# What’s new in Microsoft Intune – October 2026: STIG baselines, EPM network settings and Autopatch

> What’s new in Microsoft Intune for October 2026: STIG and Windows 365 for Agents baselines, EPM for network settings, Autopatch quality updates and Apple.

- URL: https://benjamintestart.fr/en/whats-new-microsoft-intune-october-2026/
- Author: Benjamin Testart (Devices Practice Leader & Microsoft Intune consultant)
- Published: 2026-11-03
- Updated: 2026-11-03
- Category: Microsoft Intune
- Language: en
- Tags: Microsoft Intune, What's new in Intune, Security baselines, Endpoint Privilege Management, Windows Autopatch, Apple
- Version française: https://benjamintestart.fr/fr/nouveautes-microsoft-intune-octobre-2026/

## TL;DR

In October 2026, Microsoft Intune adds a security baseline for Windows 365 for Agents Cloud PCs and opens the STIG baseline to commercial customers. Endpoint Privilege Management lets standard users change IPv4, IPv6 and DNS settings, Windows Autopatch lets admins approve and schedule quality updates, and Apple gets an iOS 27 skip key, faster macOS check-ins and new settings.

Microsoft Intune’s October 2026 updates revolve around a simple question: **who can change what on a device, and when updates land**. On the menu: a **security baseline for Windows 365 for Agents**, the **STIG baseline** opened to commercial customers, **network setting changes without admin rights** thanks to Endpoint Privilege Management, **quality update approvals** in Windows Autopatch and a series of improvements for **Apple**.

Microsoft’s recap presents these capabilities as available, without labeling them as preview, except for Apple OS 27 DDM status data, which is announced as coming. The “Myth vs. Reality” section, for its part, covers how quickly compliance is reevaluated.

Here is what to remember, and what it actually changes for you.

## October’s updates at a glance

| Feature | Platforms | Status |
| --- | --- | --- |
| Windows 365 for Agents security baseline | Windows 365 for Agents Cloud PCs (Windows 11, Edge, Defender for Endpoint) | Available |
| STIG baseline | Windows | Available to commercial customers (previously offered in government clouds) |
| EPM: network system settings (IPv4, IPv6, DNS) | Windows | Available |
| Windows Autopatch: quality update approval and scheduling | Windows | Available |
| “Device features tour” Setup Assistant skip key | iOS 27, iPadOS 27 (Automated Device Enrollment) | Available |
| More frequent check-ins after first sign-in | macOS | Available |
| New Apple settings in the Settings Catalog | iOS/iPadOS, macOS | Available |
| Declarative VPP apps in Company Portal | iOS/iPadOS | Available |
| DDM status data in device inventory | Apple OS 27 | Coming |

## Security baselines: Windows 365 for Agents and STIG

### A baseline for Cloud PCs used by agents

A Cloud PC that an agent may use must be secured **before its first task runs**. Intune now includes a **security baseline for Windows 365 for Agents Cloud PCs**. It deploys recommended settings for **Windows 11**, **Microsoft Edge** and **Microsoft Defender for Endpoint**.

In practice: you start from a consistent security posture for your agentic workloads, then customize only what those workloads really need. A device type that would be easy to forget.

### The STIG baseline comes to commercial customers

**STIGs** (Security Technical Implementation Guides) are the configuration recommendations from **DISA** (Defense Information Systems Agency). Intune’s **STIG baseline**, previously limited to government clouds, is now **available to commercial customers**.

Key point: it is used to **audit** supported Windows device configurations and identify settings that don’t meet the recommendations, **without changing any device settings**. If your compliance requirements rely on STIGs, you get a measure of the gap with no risk of breaking anything. To get started, see [Manage security baseline profiles in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-security/security-baselines/configure-baselines).

## Endpoint Privilege Management: change network settings without admin rights

Changing an IP address shouldn’t mean handing out local admin rights. **Microsoft Intune Endpoint Privilege Management (EPM)** now allows **standard users** to change their network settings through a **dedicated experience in Company Portal**.

It relies on an **elevation system settings policy**. It lets the user change **IPv4**, **IPv6** and **DNS server** values on their device’s network adapters, without broad administrator rights or a separate app deployment.

Two rule modes are available:

- **automatic**: the change applies directly;
- **user confirmed**: you can then require a **business justification**, **Windows authentication**, or both, before the change applies.

My take: this is the typical use case for field technicians or users who need to set a static IP address for a piece of equipment. Instead of keeping a local admin account “just in case”, you scope this action precisely. Details are in [Manage system settings with Endpoint Privilege Management](https://learn.microsoft.com/en-us/intune/epm/manage-system-settings).

## Windows Autopatch: plan quality updates around users’ work

Not every update needs the same schedule. **Windows Autopatch** extends the **approval and scheduling** process already used for **driver updates** to **quality updates**. You can **approve or auto-approve** updates by type, **schedule** deployments and **pause** rollouts when needed.

Four types can now be managed independently:

- monthly security updates;
- monthly non-security updates;
- out-of-band security updates;
- out-of-band non-security updates.

These expanded controls also let you configure **.NET Framework updates** and **Quick machine recovery** controls for boot-critical issues.

In practice: you can align non-security updates with your testing, compliance requirements and business readiness, while handling security updates according to their urgency. See [Windows quality and .NET Framework updates](https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-overview).

## Apple: faster setup and new settings

### A new Setup Assistant skip key

**Automated Device Enrollment** profiles now include a Setup Assistant skip key for the **Device features tour** screen, on supported devices running **iOS 27** and **iPadOS 27**. It joins the **Liquid Glass** and **Accessibility Appearance** skip keys added in August.

