Microsoft Intune October 2026: Baselines, EPM, Updates

Introduction

Microsoft Intune’s October 2026 updates focus on a common admin challenge: keeping devices secure and compliant without slowing users down. This month’s changes give IT teams more control over security baselines, delegated device actions, update timing, and Apple onboarding.

What’s new in Intune for October 2026

New security baselines

• Windows 365 for Agents Cloud PCs now have a dedicated security baseline in Intune.
• The baseline includes recommended settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint.
• STIG baseline support is now available for commercial customers, extending beyond previous government cloud availability.
• STIG baselines help organizations audit supported Windows device configurations against DISA recommendations without changing settings automatically.

Endpoint Privilege Management for network changes

• Endpoint Privilege Management (EPM) now lets standard users change IPv4, IPv6, and DNS settings without full local admin rights.
• Users make approved changes through Company Portal.
• Admins can configure rules as automatic or user-confirmed.
• User-confirmed actions can require business justification, Windows authentication, or both.

More control for Windows quality updates

• Windows Autopatch now extends approval and scheduling controls from driver updates to quality updates.
• Admins can approve or auto-approve updates by type, schedule deployments, and pause rollouts.
• Separate controls are now available for:
  • Monthly security updates
  • Monthly non-security updates
  • Out-of-band security updates
  • Out-of-band non-security updates
  • .NET Framework updates
  • Quick machine recovery settings

Apple device management improvements

• Automated Device Enrollment adds a Setup Assistant skip key for the Device features tour on iOS 27 and iPadOS 27.
• The Intune management client on macOS now checks in immediately after first sign-in, then more frequently for the first few hours.
• The Settings Catalog adds more Apple settings, including app controls, Apple Intelligence, network and web content filtering, and macOS login window options.
• iOS/iPadOS Company Portal now supports declarative VPP app downloads, reducing install latency and improving status visibility.
• Intune will also add Apple OS 27 DDM status data to device inventory for deeper visibility.

Why this matters for IT admins

These updates help admins tighten security while reducing operational friction. The new baselines simplify standardization, EPM reduces the need for local admin rights, and expanded Autopatch controls make it easier to align update rollouts with testing and business schedules.

For Apple admins, faster macOS check-ins and richer iOS/iPadOS management should improve the out-of-box experience and speed time to productivity.

Action items

• Review the new Windows 365 for Agents and STIG baselines.
• Evaluate whether EPM network setting controls can replace local admin access for support scenarios.
• Update your Windows Autopatch processes for quality and .NET update scheduling.
• Test new Apple enrollment and declarative app deployment features in pilot groups.
• Verify your compliance workflows for supported Windows devices that can benefit from faster reevaluation.