Week of 20 July 2026 — Daily Intune News

Week in brief

Client-driven compliance preview centers on proactive Windows reevaluation as macOS guidance flags LAPS expiry

The week of 20 July was dominated by documentation maintenance: 2,515 of 2,517 recorded changes were updates, 2,482 were associated with Configuration Manager, and no removals or Message Center items were supplied. The meaningful Intune diffs describe client-driven compliance evaluation as a Windows preview, warn about macOS compliance password side effects, and document an Endpoint Privilege Management scope-tag limitation. A settings catalog tutorial also adds dynamic-group targeting references. Nothing in the supplied evidence establishes a general-availability launch or retirement.

Intune · Device security
Client-driven compliance evaluation is documented as a Windows preview
Intune compliance-policy guidance adds “Client-driven compliance evaluation (preview)” for supported Windows devices. Devices can detect certain local state changes—including device configuration, security posture, and other compliance-affecting settings—and proactively request a compliance reevaluation instead of waiting for the next scheduled check-in. This is preview guidance, not evidence of general availability.
Intune · Device security
macOS password requirements carry an all-account expiry warning
The macOS compliance settings reference now warns that requiring a password in a compliance policy automatically expires the existing password for all accounts on the device, including accounts created by LAPS and Platform SSO. It recommends managing device passwords with a settings catalog policy and configuring Change At Next Auth to False. The diff documents this side effect; it does not establish that the behavior is newly introduced.
Endpoint Privilege Management · Windows
Endpoint Privilege Management roles do not support scope tags
The EPM known-issues guidance states that the built-in “Endpoint Privilege Manager” role and the custom “Endpoint Privilege Management Policy Authoring” role do not support scope tags. To restrict an administrator’s view permissions using scope tags, the documented workaround is to grant permissions that include Read for “Device configurations.”
Intune · Windows
Settings catalog tutorial adds dynamic-group efficiency references
The settings catalog policy walkthrough adds links for creating simpler and faster dynamic membership rules, optimizing rule efficiency, and choosing the right targeting method in Intune. This is an ordinary documentation clarification and related-content addition; the diff does not indicate a change to dynamic-group behavior or settings catalog functionality.
Configuration Manager · Device security
Configuration Manager volume is largely metadata normalization
The supplied Configuration Manager representative diffs show mechanical metadata changes, including replacing ms.subservice “core-infra” with “core-infrastructure” and adding ms.service “microsoft-endpoint-configuration-manager.” These are documentation taxonomy edits, not evidence of a product feature, retirement, security fix, or changed administrator procedure.

For Intune administrators

Windows compliance administrators should account for supported devices proactively requesting reevaluation after local configuration or security changes, rather than relying solely on scheduled check-ins; the capability is explicitly preview. Before changing macOS compliance password requirements, account for automatic password expiry across all device accounts, including LAPS and Platform SSO, and consider the documented settings catalog alternative with Change At Next Auth set to False. EPM RBAC designers cannot use scope tags with the two named roles and should use the documented Device configurations Read-permission workaround where applicable. The large Configuration Manager batch and BlackBerry edits are metadata or link maintenance in the supplied diffs and indicate no tenant action

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Microsoft Intune

32 updates

22 July 2026

Endpoints Us Government

Updated

Updated Microsoft Intune documentation in intune/fundamentals/endpoints-us-government.md.

21 July 2026

Updated Microsoft Intune documentation in intune/device-security/compliance/monitor-policy.md.

21 July 2026

Updated

Updated Microsoft Intune documentation in intune/device-configuration/settings-catalog/tutorial-group-policy-migration.md.

24 July 2026

Windows Autopilot

2 updates

Device enrollment

How to enroll with Windows Autopilot

Updated

Updated Microsoft Intune documentation in intune/configmgr/comanage/autopilot-enrollment.md.

22 July 2026

Windows

22 July 2026

Updated

Updated Microsoft Intune documentation in intune/configmgr/develop/reference/mdm/sms_mdmdeviceenrollmentmanagers-server-wmi-class.md.

22 July 2026

22 July 2026

22 July 2026

Device updates

ValidateNewPackageSource Method in Class SMS_DriverPackage

Updated

Updated Microsoft Intune documentation in intune/configmgr/develop/reference/osd/validatenewpackagesource-method-in-class-sms_driverpackage.md.

22 July 2026

24 July 2026