Microsoft Intune’s Service Release 2607 (Week of July 27, 2026) is a substantial update that spans all major platforms — Android Enterprise, Windows, macOS, and Apple tvOS/visionOS. Rather than a single headline feature, this release delivers a collection of targeted improvements that address long-standing pain points for endpoint management teams: firmware control for Samsung fleets, platform parity for macOS compliance, configuration authority for Defender, and better visibility into Windows device sync.

Here’s a detailed breakdown of what’s new, why it matters, and what you should do about it.

Samsung Knox E-FOTA Firmware Update Management for Android Enterprise

The change: Intune now integrates with Samsung Knox Enterprise Firmware-Over-The-Air (E-FOTA), letting admins manage firmware updates for corporate-owned Samsung devices directly from the Intune admin center.

This is a significant addition for organizations running Samsung-heavy Android fleets. Previously, firmware updates on Samsung devices were either carrier-driven, user-initiated, or required a separate Knox console. Now, Intune serves as the central control point.

What you can do:

  • Control which firmware version each device receives — keep production devices on a validated version while testing new firmware on a pilot group
  • Deploy firmware updates without user interaction — no more relying on users to accept OTA prompts
  • Schedule downloads and installations — reduce downtime by planning updates during off-hours
  • Use existing Intune device groups — if group membership changes, firmware assignment follows automatically

How it complements Knox Mobile Enrollment (KME):

KME handles the enrollment and provisioning side — getting devices into Intune at first boot. E-FOTA handles the ongoing firmware lifecycle — keeping devices on the right firmware version throughout their lifespan. Most Samsung Enterprise shops will use both together.

What you need:

A Knox E-FOTA subscription from Samsung. Intune surfaces the controls, but the backend integration requires the Samsung-side license. Plan your firmware rollout rings the same way you’d plan Windows update rings: pilot → pre-production → broad deployment.

Applies to: Android Enterprise COSU, COBO, COPE

Custom Compliance Settings for macOS

The change: Intune now supports custom compliance settings for macOS, bringing it to feature parity with the existing Windows and Linux custom compliance capabilities.

This is one of the most impactful changes in this release for Mac-heavy environments. Until now, macOS admins were limited to Intune’s built-in compliance settings. If you needed to check something outside that catalog — like verifying a third-party EDR agent was running, or validating a custom security configuration — you had to build external tooling or accept the gap.

How it works:

  1. You write a script (bash, zsh, or Python) that evaluates device state
  2. The script outputs JSON data
  3. You define compliance rules in Intune that evaluate against that JSON output
  4. Results appear alongside standard compliance reporting in the Intune admin center
  5. Non-compliant devices can be blocked from accessing resources via Conditional Access

Practical use cases:

  • EDR/AV verification — confirm CrowdStrike, Jamf Protect, or other security agents are installed, running, and properly configured
  • Secure configuration checks — validate sudoers settings, custom password policies, or FileVault configurations beyond built-in settings
  • Software version enforcement — ensure specific versions of Xcode, Docker, or internal tools are installed in regulated environments
  • Regulatory compliance — map ISO 27001, SOC2, or sector-specific controls to concrete script checks tied to Conditional Access

What this means for platform parity:

Intune now offers the same custom compliance model across Windows, Linux, and macOS. This is a meaningful step toward treating Macs as first-class citizens in the Intune ecosystem rather than second-tier managed devices.

Applies to: macOS

Controlled Configuration for Microsoft Defender Antivirus (Preview)

The change: In public preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When enabled, Defender AV settings delivered by Intune or Microsoft Defender for Endpoint security settings management become the single source of truth, overriding configurations from all other channels.

This is the most security-significant change in this release. It directly addresses one of the most persistent problems in hybrid environments: configuration conflicts between management tools.

The problem it solves:

In many organizations, Defender AV settings are configured by multiple overlapping tools:

  • Group Policy Objects (GPOs) from on-prem Active Directory
  • Configuration Manager baselines
  • Intune endpoint security policies
  • Microsoft Defender for Endpoint security settings management
  • Local scripts or manual registry edits

When these tools push conflicting configurations, the result is unpredictable. An admin thinks Defender is configured one way, but a legacy GPO is silently overriding settings. Security gaps appear that are difficult to diagnose.

