Intune January 2026 Updates: Win32, EPM, Apple

Introduction: why these Intune updates matter

January’s Intune improvements target the day-to-day friction points IT admins feel most: packaging and updating Win32 apps, safely enabling elevation without breaking user-context dependencies, and managing a growing list of approvals and remediation workflows across security and endpoint operations. The result is faster change cycles, cleaner auditability, and a more consistent admin experience.

What’s new

PowerShell script installers for Win32 apps

Intune now supports uploading a PowerShell script as the installer when creating a Win32 app (instead of only specifying a command line). Intune packages the script alongside the app content and runs it in the same context as the installer.

Key benefits:

• Faster iteration: Update the script without repackaging and re-uploading the full app binary each time.
• Better customization: Use scripts for prerequisite checks, dependencies, registry updates, and post-install configuration.
• Improved visibility: Install outcomes report as success/failure in the Intune admin center based on return codes.

This is especially helpful for organizations with strict deployment and compliance requirements (for example, finance and healthcare) where installation workflows often include mandatory checks and remediation steps.

Endpoint Privilege Management (EPM) gets sharper

Two EPM enhancements are highlighted:

• Elevate as current user: Elevation can now preserve the current user profile context (profile paths, environment variables, personalized settings). This is important for installers and tools that rely on the active user’s profile.
• Scope tags for elevation scenarios: Admin visibility into elevation requests can be restricted using scope tags, helping compartmentalize access in regulated or segmented environments.

Together, these capabilities improve usability for end users and strengthen audit trails and compliance reporting for admins.

Admin tasks is now generally available (GA)

Admin tasks (under Tenant Administration) provides a centralized, prioritized queue where admins can search, filter, and sort across operational tasks and approvals.

Currently included workloads:

• EPM elevation requests
• Multi Admin Approval (MAA) tasks
• Microsoft Defender for Endpoint (MDE) security tasks
• Device Offboarding Agent tasks (Microsoft Security Copilot)

This unification matters because approvals, security remediation, and offboarding workflows are increasingly interconnected—and every approval/rejection is recorded to support audit needs.

Apple enrollment: ACME certificates and more Setup Assistant controls

Intune is rolling out ACME protocol support for new iOS/iPadOS/macOS enrollments. New Apple devices will receive an ACME certificate instead of SCEP, improving protection against unauthorized certificate issuance and reducing certificate management errors through automation and stronger validation.

Additionally, Intune adds 12 new Setup Assistant screens you can control during Apple Automated Device Enrollment (ADE), giving more flexibility to streamline (or lock down) the onboarding experience.

Impact on IT admins and end users

• Admins should see reduced app packaging overhead, clearer elevation governance, and fewer “lost” operational tasks spread across multiple blades and tools.
• End users benefit from more reliable app installs, smoother elevation experiences that work with user-profile-dependent tools, and more consistent Apple onboarding.

Action items / next steps

• Review your Win32 app deployment process and identify packages where a PowerShell script installer can reduce repackaging cycles.
• If using EPM, validate where user-context elevation is required (installers/tools dependent on profile paths or environment variables) and ensure admin segmentation aligns with scope tags.
• Pilot Admin tasks as the primary intake queue for EPM/MAA/MDE/offboarding workflows and update runbooks accordingly.
• For Apple platforms, confirm enrollment methods (ADE/Configurator/Device Enrollment) and plan for ACME certificate adoption, plus any updated Setup Assistant experience requirements.