The EPM pilot as a build sheet: the user-targeted pilot group with the licensing rationale, the elevation settings policy with every value given and the Not Configured trap named, assignment, three-check device validation, and one elevation request run end to end.
EPM rollout has two halves that move together: expanding rings with the pilot playbook, and actually removing standing local admin as each ring proves out. Plus the operating cadence, rule hygiene, and the four failure modes that kill deployments.
The EPM pilot is a discovery phase, not an agent test: run support-approved with no rules, triage the request queue nobody notifies you about, and promote repeated requests into rules with deliberate choices on anchor, elevation type, and child process behavior.
The EPM build is one policy and one decision: licensing reality including the EM+S trap, the elevation settings policy that provisions the agent, full-scope reporting as the discovery instrument, and why support approved is the right default elevation response.
Update management built on the old MDM commands stops functioning in the 27.0 releases this fall. Declarative Device Management moves the enforcement into the device itself, and that changes what an update policy is.
One assistant that is genuinely GA, three agents still in preview, and one already retired. A status map of Copilot in Intune, and where AI can carry weight in a production tenant today.
Replacing a Windows device has always been two migrations wearing one name. OneDrive owns the files. Windows Backup for Organizations finally owns the settings, and at 26H2 it becomes the default.
Multi-Admin Approval assumes any admin account, including the most privileged one in the tenant, might be an attacker by the time it makes a change. For protected resources, no single account changes anything alone.
