Designing, deploying, and operating Microsoft Intune. Home of the Intune Deployment Guide.
Running MAM after the design is done: the January 2026 version-floor enforcement, conditional launch as a precedence engine, the two offline timers, selective wipe mechanics, and the Conditional Access grant that actually enforces it.
The operational capabilities the July 2026 change folded into Microsoft 365 E3: Remote Help built on your identity, Advanced Analytics with Device Query, and Tunnel for MAM. What each one is, where its boundary sits, and why these are the easy yes of the Suite.
Microsoft Cloud PKI retires the NDES, connector, and on-premises issuing CA you run purely to hand certificates to your endpoints. What it removes, the cloud-root versus bring-your-own-CA decision, what it will and will not issue, and the boundary that keeps it honest as an endpoint issuer rather than an enterprise PKI.
Endpoint Privilege Management runs users as standard and elevates specific tasks by policy. How the isolated-virtual-account model works, the spectrum of elevation types, why the reporting is the migration path, the Windows-only scope, and how it is now licensed through E5.
As of July 2026 the Intune Suite is folded into Microsoft 365 E3 and E5. What landed in each plan, the EM+S carve-out that will catch people, what each component is, and the deliberate order I would adopt them in.
Enterprise App Management is Microsoft's managed application supply chain. What it actually is, the packaging labor it removes, how it is now licensed through E5, and where it sits against Winget and the deeper third-party tools.
Auto-update turns Enterprise App Management from a packaging accelerator into a managed patch service. What that actually trades away, and the narrow scope where the trade is worth making.
Winget in Intune works, and for a lot of environments it is genuinely fine. I want to say that plainly up front, because the rest of this article is going to be honest about where it sits, and honesty can…