How Controlled Configuration fixes this:

When CC is enabled:

  • Intune/Microsoft 365 Defender settings take precedence over GPO, SCCM, local scripts, and manual edits
  • Devices converge to the Intune configuration regardless of what other tools push
  • This extends Tamper Protection, which previously only prevented local/malware-based changes, to now also block policy-level overrides from other management stacks

Think of it as: Tamper Protection says “don’t let the endpoint change itself.” Controlled Configuration says “don’t let any other management stack contradict Intune.”

What to do before enabling:

  1. Audit existing GPO and Config Manager Defender configurations — identify legacy policies that conflict with your desired Defender baseline
  2. Document what CC will override — know what’s changing before you flip the switch
  3. Plan for cloud-first security standardization — treat GPO/SCCM as fallback only for systems that can’t yet be cloud-managed

Applies to: Windows

Improved On-Demand Device Sync for Windows

The change: The per-device sync experience in the Intune admin center has been substantially upgraded.

What’s new:

  • Live sync status pane — shows progress for each step of the sync process, from notifying the device through policy/app/script processing to compliance calculation
  • Combined MDM + IME sync — the sync action now triggers both the MDM check-in AND the Intune Management Extension (IME) check-in simultaneously
  • Single-pass sync — one sync now pulls down configuration policies, apps, and PowerShell scripts together

Why this matters for troubleshooting:

Previously, the sync button was somewhat of a black box. You clicked it, waited, and hoped. If a Win32 app or PowerShell script didn’t arrive, you couldn’t tell whether the device never checked in or whether the IME cycle just hadn’t run yet. Admins often had to tell users to “wait longer” or manually trigger separate IME syncs.

Now, the sync status pane lets you:

  • See exactly where a failure occurs — is the device unreachable, or did the script fail to install?
  • Confirm all workloads synced — policies, apps, and scripts in one pass
  • Screenshot failure points for escalation tickets
  • Reduce mean time to resolution (MTTR) — faster diagnosis means faster fixes

This turns what was an opaque, asynchronous process into a diagnosable workflow. For helpdesk teams, this is a quality-of-life improvement that reduces escalations and improves first-call resolution rates.

Applies to: Windows

Windows Registry Data Collection via Properties Catalog

The change: Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices.

Collection modes:

  • Single value — collect a specific registry value
  • All values under a key — collect everything directly under a specified key
  • Same value across subkeys — collect a named value from all subkeys under HKEY_LOCAL_MACHINE

Why this matters:

This effectively brings SCCM-style registry querying capability into Intune’s cloud-native inventory engine. For teams migrating from Configuration Manager, this removes one more reason to keep SCCM around.

Practical use cases:

  • Security posture monitoring — check Defender registry keys, detect unapproved security tools, or identify Shadow AI agents using known registry signatures
  • Application configuration discovery — confirm required app settings are present and correctly configured across your fleet
  • License tracking — inventory which devices have specific feature flags or license states stored in the registry
  • Dynamic device grouping — build groups based on registry conditions (e.g., “all devices with Agent X installed”) and target policies accordingly
  • Compliance evidence — use registry data as evidence in audit scenarios where built-in compliance settings don’t cover the check

What to plan:

  • Identify the registry keys that matter most for your security and compliance requirements
  • Build inventory policies that collect those keys
  • Train admins on Intune’s device query capabilities to leverage the collected data
  • Consider how this pairs with custom compliance — registry data collected via properties catalog can inform compliance rules

Applies to: Windows

Regional Support for Microsoft Store Apps

The change: When adding a Microsoft Store app in Intune, you can now choose the region (market) whose Store catalog to search and deploy from. Previously, Intune only searched the United States catalog.

Why this was needed:

Many organizations operating outside the US — or global organizations with regional subsidiaries — found that locally published apps weren’t available through Intune’s Store integration. Apps published for the Japanese, Spanish, or other regional markets simply didn’t appear in search results.

This forced admins into workarounds: manual app packaging, region-specific deployment scripts, or maintaining separate app catalogs per geography.

What this enables:

  • Global app standardization — define app baselines using Store apps that work across regions
  • Localized app deployment — deploy apps published for specific markets (Japan, Spain, etc.) that aren’t available in the US catalog
  • Reduced packaging overhead — fewer custom packages needed when the Store app is directly available

Applies to: Windows

Skip Setup Assistant Screens for tvOS and visionOS

The change: Intune now supports hiding or showing Setup Assistant screens during Automated Device Enrollment (ADE) for tvOS and visionOS devices.

