Here’s what caught my attention this week.
Configuration Manager 2609 is now generally available, Intune has added some useful administrative and troubleshooting capabilities, and there’s a change to Windows health attestation worth getting ahead of. I also found a walkthrough for protecting endpoints from malicious AI agent activity.
Configuration Manager 2609 is now globally available
Microsoft made Configuration Manager 2609 globally available on October 26. If you’re running 2503 or later, you can install it through the in-console update process.
There are a few things worth checking before starting the upgrade. SQL Server 2016 is no longer supported, and the prerequisite check will block the upgrade if any site database is still running on it. Windows Server 2012 and 2012 R2 are also no longer supported as ConfigMgr client operating systems.
Version 2609 migrates CMG deployments to newer VM sizes and Azure Load Balancer inbound NAT rules version 2. Existing deployments are migrated automatically, but Microsoft specifically recommends checking regional Azure vCPU quotas and VM availability before upgrading. A quota problem can cause the migration to fail.
There’s also a prerequisite warning for hierarchies configured to automatically approve all computers. Microsoft plans to remove that option in a future release, so this is a good time to move to manual approval or automatic approval for trusted domains.
What’s new in Configuration Manager 2609 · Summary of changes and fixes
Intune adds certificate connector health monitoring
Intune now surfaces Certificate Connector health and status information directly in the admin center. The new indicators help identify common problems, including an inability to reach the certification authority, missing permissions on the connector service account, and certificate requests rejected because of a template mismatch with a PKCS profile.
This is a useful improvement for environments relying on certificate-based Wi-Fi, VPN, or other device authentication. These problems can be difficult to diagnose when the first visible symptom is a device that can’t authenticate. Having connector health information alongside device management should make it easier to find the problem before users start reporting access failures.
Microsoft Intune What’s New — October 26
Intune scoped permissions are generally available
Microsoft has made scoped permissions for Intune RBAC generally available. The feature changes how permissions are combined when an administrator has multiple role assignments with different scope tags.
With scoped permissions enabled, permissions from separate role assignments are evaluated within their own scope tag context instead of being merged across assignments. This gives administrators more predictable control over delegated access.
Before enabling it, run the Permissions Assessment Report under Tenant administration > Roles > Settings. Microsoft recommends reviewing the report to understand how access will change. This is especially important in environments with custom roles and extensive scope-tag delegation.
Intune What’s New · Intune scope tags and RBAC documentation
Windows health attestation is moving to Azure Attestation
Jannik Reinhard and Florian Salzmann highlighted a change that could cause some Windows 11 devices to show as noncompliant even when BitLocker and Secure Boot are working correctly.
Intune is migrating Windows health attestation from the existing Device Health Attestation service to Microsoft Azure Attestation (MAA). If your firewall or proxy blocks the MAA endpoints for your tenant’s region, devices using health-based compliance settings can fail their attestation checks. Microsoft specifically calls out BitLocker, Secure Boot, and Code Integrity.
The service-side migration is targeted for the end of Q1 2027. Review the required endpoints now, including the requirement to allow outbound HTTPS on port 443 without SSL inspection. Windows 10 and GCC High/DoD environments continue using the existing DHA endpoint.
This is an easy one to miss because the compliance policy itself doesn’t need to change. The network path does.
Jannik and Florian’s practical breakdown · Microsoft’s Intune network endpoint requirements
AI agent runtime protection gets an Intune policy template
Peter van der Woude took a look at Microsoft’s AI agent runtime protection for Defender for Endpoint. The capability is designed to detect potentially malicious activity involving AI agents, including prompt injection attempts that could influence an agent through instructions hidden in content it processes.
Intune’s endpoint security template provides Audit and Block modes. Audit mode lets you observe and investigate activity before enforcing restrictions, while Block mode can prevent suspicious actions. Devices need to be onboarded to Defender for Endpoint, with Defender Antivirus running in active mode and real-time protection enabled. Supported agents and licensing requirements also apply.
The Intune template is now generally available, although the underlying capability’s rollout and availability should be checked against Microsoft’s current Defender documentation.
Intune ends support for legacy Apple enrollment authentication
With the October 2610 service release, Intune has ended support for Setup Assistant (legacy) authentication for Apple Automated Device Enrollment with user affinity.
Existing enrollment profiles using the legacy method are automatically updated to Setup Assistant with modern authentication. The legacy option is no longer available when creating or editing profiles, but devices that are already enrolled aren’t affected.
If you still have Apple enrollment workflows using the legacy method, review the updated profiles and test the modern authentication experience. Microsoft recommends using Setup Assistant with modern authentication and Just-in-Time registration.
Microsoft’s Automated Device Enrollment guidance
That’s it for this week.
Do you have a suggestion for this newsletter? Let me know in the comments.