A lot has landed in Intune and Windows this year, and most of it got written up in the usual dense, acronym-heavy way. This is the plain-English version - what actually changed, why it matters, and what you genuinely need to do about it. No PowerShell wall, no registry dive. Just the story.
Three things are worth your five minutes: your licensing just got more generous, Windows devices now talk to the cloud in two different ways depending on what they're doing, and a new laptop can now recognise your company before anyone even logs in.
From July 2026, several premium Intune Suite features - remote help, endpoint privilege management, advanced analytics, and cloud-based certificate management among them - are folding into standard Microsoft 365 E3 and E5 licenses, at a modest price increase. Separately, Windows now has a second, faster way of receiving policy from Intune alongside the classic one, which matters if you've ever wondered why a setting took hours to land. And Autopilot devices can now be tied to your company at the firmware level before the box is even opened, which finally lets you brand the very first screen a new laptop shows.
Your licence just got more useful
Starting July 2026, Microsoft is folding a chunk of the paid Intune Suite add-on directly into the Microsoft 365 E3 and E5 licenses most organisations already own. Features that used to cost extra - remote help for end users, deeper device analytics, endpoint privilege management, and Microsoft's cloud-based certificate service among them - now just come with the license.
The price of E3 and E5 both went up a little to pay for it, but if you were already paying for the Intune Suite add-on separately, this is very likely a net saving. If you weren't, you've just been handed tools you didn't have yesterday, for free.
The bigger picture: Microsoft is betting that bundling these features in will push IT teams away from separate, agent-heavy device management add-ons and toward doing everything through Intune. Whether or not that's the right call for your organisation, it's now a much cheaper experiment to run.
Two ways your PC talks to Intune
Here's something that explains a lot of "why did that setting take so long to apply" tickets. Windows now has two separate channels for talking to Intune, and they behave very differently.
The old way works like a phone call where you have to hang up and redial for every single question. Intune asks the device "what's your current setting?", waits for an answer, sends one change, and asks again to confirm it landed. It does this check-in roughly every eight hours by default. If someone changes a setting by hand in between check-ins, the device just sits there non-compliant until the next call.
The new way is more like handing someone a full instruction sheet and trusting them to keep checking their own work. Intune sends the device one complete document describing everything it should look like, and a background process on the device re-checks itself against that document every four hours - on its own, without waiting to be asked. If something drifts, the device fixes itself and only bothers Intune if it genuinely can't.
The one thing worth knowing if you manage a firewall: the newer channel talks to a different address than the classic one does. If your network team is intercepting and inspecting HTTPS traffic for security scanning, and that inspection also catches the newer channel's traffic, the connection breaks and those specific features quietly stop working - no error message, they just never turn up. If endpoint privilege management or device inventory ever seem to be silently missing on some devices, that's the first thing worth ruling out with your network team.
A laptop that knows your company before it's turned on
This is the one that's actually a bit exciting. Autopilot's fast, no-hash-registration setup mode (Device Preparation) had one annoying gap since it launched: because the device didn't know which company it belonged to until someone actually signed in, all the early setup screens - language, keyboard layout, company branding - showed up generic. By the time the device knew who owned it, the user had already clicked past the screens that setup was supposed to customise.
The fix moves that recognition earlier - all the way to the moment the laptop is switched on for the very first time, before a network connection is even needed for identity. A technician exports a small cryptographic identity file from the device (generated by a security chip built into the hardware) and uploads it to Intune ahead of time. From then on, the very first time that specific laptop boots and reaches the internet, it can prove who it is immediately, and the setup screens are customised from the first moment rather than the third or fourth.
Because that identity gets written into the laptop's own firmware rather than just stored in the cloud, it survives things that would normally wipe a device clean - a factory reset, a fresh Windows install, even swapping the hard drive. The laptop remembers who it belongs to at a level below the operating system.
Five smaller changes worth knowing about
None of these need a deep explanation, but all five are worth having on your radar.
- Certificates without running your own servers. Microsoft's cloud-based certificate service (Cloud PKI) is now available to more organisations through the licensing change above. If issuing and renewing device certificates has meant babysitting an on-premises server, this is worth a look - it can hand that job to Microsoft entirely, or sit alongside an existing certificate setup if you're not ready to move everything.
- Patching that doesn't ask permission first. Windows Autopatch - Microsoft's automated patching service - is now available on more license tiers, and "hotpatching" (installing a security update with no restart required) has become the default for a growing share of devices, not just an opt-in extra.
- Office's update channels are merging. The slower, twice-a-year update track for Microsoft 365 Apps is being retired in favour of the monthly one. If your organisation deliberately chose the slower track for stability, this is worth flagging to whoever owns that decision before it changes underneath them.
- Backup is moving into Intune. The older "Enterprise State Roaming" feature for syncing user settings between devices is being retired in favour of Windows Backup policies managed directly in Intune - one less separate system to know about.
- AI agents can now be blocked like any other unwanted app. Windows compliance policies can flag specific unauthorised AI tools running on a device and mark it non-compliant, the same way an outdated antivirus would - useful as "shadow AI" tools spread faster than most policies can keep up with.
What to actually do about all this
- Check what your licence gives you now. If you were paying separately for Intune Suite add-ons, go check whether you're now paying twice for something that's included by default.
- Don't panic about the two sync engines. You don't need to manage this directly - just know it exists, so a device that seems "stuck" on one feature but fine on everything else makes sense instead of looking broken.
- Tell your network/security team about the newer channel's address if your organisation does SSL inspection on outbound traffic - it's a five-minute conversation that can save a very confusing troubleshooting session later.
- If you deploy hardware at scale, look at Device Association before your next big rollout, not during it - it changes your provisioning process, not just a setting in the portal.
References
- Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5 - Microsoft's own announcement, with the live, current feature-to-license breakdown.
- Windows declared configuration protocol - Microsoft Learn's technical description of the newer, self-checking policy channel.
- Overview of Windows Autopilot device association - how the firmware-backed identity link actually works.
- What is Windows Autopatch? - the official overview of the automated patching service mentioned above.
- Overview of Microsoft Cloud PKI for Microsoft Intune - the cloud certificate service, for anyone tired of running their own.