1. October 2026

2. 6 Oct 2026IntuneNew

   Deployment plans: staged rollouts in rings

   Stage Win32 apps, catalog apps, Settings Catalog and endpoint security policies across rings with controlled timing.

   Microsoft source ↗Read: Intune in September: deployment rings, faster compliance and stricter automation
3. 6 Oct 2026IntunePreview

   Client-driven compliance evaluation

   Supported Windows devices ask Intune to re-evaluate compliance as soon as a signal such as BitLocker or the firewall changes.

   Microsoft source ↗Read: Intune in September: deployment rings, faster compliance and stricter automation
4. 6 Oct 2026IntuneChangeaction needed

   Multi Admin Approval now applies to Microsoft Graph calls

   Scripts and apps that change MAA-protected resources without approval now get HTTP 403. Update them or add a temporary exclusion.

   Microsoft source ↗Read: Intune in September: deployment rings, faster compliance and stricter automation
5. 6 Oct 2026IntuneNew

   Windows 11 26H2 security baseline

   A new baseline version is available. Existing profiles don't update automatically.

   Microsoft source ↗Read: Intune in September: deployment rings, faster compliance and stricter automation
6. 6 Oct 2026IntuneChangeaction needed

   iOS/iPadOS 18 is now the minimum

   Standard device management, Company Portal and app protection now require iOS/iPadOS 18 or later.

   Microsoft source ↗Read: Intune in September: deployment rings, faster compliance and stricter automation

7. September 2026

8. 4 Sept 2026Entra IDRetirementaction needed

   Microsoft-provided SMS and voice MFA retiring

   Text and phone call authentication ends for most users on 1 February 2027. Passkeys are being switched on for affected users.

   Microsoft source ↗Read: Microsoft is retiring its own SMS and voice MFA. Here's your plan.
9. 2 Sept 2026IntuneNew

   Unattended Remote Help for Windows

   Helpdesk agents can connect to physical Windows devices with nobody at the keyboard. Scope the role carefully.

   Microsoft source ↗Read: Intune in August: unattended Remote Help, DDM app installs and eSIM
10. 2 Sept 2026IntuneNew

    Apple VPP apps through declarative device management

    Set the management type to DDM when uploading a VPP token. Needs iOS/iPadOS 17.2+ or macOS 26+.

    Microsoft source ↗Read: Intune in August: unattended Remote Help, DDM app installs and eSIM
11. 2 Sept 2026IntuneNew

    eSIM management for corporate Android

    Activate and remove eSIMs, and choose whether they're removed on wipe, on corporate-owned Android devices.

    Microsoft source ↗Read: Intune in August: unattended Remote Help, DDM app installs and eSIM

12. August 2026

13. 5 Aug 2026IntuneNew

    Custom compliance for macOS

    A script reports values and a JSON rules file defines what's compliant, as on Windows and Linux.

    Microsoft source ↗Read: Intune in July: macOS custom compliance and Defender settings that finally win
14. 5 Aug 2026IntunePreview

    Controlled configuration for Defender Antivirus

    Lets Intune or Defender for Endpoint own Defender settings so Group Policy and other sources stop overriding them.

    Microsoft source ↗Read: Intune in July: macOS custom compliance and Defender settings that finally win

15. July 2026

16. 22 Jul 2026Entra IDChangeaction needed

    Authenticator blocks jailbroken and rooted devices

    Work and school accounts can't be added or used in Authenticator on modified phones. Brief the service desk.

    Microsoft source ↗Read: Microsoft Authenticator now blocks jailbroken and rooted devices
17. 15 Jul 2026Entra IDGA

    BYOD Windows access with Entra registration

    Users, partners and internal guests can reach corporate resources from personal Windows PCs using Entra registration.

    Microsoft source ↗Read: BYOD Windows access with Entra registration is now GA
18. 8 Jul 2026Entra IDChangeaction needed

    Phased move from Connect Sync to Cloud Sync

    Tenants are being notified of their own transition timeline. Inventory your sync features and pilot Cloud Sync.

