Microsoft Intune’s Service Release 2606 continues to roll out with a second wave of updates that didn’t get coverage in our initial 2606 breakdown. These updates span AI governance, licensing transformation, Android security hardening, and Linux server management — and they collectively signal Intune’s evolution from MDM/MAM tool to strategic security and operations platform.
Here are the seven updates from 2606 that deserve your attention this week.
1. ChatGPT is Now an Intune Protected App
The ChatGPT mobile app is now officially listed as a protected app for Microsoft Intune. This means you can apply Intune App Protection Policies (MAM) directly to ChatGPT — without requiring device enrollment.
What you can control:
- Restrict copy/paste and “Save As” from ChatGPT to unmanaged apps
- Require device compliance (no jailbreak/root) to use ChatGPT with work accounts
- Enforce app PIN or biometric authentication
- Selectively wipe organizational data from ChatGPT if a user leaves or a device is lost
Why this matters: This is a watershed moment for enterprise AI governance. Instead of blanket-blocking ChatGPT, organizations can now enable it with strict data loss prevention controls. On BYOD devices where you can’t manage the OS, you can still control how corporate data flows into and out of ChatGPT. This moves the conversation from “should we allow ChatGPT?” to “how do we govern ChatGPT?”
Admin action: Add ChatGPT to your targeted apps list in existing App Protection Policies. Apply strict DLP settings, require conditional launch, and update your AI governance documentation so support teams know how ChatGPT is controlled.
2. Intune Suite Capabilities Bundled into Microsoft 365 E3 and E5
This is arguably the most significant licensing change for Intune in years. Microsoft is adding several Intune Suite capabilities directly into M365 E3 and E5 licenses, eliminating the need for separate add-on purchases.
M365 E3 (via EMS E3) now includes:
- Remote Help
- Advanced Analytics
- Intune Plan 2 (Microsoft Tunnel for MAM, specialty device management, FOTA updates)
M365 E5 includes everything in E3 plus:
- Endpoint Privilege Management (EPM)
- Enterprise Application Management (EAM)
- Microsoft Cloud PKI
Why this matters: Many organizations with M365 E3/E5 didn’t adopt these advanced capabilities because they required separate licensing. Now they’re being auto-provisioned for eligible tenants with a 30-day notice in the Microsoft 365 admin center. This raises the security baseline across the entire E3/E5 ecosystem and gives IT teams access to least-privilege elevation, enterprise app lifecycle automation, and cloud-based PKI without additional procurement.
Admin action: Work with your licensing admin to confirm new entitlements. Prioritize rollout: Remote Help → EPM → Tunnel for MAM → EAM auto-updates → Cloud PKI. Re-evaluate any overlapping third-party tools (remote support, privilege management, VPN, PKI) for potential consolidation and cost savings.
3. New Android Enterprise Settings: AI Agent Blocking and Connectivity Hardening
The Intune settings catalog for Android Enterprise received a massive update with 15+ new settings across three categories.
Applications:
- Block apps from exposing app functions — Controls whether managed apps can expose programmatic actions that other apps and on-device AI agents can invoke. This is Microsoft’s first real move toward controlling AI-driven app orchestration on mobile devices.
- Block widgets from work profile apps — Controls widget visibility on home screens
Connectivity (11 new settings):
- Block airplane mode, cellular 2G, VPN configuration, SMS, outgoing calls, ultra wideband
- Minimum Wi-Fi security level (Open → Personal → Enterprise → Enterprise 192-bit)
- Block cell broadcasts, mobile network config, network reset
- Preferential network service for 5G enterprise slices
General:
- Block printing, user icon changes, wallpaper changes, eSIM profile additions
Why this matters: The AI agent blocking setting is particularly significant — it directly addresses the emerging threat of AI agents orchestrating app actions without explicit user intent. On the connectivity side, blocking 2G mitigates well-documented downgrade and interception risks, while Wi-Fi security minimums enforce modern encryption standards across corporate fleets.