Admins can now choose which screens appear during setup:

  • Apple ID — suppress the iCloud sign-in prompt
  • Diagnostics Data — skip the diagnostics sharing opt-in
  • Location Services — bypass the location services enablement screen

Why this matters:

For organizations deploying Apple TV units as meeting room displays or digital signage, and Vision Pro devices in enterprise or training scenarios, every unnecessary Setup Assistant screen is:

  • A friction point that slows down deployment
  • An opportunity for users to make non-compliant choices
  • A potential support ticket

By suppressing non-essential screens, devices go straight from unboxing to a managed state with minimal interaction. This aligns tvOS and visionOS with the existing iOS/iPadOS and macOS ADE experience.

Applies to: tvOS, visionOS

Dedicated RBAC Permission for Google Zero-Touch Enrollment

The change: Intune now has a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access, separated from the “Update app sync” permission.

Why the previous model was problematic:

Before this change, the zero-touch enrollment iframe in the Intune admin center required the “Update app sync” permission — which also grants rights to manage Managed Google Play app sync. This meant:

  • Over-privileged admins — staff who only needed to manage zero-touch enrollment also got app sync management capabilities they didn’t need
  • Security risk — zero-touch enrollment defines which devices auto-enroll and into which tenant/profile. A misconfiguration here could repoint new devices to the wrong environment
  • Poor segregation of duties — security best practices call for separating enrollment supply chain management from routine policy/app management

What the dedicated permission enables:

  • Granular access — create a role specifically for zero-touch enrollment admins (typically a smaller, more senior group)
  • Better governance — changes to zero-touch configuration are easier to audit and attribute
  • Reduced blast radius — a misconfiguration by a general admin can’t affect the enrollment supply chain

Applies to: Android Enterprise

New Windows Settings Catalog and Edge Policy Additions

Two additional device configuration updates round out this release:

Windows Settings Catalog:

New settings for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL) configuration.

Microsoft Edge Administrative Templates:

Refreshed to Edge 149 (version 149.0.4022.21), adding 20+ new policy settings including:

  • Multiple Copilot controls (browsing allow/block URLs, address bar suggestions, new tab page configuration, side pane auto-open for Outlook links)
  • Local Fonts permission management (allow/block per site, default setting)
  • Developer tools URL allow/block lists
  • M365 authentication popup controls in work profiles
  • MAM with Purview DLP integration
  • WebSocket proxy connection limits
  • CPU performance tier override
  • SharedWorker extended lifetime

These Edge policy additions are particularly notable for organizations managing Copilot adoption — the new controls allow granular URL-level management of Copilot browsing capabilities within Edge.

How to Operationalize Release 2607

For Android teams:

  • Incorporate Knox E-FOTA and zero-touch RBAC into your enrollment and lifecycle documentation
  • Evaluate whether your Samsung fleet needs firmware ring management
  • Review zero-touch enrollment access permissions and restrict to dedicated role

For macOS teams:

  • Design custom compliance scripts and map them to Conditional Access requirements
  • Identify the gap between built-in compliance settings and your actual security requirements
  • Build and test compliance scripts in a pilot group before broad deployment

For Windows teams:

  • Update troubleshooting scripts and support runbooks to leverage the new sync status pane
  • Begin planning for Controlled Configuration rollout — audit existing GPO/SCCM Defender configurations
  • Identify high-value registry keys for properties catalog inventory
  • Review Edge 149 policy additions, especially Copilot controls if managing AI adoption

For security teams:

  • Controlled Configuration, registry collection, and custom compliance are security program tools as much as IT tools
  • Work jointly with endpoint management to define authoritative baselines and conflict resolution strategies
  • Plan migration from GPO/SCCM-managed Defender settings to Intune-managed settings with CC enforcement

For Apple teams:

  • Update ADE profiles for tvOS and visionOS to suppress unnecessary Setup Assistant screens
  • Update provisioning runbooks for meeting room and shared device scenarios

Summary

Service Release 2607 is a mature, multi-platform update that reflects Intune’s trajectory toward deeper control and visibility across heterogeneous estates. The standout features — Samsung Knox E-FOTA integration, macOS custom compliance, and Defender Controlled Configuration — each address a specific gap that has limited IT teams operating across multiple platforms and management stacks.

For endpoint management professionals, this release moves Intune closer to being a truly unified cloud-native endpoint management platform rather than a Windows-first tool with add-ons for other platforms. The investments in cross-platform compliance, firmware lifecycle management, and configuration conflict resolution are exactly what mature teams need as they consolidate tooling and move further into cloud-first operations.

Follow Kevin on X at https://x.com/kkaminski for more Intune and endpoint management content.