    Microsoft source ↗Read: Entra Connect Sync is on its way out. Start planning for Cloud Sync.
19. 2 Jul 2026IntuneChange

    Intune advanced features coming to Microsoft 365 E3 and E5

    Remote Help, Endpoint Privilege Management, Cloud PKI and more move into the main licences.

    Microsoft source ↗Read: Intune's advanced features are coming to Microsoft 365 E3 and E5

20. June 2026

21. 24 Jun 2026Entra IDGA

    Entra Backup and Recovery

    Daily, tamper-proof backups of key directory objects with seven days of history, difference reports and restore.

    Microsoft source ↗Read: Entra Backup and Recovery is here: an undo button for your tenant
22. 17 Jun 2026Entra IDGA

    Account Discovery

    Reports accounts inside connected apps, including orphaned accounts with no Entra assignment.

    Microsoft source ↗Read: Account Discovery: find the accounts your SaaS apps forgot to tell you about
23. 10 Jun 2026Entra IDPreview

    Soft delete for device objects

    Deleted devices become recoverable, with their identity and BitLocker keys intact, for a retention period.

    Microsoft source ↗Read: Soft delete for Entra device objects: a safety net for device clean-ups
24. 3 Jun 2026Entra IDGA

    Cross-tenant group sync

    Sync security groups and memberships from a source tenant into target tenants alongside users.

    Microsoft source ↗Read: Cross-tenant group sync is GA: one group, many tenants
25. 1 Jun 2026Entra IDChangeaction needed

    Hard match blocked for users with Entra roles

    Sync can no longer take over a cloud account that holds an Entra role by hard matching.

    Microsoft source ↗Read: Entra Connect Sync is on its way out. Start planning for Cloud Sync.

26. May 2026

27. 27 May 2026Entra IDChange

    System-preferred authentication picks the first factor too

    Users with a passkey may sign in without a password prompt, and registration campaigns can prompt for passkeys.

    Microsoft source ↗Read: System-preferred authentication now picks the first factor too
28. 6 May 2026Entra IDGA

    Entra Agent ID

    First-class identities for AI agents, with sponsors, and Conditional Access for agents in preview.

    Microsoft source ↗Read: Entra Agent ID: giving AI agents real identities

29. April 2026

30. 29 Apr 2026Entra IDGA

    Configurable token lifetimes

    Set access, ID and SAML token lifetimes per application.

    Microsoft source ↗Read: Configurable token lifetimes are GA: when to shorten them (and when not to)
31. 22 Apr 2026Entra IDGA

    Authentication context on PIM activation

    PIM can require a Conditional Access authentication context every time a role is activated.

    Microsoft source ↗Read: Require phishing-resistant MFA on every PIM activation
32. 8 Apr 2026Entra IDGA

    Tenant configuration management APIs

    Snapshot tenant configuration as JSON and monitor it for drift. The admin center experience is in preview.

    Microsoft source ↗Read: Tenant configuration management: snapshot your Entra config and catch drift
33. 1 Apr 2026Entra IDPreview

    Hybrid join using Entra Kerberos

    Windows devices can become hybrid joined at provisioning, without Entra Connect device sync or AD FS.

    Microsoft source ↗Read: Hybrid join without Entra Connect: hybrid join using Entra Kerberos

34. March 2026

35. 18 Mar 2026Entra IDGA

    Synced passkeys and passkey profiles

    Passkeys in password managers and phone platforms are supported, with different passkey rules per group.

    Microsoft source ↗Read: Synced passkeys and passkey profiles are now GA in Entra ID

36. February 2026

37. 25 Feb 2026Entra IDGA

    External MFA

    Third-party MFA providers become a proper authentication method, replacing custom controls.

    Microsoft source ↗Read: External MFA is GA: third-party MFA without giving up Conditional Access

38. January 2026

39. 28 Jan 2026Entra IDGA

    Source of Authority conversion for users

    Switch an individual AD-synced user to cloud-managed without recreating it.

    Microsoft source ↗Read: Converting synced users to cloud-managed: Source of Authority is GA

Each entry links to Microsoft's own announcement. Details can change after publication, so check the source before acting.