azureblog.co.uk
← cd ~/posts

Intune in August: unattended Remote Help, DDM app installs and eSIM

Helpdesk agents can now support Windows devices with nobody at the keyboard, Apple VPP apps can install through declarative device management, and corporate Android gets eSIM control.

2 min read✓ checked 2 Sept 2026Intune · What's new
On this page
  1. Unattended Remote Help for Windows
  2. Declarative device management for VPP apps
  3. eSIM management for corporate Android
  4. Also new
  5. What to do this month

Unattended Remote Help for Windows

Remote Help on physical Windows devices now supports unattended sessions. Helpdesk agents sign in with their own credentials and connect without a user being present. It's ideal for kiosks, meeting room PCs and out-of-hours fixes. Lock it down with Remote Help roles and scope tags so only the right people can use it on the right devices.

Attended

  • User is at the device
  • User accepts the session
  • Best for live troubleshooting

Unattended

  • No one at the keyboard
  • Agent signs in with their own credentials
  • Kiosks, meeting rooms, out of hours
Attended and unattended sessions.

Because nobody approves an unattended session, permissions matter more. Use a dedicated Remote Help role, scope it with scope tags to the device groups that need it, and review the session reports regularly.

Declarative device management for VPP apps

Apple Volume Purchase Program apps can now install through declarative device management (DDM). Set the management type to when you upload the VPP token. It requires iOS/iPadOS 17.2 or later, or macOS 26 or later. DDM lets devices act on their own state rather than waiting for commands, which tends to make installs faster and more reliable.

Command-based (MDM)

  • Intune sends commands
  • Device reports back later
  • State can drift between check-ins

Declarative (DDM)

  • Intune sends the desired state
  • Device applies and maintains it
  • Device reports status changes itself
Command-based versus declarative management.

eSIM management for corporate Android

On corporate-owned Android devices, you can now activate eSIMs, remove individual eSIMs, and choose whether eSIMs are removed during a wipe. It requires Android 15 or later, or Android 17 for work profile devices, and uses the preview device view.

Also new

  • Audit mode for Defender Antivirus on Linux, to detect threats without quarantining while you test.
  • Apple OS 27 settings in beta in the Settings Catalog, for testing ahead of release.
  • A security baseline for Windows 365 for Agents.

What to do this month

  • Decide who may run unattended Remote Help, and set up roles and scope tags
  • Check your Apple devices meet the OS requirement before switching VPP tokens to DDM
  • Corporate Android: decide whether eSIMs should be removed on wipe
  • Test Apple OS 27 settings on beta devices only
Sources

Related posts