Admin action: Create or update baseline policies for corporate Android devices. Disable 2G where possible, enforce Wi-Fi security minimums, and evaluate whether to block app function exposure for sensitive user groups.
4. Trustd Mobile Joins as Mobile Threat Defense Partner
Trustd Mobile is now a supported Mobile Threat Defense (MTD) partner for Intune, covering Android 9.0+ and iOS/iPadOS 15.0+.
What this means: Threat signals from Trustd Mobile integrate directly into Intune compliance and conditional access. Devices flagged with high-severity threats can be automatically marked non-compliant, blocking access to corporate resources.
Intune also introduces a new Mobile Threat Defense role category in the admin center, allowing delegated MTD management without broad Intune rights.
Admin action: If you’re evaluating MTD solutions, add Trustd Mobile to your shortlist. Configure the connector, map risk levels to compliance actions, and pilot with a subset of users.
5. Remote Help Support for RemoteApp in Azure Virtual Desktop
Remote Help now supports RemoteApp sessions in Azure Virtual Desktop, not just full desktop sessions. Help desk agents can securely view and control individual published apps within RemoteApp sessions.
Why this matters: Organizations running locked-down AVD environments with app-only publishing can now use the same Remote Help tooling for support as they do for physical PCs and full AVD desktops. This unifies support operations and provides better auditing and RBAC than legacy remote support tools.
Admin action: Ensure support staff are on the latest Remote Help client. Update support runbooks to include RemoteApp troubleshooting workflows. If you’re now getting Remote Help via M365 E3 bundling, consider consolidating older remote support tools.
6. Microsoft Tunnel Adds RHEL 9.7 Support
Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux 9.7 as a server distribution, requiring Podman 5.8.2 as the container engine.
Migration considerations:
- Podman v3 containers are NOT compatible with Podman 5.8.2 — you must recreate containers and reinstall Microsoft Tunnel
- RHEL 9.x doesn’t auto-load the ip_tables module — manual loading is required before installation
- Plan SELinux and firewall configurations for the new environment
Admin action: If you’re running Tunnel gateways on older RHEL versions, plan your migration to 9.7. Update automation scripts to use Podman rather than legacy container engines.
7. New Defender Antivirus Settings for Linux Server
Two new settings have been added to the endpoint security Antivirus policy for Microsoft Defender Antivirus on Linux Server:
- Offline security intelligence update — Manages how Defender keeps signatures current on Linux Server devices, including updates while offline. Critical for servers in isolated or high-security networks (DMZ, OT, regulated environments) where direct internet access is restricted.
- Scheduled scan — Manages when Defender runs scheduled scans on Linux devices, bringing Linux closer to Windows parity for predictable, auditable malware scanning.
These settings work for both Intune-enrolled Linux Server devices and Linux devices managed through Microsoft Defender for Endpoint security settings management.
Why this matters: This eliminates the need for ad-hoc scripts or manual cron jobs for Linux antivirus management. Combined with Microsoft’s broader Controlled Configuration initiative, it moves organizations toward a unified endpoint protection strategy across Windows and Linux.
Admin action: Define Linux AV baselines in Intune. Configure scheduled scans during maintenance windows, and set policies for offline signature distribution through internal update servers.
The Bigger Picture
Service Release 2606’s second wave of updates reinforces three strategic directions for Intune:
- AI-aware management — From ChatGPT protection to Android AI agent blocking, Intune is becoming the control plane for enterprise AI governance
- Licensing democratization — Bundling Suite capabilities into E3/E5 removes the procurement friction that kept advanced security features out of many organizations
- Platform convergence — Linux server management, Android enterprise hardening, and AVD support convergence under a single management plane
For IT admins, the message is clear: Intune is no longer just an MDM tool. It’s becoming the strategic platform for endpoint security, AI governance, and operational efficiency across your entire device fleet.
Already covered in our first 2606 post: EAM for GCC High/DoD, EAM auto-updates, macOS PKG auto-updates, WPA3-Personal for iOS, and the M365 Apps security baseline v2512. The IE11 COM automation block in the Windows 25H2 baseline was covered separately.