Week of 18 May 2026 — Daily Intune News

Week in brief

EPM report access tightens as Intune flags device-reported compliance values as untrusted

The week was dominated by documentation maintenance—licensing-link moves, metadata changes, and template reshaping—but several updates carry concrete administrator consequences. EPM reporting guidance now describes an explicit permission requirement; Security Copilot guidance expands the documented default inheritance of Intune RBAC access; the Vulnerability Remediation Agent workflow and identity handling have changed; and new Cloud PKI guidance covers staged CA renewal. The supplied evidence contains no Message Center item and does not establish a new GA launch, retirement, or tenant-wide rollout.

Endpoint Privilege Management · Device security
EPM reports now require explicit View Reports permission
The updated EPM reporting article states that access through the Intune admin center or Microsoft Graph requires Endpoint Privilege Management Policy Authoring > View Reports, also identified as EpmPolicy.ViewReports. Users without it receive HTTP 403 responses from the report endpoint. The article says Device configurations > Read previously provided access. Review custom roles and reporting clients that depend on the older permission.
Security Copilot · Fundamentals
Security Copilot guidance expands default Intune-role access inheritance
When Microsoft Intune is enabled as a Security Copilot data source, the updated overview says the Microsoft Entra Intune Administrator role automatically inherits Security Copilot owner access, while all other built-in and custom Intune RBAC roles inherit Security Copilot contributor access. Existing Intune RBAC permissions and scope tags still limit accessible data and actions. Administrators can remove the default access by removing Intune roles from the Security Copilot contributor role.
Intune · Device security
Compliance guidance treats device-reported Setting values as untrusted input
The Monitor Policy update explains that some compliance reports include a Setting column populated directly by a device, application, or administrator-supplied script, including custom compliance and Android app configuration scenarios. Intune does not validate or enforce the content; values can contain free-form text, URLs, file paths, or identifying and environment-specific information, and may attempt to influence administrator behavior. Use these values only as context, confirm status through trusted workflows,
Security Copilot · Troubleshooting
Vulnerability Remediation Agent tightens identity setup and run readiness
Updated Security Copilot instructions require administrators to delegate all required permissions to the agentic user and pass Run Readiness Check before runs are enabled; a successful check enables the Run button and scheduled runs. Agents using human identities must transition before support expires. Identity problems are handled by removing the agent and setting it up again rather than renewing or replacing the identity.
Cloud PKI · General
New Cloud PKI guidance documents staged CA renewal
A new Cloud PKI article documents renewal for Intune-managed and bring-your-own-CA issuing CAs. Renewal always generates a new public/private key pair while preserving certificates and CRLs from earlier CA versions. A CA becomes eligible at half its validity lifetime or after expiry; an expired CA can be renewed, but certificate issuance remains unavailable until the staged CA is activated. The documented permissions are Read CAs and Create certificate authorities.

For Intune administrators

Audit custom EPM roles and Graph-based reporting access for the explicit View Reports permission. Review which Intune RBAC roles should inherit Security Copilot access when Intune is enabled as a data source. Update compliance-report procedures so device-reported values are treated as untrusted context, not an enforcement signal. For the Vulnerability Remediation Agent, verify delegated permissions and readiness-check procedures, and plan human-identity transitions before support expires. Cloud PKI administrators should review renewal permissions and staged-CA activation requirements before a CA expires.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Microsoft Intune

Updated

Updated Microsoft Intune documentation in intune/solutions/cloud-native-endpoints/tutorial-cloud-native-setup.md.

18 May 2026

Tutorial Cloud Native Setup

Updated

Updated Microsoft Intune documentation in intune/solutions/cloud-native-endpoints/tutorial-cloud-native-setup.md.

18 May 2026

18 May 2026

Updated Microsoft Intune documentation in intune/solutions/cloud-native-endpoints/tutorial-cloud-native-setup.md.

18 May 2026

18 May 2026

19 May 2026

18 May 2026

19 May 2026

21 May 2026

18 May 2026

Developer

Quickstart Integration

Updated

Updated Microsoft Intune documentation in intune/developer/app-sdk/quickstart-integration.md.

21 May 2026

Ref Data Model

Updated

Updated Microsoft Intune documentation in intune/developer/data-warehouse/ref-data-model.md.

19 May 2026

Compliance

Passwordless

Updated

Updated Microsoft Intune documentation in intune/solutions/passwordless.md.

21 May 2026

Linux

Platform Guide Linux

Updated

Updated Microsoft Intune documentation in intune/fundamentals/platform-guide-linux.md.

21 May 2026

Windows Autopilot

Updated Microsoft Intune documentation in autopilot/existing-devices.md.

18 May 2026

Windows

What's new in version 1610 of Configuration Manager

Updated

Updated

Use Docs

1 update

Fundamentals

Advanced Capabilities

Updated

Updated Microsoft Intune documentation in intune/fundamentals/advanced-capabilities.md.

22 May 2026

Endpoint Privilege Management

21 May 2026

Device enrollment

Troubleshoot and Monitor Remote Help

Updated

Updated Microsoft Intune documentation in intune/remote-help/troubleshoot.md.

21 May 2026

Windows

ServiceNow Integration with Microsoft Intune

Updated

Updated Microsoft Intune documentation in intune/device-management/tools/setup-servicenow.md.

21 May 2026

Microsoft Intune Advanced Analytics

General

Index

Updated

Updated Microsoft Intune documentation in intune/cloud-pki/index.md.

22 May 2026

Renew a Certificate Authority in Cloud PKI

New

Added Microsoft Intune documentation in intune/cloud-pki/renew-ca.md.

19 May 2026

Deployment models for Microsoft Intune cloud PKI

Updated

Updated Microsoft Intune documentation in intune/cloud-pki/deployment-models.md.

19 May 2026

Manage Ca Expiration

Removed

Removed Microsoft Intune documentation in intune/cloud-pki/manage-ca-expiration.md.

19 May 2026

Fundamentals

Microsoft Cloud PKI for Microsoft Intune

Updated

Updated Microsoft Intune documentation in intune/cloud-pki/index.md.

21 May 2026

Microsoft Cloud PKI for Microsoft Intune

Updated

Updated Microsoft Intune documentation in intune/cloud-pki/index.md.

19 May 2026

Microsoft Intune cloud PKI fundamentals

Updated

Updated Microsoft Intune documentation in intune/cloud-pki/fundamentals.md.

19 May 2026

Enterprise App Management

3 updates

21 May 2026

Microsoft Security Copilot in Intune

20 updates

General

Suggestions

Updated

Updated Microsoft Intune documentation in intune/copilot/agents/manage-vulnerability-remediation-agent.md.

21 May 2026

Vulnerability Remediation Agent

Updated

Updated Microsoft Intune documentation in intune/copilot/agents/vulnerability-remediation-agent.md.

21 May 2026

Security Copilot in Intune features overview

Updated

Updated Microsoft Intune documentation in intune/copilot/index.md.

19 May 2026

Endpoint analytics

Settings

Updated

Updated Microsoft Intune documentation in intune/copilot/agents/manage-vulnerability-remediation-agent.md.

21 May 2026

Tenant administration

Vulnerability Remediation Agent

Updated

Updated Microsoft Intune documentation in intune/copilot/agents/vulnerability-remediation-agent.md.

21 May 2026