Microsoft Intune service release 2610, listed by Microsoft for the week of October 26, 2026, changes how administrators manage AOSP applications, Apple routing and updates, Windows security, certificate infrastructure, permissions, and script delivery. The release contains multiple configuration changes with direct policy, firewall, and migration consequences.
For Intune administrators, the signal is clear: this release is less about a single headline feature than removing unsupported paths and exposing better control evidence. Your team should treat 2610 as a review cycle for Apple policies, Windows connectivity, certificate operations, and delegated administration.
1. AOSP Referenced Apps Manage Existing Packages
Microsoft says Intune now supports an AOSP referenced app type that identifies an application by package name rather than requiring an APK upload. The feature applies to OEM, preloaded, or externally deployed apps already present on supported AOSP devices.
A Required assignment unhides an existing app, while an Uninstall assignment hides it. This is not another application distribution mechanism. It is a control layer for software already resident on the device.
Microsoft’s AOSP application documentation also says referenced apps can receive JSON-based app configuration policies. Configuration designer and Connected Apps are not supported because Intune does not have an uploaded APK from which to obtain a managed configuration schema.
What you can control: You can create a referenced application from its package name, assign Required or Uninstall intent, and target it with manually authored JSON configuration.
Why this matters: Organizations using OEM images or external deployment systems can govern device-resident applications without duplicating package distribution in Intune. The tradeoff is greater dependence on accurate package names and vendor-provided JSON schemas.
Admin action: Confirm that each target package already exists on the device, obtain its exact package name from the OEM or application vendor, and test both visibility behavior and JSON settings on a limited AOSP group.
2. Apple VPN Profiles Gain Enforce Routes Support
Microsoft says Intune now supports Apple’s Enforce Routes capability in iOS, iPadOS, and macOS VPN profiles. Administrators define the intended behavior through Include all networks and Exclude local networks, after which Intune derives the corresponding Enforce Routes configuration.
According to Microsoft’s Apple VPN documentation, the resulting behavior follows Apple’s routing semantics. Include all networks directs most traffic through the tunnel, while Exclude local networks allows local services to remain outside it.
What you can control: You can express whether traffic should use the VPN broadly and whether local-network traffic should remain directly accessible.
Why this matters: Explicit routing reduces the possibility of traffic bypass or de-cloaking caused by ambiguous route precedence. This is a security control, but an incorrect combination can also disrupt access to local printers, nearby services, or resources with unusual routing dependencies.
Admin action: Review existing Apple VPN profiles, document the intended route behavior, and test full-device and per-app VPN scenarios before changing production assignments.
3. Legacy Apple Update Workloads Are Removed
Microsoft says Intune is removing legacy Apple MDM software update workloads because Apple retired the underlying commands and payloads in OS 27. Administrators must use Apple declarative device management update policies to continue managing software updates.
Microsoft’s Apple update planning guidance positions declarative device management as the supported replacement. Under that model, administrators declare the desired update behavior while the device manages more of the download, prompting, preparation, and installation lifecycle.
This is not a UI cleanup. It is the removal of controls whose underlying Apple mechanisms are no longer supported.
What this means: Existing operational documentation, automation, and policy reviews built around legacy MDM update commands are now stale. Your supported path is declarative update enforcement and associated software update settings.
Why this matters: A policy that remains visible in an internal runbook but no longer maps to a supported device command creates false assurance. That is a compliance and patch-governance problem.
Admin action: Inventory legacy Apple update configurations, replace them with declarative policies, and validate deadline and user-prompt behavior across representative iOS, iPadOS, and macOS devices.
4. MEFERI OEMConfig Support Reaches Android Enterprise
Microsoft has added support for the MEFERI OEMConfig application, identified by package name com.meferi.oemconfig, for Android Enterprise devices. Administrators can use Intune’s existing OEMConfig workflow to deploy settings exposed through MEFERI’s OEM-provided schema.
The required workflow is to add the application from Managed Google Play, assign it, and create an OEMConfig profile for the schema bundle. The available settings are defined by MEFERI, not by Intune.
What you can control: Your team can configure MEFERI-specific device capabilities through the standard Intune OEMConfig policy model.
Why this matters: MEFERI fleets no longer require a separate configuration workaround when the needed setting is exposed through the OEM schema. Schema changes still require testing because the OEM controls the available keys and defaults.
Admin action: Add com.meferi.oemconfig from Managed Google Play, assign it to a pilot device group, inspect the exposed schema, and test policy conflicts before expanding deployment.
5. Setup Assistant Legacy Authentication Ends
Microsoft says Intune has ended support for Setup Assistant legacy authentication in iOS, iPadOS, and macOS automated device enrollment profiles that use user affinity. Existing profiles are automatically updated to Setup Assistant with modern authentication.
The legacy option is no longer available when administrators create or edit profiles. Devices already enrolled through those profiles remain enrolled and are not affected.
What this means: The immediate risk is not device unenrollment. It is an enrollment workflow change for future devices using an automatically updated profile.
Why this matters: Authentication behavior during automated enrollment affects user prompts, support procedures, and conditional access sequencing. An automatic profile update still requires operational validation.
Admin action: Review affected automated device enrollment profiles, run a fresh enrollment on each relevant Apple platform, and update help-desk documentation to reflect modern authentication prompts.
6. Administrator Protection Expands Across Intune Policies
Microsoft has added two Administrator protection settings to endpoint security Account protection policies. On supported Windows 11 versions, administrators can configure the Administrator Approval Mode type and select the elevation prompt behavior used with Administrator protection.
Microsoft also says the same two controls are supported in the settings catalog for Windows 11 versions 24H2 and 25H2. This provides two Intune policy surfaces for configuring the behavior.
