Here’s what caught my attention this week.
The October Windows update is exposing some older network authentication dependencies, Intune is changing its default device page and permissions, and there’s a useful expansion to the Sync action. ConfigMgr admins should also check the latest CMPivot certificate guidance.
The October update can break 802.1X single sign-on
Microsoft’s October 13 security update, KB5127648, changes the default behavior for BlockNtlmv1SSO. On affected devices where Credential Guard is disabled and the registry value isn’t configured, Windows now enforces the protection against generating NTLMv1-derived credentials for single sign-on instead of auditing their use.
The catch is that some environments still rely on MS-CHAPv2-based authentication for Wi-Fi, wired 802.1X, or VPN connections. Those connections can fail to authenticate automatically after the update, even though the network adapter itself is working correctly.
Microsoft’s NTLMv1 change and mitigation guidance · KB5127648 release notes
Intune’s new device page changes the permissions you need
Microsoft is making the new device page the default experience in the Intune admin center, replacing the legacy page. The device-management features remain, but the permission model needs attention.
Admins need the Managed devices / Update permission, along with the specific permissions required for individual actions.
Change details and permission summary
Intune’s comprehensive Sync action now covers iOS and iPadOS
Intune’s comprehensive Sync device action now applies to iOS and iPadOS as well as Windows. It synchronizes key workloads, including configuration policies, apps, and scripts where applicable.
This gives admins a more useful option when they need to prompt a device to catch up rather than waiting for its normal management cycle. It doesn’t replace checking assignment, applicability, or installation status when something still doesn’t arrive, but it’s another tool to keep in mind when troubleshooting delayed policy or app delivery.
Intune changes for the week of October 19
Check CMPivot certificate trust on older ConfigMgr versions
Microsoft clarified the CMPivot certificate-trust requirements in its Configuration Manager documentation. CMPivot is signed with the Microsoft Code Signing PCA 2011 certificate.
Configuration Manager 2609 and Configuration Manager 2603 with the relevant update rollup automatically add the certificate to Trusted Publishers. Earlier versions require administrators to export and add the certificate manually. This matters particularly in environments where PowerShell execution policy is set to AllSigned.
If CMPivot scripts or queries are failing under restrictive signing policies, check certificate trust and your ConfigMgr version before treating it as a query problem. The documentation also clarifies that the 2603 update rollup, KB39169655, includes fixes that previously had separate hotfix entries.
Microsoft’s CMPivot documentation · Configuration Manager documentation changes this week
Windows Autopilot documents a new MDM-provider integration path
Microsoft published documentation for integrating third-party MDM providers with Windows Autopilot device association. The process is currently in private preview and covers prerequisites, requesting limited access, review, and technical onboarding.
Autopilot device-association documentation update
That’s it for this week.
Do you have a suggestion for this newsletter? Let me know in the comments.