### macOS: more frequent check-ins after first sign-in

The Intune management client on **macOS** now checks in **right after the user’s first sign-in**, then **frequently for the next couple of hours**, before returning to the standard **hourly** schedule while the device is online. Apps, scripts and related assignments therefore arrive sooner, without admin or user action. The intervals are described in [the documentation on policy refresh intervals](https://learn.microsoft.com/en-us/intune/device-configuration/troubleshoot-device-profiles#policy-refresh-intervals).

### New Apple settings in the Settings Catalog

The **Settings Catalog** gains options for supported iOS/iPadOS and macOS devices: **app settings**, **Apple Intelligence**, **network and web content filtering** and the **macOS login window**. Everything is configured through the usual Settings Catalog policy workflow; see [create a policy using settings catalog](https://learn.microsoft.com/en-us/intune/intune-service/configuration/settings-catalog).

### Declarative VPP apps in Company Portal

The **iOS/iPadOS Company Portal** now supports downloading **declarative VPP (Volume Purchase Program) apps** from the **Apps** tab. They install with less latency, can **update automatically overnight** and show users **live installation status**. If you don’t use declarative VPP apps, nothing changes for you or your users.

### Coming: Apple OS 27 DDM status in inventory

Intune **will add** Apple OS 27 **declarative device management (DDM)** status data to device inventory: system health for supported hardware components, content cache details, enhanced logging and MDM status. The information available will vary by operating system, hardware, enrollment type and supported DDM capabilities.

## Myth of the month: compliance takes hours to be reevaluated

The myth: after a policy or security setting change, Intune takes hours to reevaluate a device’s compliance.

In reality, two mechanisms speed things up:

- when you **update or assign a compliance policy**, Intune uses **Fast Lane** to notify devices to sync and receive the new requirements;
- **supported Windows devices monitor key security settings locally**, even when requirements don’t change. If the firewall is turned off, the device detects the change and requests a check-in without waiting for the next scheduled one, reducing the vulnerability window.

It also works the other way: when antivirus returns to a healthy, up-to-date and active state, the device can trigger a check-in. A user blocked by **Conditional Access** therefore regains access sooner once the issue is resolved. To go further: [Create a compliance policy in Microsoft Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/create-compliance-policy).

## Also announced this month

In November, Microsoft won’t publish a “What’s New” recap: instead, **Microsoft Ignite 2026** takes place **November 17–20** in San Francisco and online. The session **AI ready endpoints: secure, manage and scale (BRK404)**, with Jason Roszak and Eugenie Burrage, will show where Intune is headed.

## What I recommend doing this month

1. **Deploy the STIG baseline in audit** if your compliance requirements reference it: it changes no settings and gives you a measure of the gap.
2. **Identify users who have local admin rights to manage network settings** and replace them with an EPM elevation system settings policy, in user-confirmed mode with a justification.
3. **Review your quality update schedule in Windows Autopatch**: separate security and non-security updates, and decide how to handle out-of-band updates.
4. **Add the Device features tour skip key** to your Automated Device Enrollment profiles for devices running iOS 27 and iPadOS 27.
5. **Prepare a baseline for Windows 365 for Agents** before making Cloud PCs available to agents.

## Key takeaways

- A security baseline now covers Windows 365 for Agents Cloud PCs: Windows 11, Microsoft Edge and Defender for Endpoint.
- The STIG baseline is available to commercial customers; it audits Windows devices without changing their settings.
- With an EPM elevation system settings policy, a standard user changes IPv4, IPv6 and DNS from Company Portal, with a justification or authentication if required.
- Windows Autopatch lets admins approve, schedule and pause four quality update types independently, and configure .NET Framework and Quick machine recovery.
- Apple: Device features tour skip key for iOS/iPadOS 27, frequent macOS check-ins after first sign-in, new Settings Catalog options and declarative VPP in Company Portal.
- Apple OS 27 DDM status data is coming to device inventory.

## Frequently asked questions

### Does the Intune STIG baseline change device settings?

No. It audits supported Windows device configurations against DISA recommendations and identifies settings that don’t meet them, without changing any device settings.

### How can a standard user change their IP address with Intune?

With an Endpoint Privilege Management elevation system settings policy: the user changes IPv4, IPv6 and DNS server values from Company Portal. The rule can be automatic or user confirmed, with a business justification, Windows authentication or both.

### Which quality updates can be managed separately in Windows Autopatch?

Monthly security updates, monthly non-security updates, and their out-of-band equivalents. Each type can be approved, auto-approved, scheduled or paused independently.

### How often does a Mac check in with Intune after the first sign-in?

The Intune client checks in right after the user’s first sign-in, then frequently for about the next two hours, before returning to the standard hourly check-in while the device is online.

## Sources and documentation

- [Microsoft Intune Blog: What’s new in Microsoft Intune – October](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-october/ba-p/4537396)
- [Microsoft Learn: Manage security baseline profiles in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-security/security-baselines/configure-baselines)
- [Microsoft Learn: Manage system settings with Endpoint Privilege Management](https://learn.microsoft.com/en-us/intune/epm/manage-system-settings)
- [Microsoft Learn: Windows quality and .NET Framework updates](https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-overview)
- [Microsoft Learn: Questions with policies and profiles in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-configuration/troubleshoot-device-profiles#policy-refresh-intervals)
- [Microsoft Learn: Create a policy using settings catalog](https://learn.microsoft.com/en-us/intune/intune-service/configuration/settings-catalog)
- [Microsoft Learn: Create a compliance policy in Microsoft Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/create-compliance-policy)