What you can control: You can define how Administrator Approval Mode operates and how elevation prompts appear on supported Windows devices.
Why this matters: Elevation behavior is now an explicit policy decision rather than a device-by-device assumption. Duplicate configuration across Account protection and the settings catalog could create avoidable policy conflicts.
Admin action: Choose one policy authority for these settings, target a supported Windows pilot group, and review the resulting policy status before broad assignment.
7. Windows Push Connectivity Requires Firewall Review
Microsoft says it improved connectivity for Windows scenarios that depend on push notifications, including device actions, Win32 applications, PowerShell scripts, and Remediations. Microsoft recommends updating firewall rules to include a new endpoint and consulting the current Intune and Windows Push Notification Services dependency lists.
The monitored release entry does not state the endpoint value itself. Administrators should use Microsoft’s current network requirements rather than copying an address from an older firewall baseline.
Why this matters: A blocked push path can delay several operational workflows at once. This can appear to be an application, script, or device-action failure when the underlying problem is network access.
Admin action: Compare outbound firewall and proxy rules with Microsoft’s current endpoint requirements, test from representative network segments, and confirm that device actions and script notifications reach managed Windows devices.
8. Apple OS 27 DDM Data Enters Device Inventory
Microsoft says Intune device inventory now includes declarative device management status data for Apple devices running OS 27. The added inventory covers hardware-component health, enhanced logging sessions, content-cache status, and Apple MDM and security states.
Those states can include enrollment type, awaiting configuration, and lockdown mode. Microsoft notes that available values depend on the device’s OS, hardware, enrollment, and declarative management capabilities.
What you can control: The change provides additional inventory evidence rather than a new enforcement mechanism.
Why this matters: Support and security teams can use the added status data to distinguish configuration, hardware-health, caching, and enrollment conditions without relying exclusively on user reports. Availability will vary, so missing values should not automatically be interpreted as failure.
Admin action: Review inventory output from representative OS 27 devices and decide which new properties belong in support procedures, compliance investigations, and operational reporting.
9. Agent Runtime Protection Is Generally Available
Microsoft says the endpoint security template for Microsoft Defender for Endpoint agent runtime protection settings is now generally available. The template no longer carries a preview designation and includes a new AI agent runtime inspection setting.
What you can control: Administrators can configure supported runtime protection settings for Windows devices through the endpoint security template, including AI agent runtime inspection.
Why this matters: General availability changes the deployment decision from preview evaluation to production policy planning. It does not eliminate the need to test compatibility and reporting behavior.
Admin action: Review any preview-era assignments, compare them with the generally available template, test AI agent runtime inspection on a controlled Windows group, and document rollback criteria before expansion.
10. Certificate Connector Health Appears in the Admin Center
The Certificate Connector for Microsoft Intune now exposes health and status signals in the Intune admin center. Microsoft says these indicators identify conditions such as an unreachable certification authority, insufficient service-account permissions to issue or revoke certificates, and certificate-template mismatches with PKCS profiles.
Each signal includes investigation and remediation guidance. This closes an operational visibility gap between certificate policy assignment and certificate issuance.
Why this matters: Certificate failures can surface downstream as access, sign-in, or compliance problems. Connector-level health evidence lets administrators investigate the issuance path before treating every failed device as an isolated endpoint problem.
Admin action: Establish a recurring connector-health review, assign ownership for certification authority and service-account failures, and incorporate the new signals into certificate incident runbooks.
11. Scoped RBAC Permissions Are Generally Available
Microsoft says scoped permissions for Intune role-based access control are now generally available. Permissions from role assignments carrying different scope tags are applied independently rather than being merged.
Microsoft recommends using the Permissions Assessment Report before enabling scoped permissions. That report is the required planning control because effective administrator access can change when independently scoped assignments replace merged behavior.
Why this matters: This is not a cosmetic RBAC adjustment. It changes how delegated access is calculated across scope boundaries.
For organizations separating regions, business units, or administrative teams through scope tags, the new behavior can better preserve intended boundaries. It can also remove access that an administrator previously received through merged assignments.
Admin action: Run the Permissions Assessment Report, identify administrators whose effective access will change, document exceptions, and enable scoped permissions only after affected support and operations teams approve the result.
12. Windows Scripts Receive Faster Push-Based Delivery
Microsoft says Intune now uses push notifications for administrator-initiated and service-side changes to Windows scripts. Managed devices can check in sooner after script changes instead of waiting only for the normal polling interval.
The workflow for creating and assigning scripts does not change. The delivery trigger does.
Why this matters: Faster notification can shorten the interval between a script change and device processing, which is useful for remediation and time-sensitive configuration work. The improvement still depends on working push connectivity, making the firewall review in release 2610 operationally significant.
Admin action: Validate script delivery from networks with different proxy and firewall paths, compare observed check-in behavior, and retain realistic deployment windows for devices that are offline or unable to receive push notifications.
The Bigger Picture
- Complete the Apple transition. Move software updates to declarative device management, validate modern authentication during automated enrollment, and review VPN routing as one coordinated Apple workstream.
- Treat connectivity as a dependency. Update Windows push allowlists before judging device actions, Win32 applications, scripts, or Remediations by delivery speed.
- Pilot new security controls. Test Administrator protection and agent runtime inspection on controlled groups, with one documented policy authority for overlapping settings.
- Use the new evidence. Add Certificate Connector health, Apple OS
27inventory, and the Permissions Assessment Report to operational reviews. - Validate vendor-defined Android controls. Confirm AOSP package names, JSON schemas, and MEFERI OEMConfig behavior before production assignment.
Stay tuned for more Intune updates, and as always, test thoroughly before deploying to production!