Intune drops legacy Apple setup and update options in release 2610

Intune drops legacy Apple setup and update options in release 2610

26 October 2026: Microsoft's Intune service release 2610 ends support for legacy Setup Assistant authentication in Apple automated device enrolment and removes the old Apple MDM software update workloads, after Apple retired the commands behind them in OS 27. The same release asks Windows administrators to open a new firewall endpoint for push-driven actions. Enrolment profiles convert on their own; software update policies do not.

Not yet independently verified. This rests on Microsoft's Intune "What's new" page, which dates the changes only to the week of 26 October and gives no per-item date. We have not found a Message Center post or an independent report for these items. We will update this when it can be confirmed, and remove this note.

Enrolment profiles switch to modern authentication

For iOS, iPadOS and macOS devices enrolled through Apple Business Manager or Apple School Manager with user affinity, Intune "has ended support for Setup Assistant (legacy) authentication". Existing profiles are updated automatically to Setup Assistant with modern authentication, the legacy option has gone from the create and edit screens, and devices already enrolled stay enrolled.

The change shows up at the next enrolment or reset rather than on current devices. Modern authentication runs the Microsoft Entra sign-in inside Setup Assistant, so Conditional Access policies that block unregistered devices, or demand MFA methods a new hire has not set up yet, can stop a device mid-setup. That is worth testing on a spare device before the next batch of laptops is unboxed.

Update policies need rebuilding on declarative management

Intune "is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27". The replacement is Apple declarative device management (DDM) update policies, and Microsoft links a migration guide. Unlike the enrolment change, nothing is converted for you: a tenant still relying on the old iOS/iPadOS update policies or the older macOS update settings needs DDM policies in place, or devices on OS 27 will stop receiving the deadlines and deferrals administrators set.

The release also adds OS 27 DDM status data to device inventory, covering hardware health, content cache status, enrolment type and lockdown mode, which is the easiest way to confirm the new policies are being reported back.

A new endpoint for Windows push actions

For Windows, Microsoft says it has improved connectivity for anything that depends on push notifications: remote device actions, Win32 app installs, PowerShell scripts and Remediations. It recommends adding this endpoint to firewall and proxy allow lists:

• *.trouter.communications.svc.cloud.microsoft

Organisations that run strict outbound allow lists will see those actions arrive late, at the next check-in, rather than straight away, if the endpoint is blocked.

Other changes in 2610

The release also brings Apple's Enforce Routes capability to iOS and macOS VPN profiles, Administrator protection settings for Windows 11 in Account protection policies, STIG audit baselines for commercial tenants with Intune Advanced Analytics, referenced apps on AOSP devices, and health signals for the Certificate Connector in the admin centre. Our mobile device management category lists eight products.

Company profile on TrustList: Microsoft

Related on TrustList:

• Windows 11 23H2 Enterprise and Education support ends 10 November
• Apple will limit Rosetta to older games from macOS 28 onwards
• Windows 10 Extended Security Updates year two: commercial price doubles to $122 per device from mid-October 2026

Sources

• Microsoft Learn: What's new in Microsoft Intune, week of October 26, 2026 (Service release 2610), 26 October 2026