for Microsoft Intune on regale.cloud, a solid hands-on learning resource worth bookmarking.
https://regale.cloud/microsoft/play/2980/intune-home#/0/1