Microsoft Intune February Update: Multi-Admin Approval & Apple DDM

Introduction: Why this matters

Workarounds in device management often start as convenience—but they can quietly increase risk. Duplicated policies, overly broad software update deployments, and unreviewed changes expand the attack surface and undermine Zero Trust practices like least privilege and strong change control. This month’s Intune improvements are aimed at reducing those gaps by adding approvals, better fleet analytics, and more precise Apple policy targeting.

What’s new in Intune (February)

1) Multi-admin approval expands to compliance and configuration policies

Intune now supports additional multi-administrator approval options for:

• Device configuration policies created via the Settings catalog
• Device compliance policies

With multi-admin approval enabled, creating, editing, or deleting these critical policies requires approval from a second administrator before changes take effect. This builds on approvals already available for other high-impact areas (apps, scripts, device actions like wipe/retire/delete, RBAC roles, and device categories).

Why it’s important: This adds practical governance to prevent accidental or unauthorized policy changes—especially valuable in environments where configuration drift can quickly lead to non-compliance.

2) Advanced Analytics: richer Multiple Device Query (MDQ) results

Advanced Analytics now includes improved MDQ usability and precision:

• Operator details are now shown in query results, including join types (such as leftanti and rightsemi) to help identify “missing” device conditions more accurately.
• Clickable join syntax in MDQ results for faster navigation to device details.
• Improved error messaging.
• Simplified joins: admins can now join results on the Device field without custom Device syntax.

Why it’s important: Better query fidelity helps admins find compliance gaps, missing configurations, or device cohorts at scale—critical for Zero Trust decisions that depend on accurate inventory and state data.

3) Apple DDM policies now support assignment filters

Previously, Declarative Device Management (DDM) policies couldn’t use assignment filters, limiting targeting flexibility (for example, separating corporate vs. personal devices). Now, Intune supports assignment filters for DDM-based policies, aligning the experience with traditional MDM-based policies.

Examples:

• Target software updates only to devices on iOS 17+ using an OS version filter.
• Target ADE supervised devices while excluding personal devices using an enrollment profile name filter.

Why it’s important: As Apple expands DDM across iOS, iPadOS, macOS, visionOS, and tvOS, admins need consistent, precise targeting to avoid overreaching deployments.

Impact on IT admins and end users

• Admins gain stronger change control for high-impact policies, improved troubleshooting and fleet analysis via MDQ enhancements, and reduced need for duplicate policies or blanket update assignments.
• End users benefit from fewer unintended policy changes and more appropriate update targeting (especially for BYOD scenarios).

Action items / Next steps

• Review whether multi-admin approval should be enabled for compliance and Settings catalog configuration policies in your tenant.
• Update internal change management guidance to include the new approval workflow and confirm audit log retention meets governance needs.
• If you use Apple DDM, revisit your assignment strategy and implement filters to better separate corporate and personal device experiences.
• For analytics-heavy environments, re-check MDQ queries and take advantage of improved joins and operator visibility to tighten fleet reporting.