EPM rollout has two halves that move together: expanding rings with the pilot playbook, and actually removing standing local admin as each ring proves out. Plus the operating cadence, rule hygiene, and the four failure modes that kill deployments.
The EPM pilot is a discovery phase, not an agent test: run support-approved with no rules, triage the request queue nobody notifies you about, and promote repeated requests into rules with deliberate choices on anchor, elevation type, and child process behavior.
The EPM build is one policy and one decision: licensing reality including the EM+S trap, the elevation settings policy that provisions the agent, full-scope reporting as the discovery instrument, and why support approved is the right default elevation response.
Update management built on the old MDM commands stops functioning in the 27.0 releases this fall. Declarative Device Management moves the enforcement into the device itself, and that changes what an update policy is.
One assistant that is genuinely GA, three agents still in preview, and one already retired. A status map of Copilot in Intune, and where AI can carry weight in a production tenant today.
Replacing a Windows device has always been two migrations wearing one name. OneDrive owns the files. Windows Backup for Organizations finally owns the settings, and at 26H2 it becomes the default.
Multi-Admin Approval assumes any admin account, including the most privileged one in the tenant, might be an attacker by the time it makes a change. For protected resources, no single account changes anything alone.
Delegation in Intune is two questions asked separately: what an administrator may do, and which objects exist for them at all. The scoped-permissions change finally makes the answers honest.
