Microsoft Intune May 2026: Android, macOS, PKI

Introduction

Microsoft Intune’s May 2026 updates are centered on a practical goal: making device management easier without sacrificing control or security. For IT admins, the release brings meaningful improvements to Android enrollment and app deployment, macOS identity setup, and Cloud PKI renewal workflows.

What’s new in Intune for May 2026

Android management improvements

Several Android updates are now generally available:

• Personal Work Profile Android Management API now supports a web-based enrollment flow, so users no longer need to find and install the Company Portal app before starting enrollment.
• Direct management of Android LOB apps is now generally available for Android Enterprise fully managed and dedicated devices. Admins can upload APKs directly to Intune instead of relying on Managed Google Play.
• Admins can now deploy multiple versions of the same app to different groups and avoid package-name limitations.
• Mobile Threat Defense apps can receive enhanced security permissions on supported Android Enterprise devices, helping threat protection continue running even when devices apply app suspension or battery optimizations.

macOS Platform SSO during setup

Platform SSO registration during Automated Device Enrollment (ADE) for macOS is now generally available.

Previously, users had to complete PSSO registration after enrollment through a desktop notification, which was easy to miss. Now, registration happens during setup, linking the Mac to Microsoft Entra ID before the user reaches the desktop. This should reduce authentication issues, missed registrations, and compliance problems.

Cloud PKI CA renewal

Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities.

This removes the need to create a new issuing CA and manually update dependent SCEP profiles. Intune also creates a staged CA with a temporary SCEP endpoint so admins can validate issuance before activation, reducing outage and misconfiguration risks.

Why this matters for IT administrators

These updates help admins standardize and simplify common management tasks:

• Faster, more consistent Android enrollment
• Greater control over internal Android app distribution
• Fewer macOS identity and compliance issues during onboarding
• Lower operational overhead for certificate renewal
• A smoother path for phased app migration from Configuration Manager to Intune

Microsoft also reinforced that app migration to Intune does not need to be all-or-nothing. Co-management and phased migration remain the recommended approach, especially for organizations moving workloads gradually.

Next steps

• Review whether web-based Android work profile enrollment fits your BYOD strategy.
• Test direct APK deployment for internal Android apps.
• Update macOS enrollment workflows to include Platform SSO during ADE.
• Check expiration timelines for Cloud PKI issuing CAs and plan staged renewals.
• Reassess your Configuration Manager to Intune app migration plan using pilot groups and low-complexity apps first.

Overall, the May 2026 Intune release is less about flashy features and more about removing friction from day-to-day administration.