MDM Monthly: July 2026 Windows, Apple, Intune Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for July 2026, covering Microsoft Intune and Windows 11, Apple iOS and macOS, Jamf, Android Enterprise, Microsoft Entra and Ivanti.

July was Microsoft’s month. Patch Tuesday landed with the largest batch of fixes I can remember and two zero-days already under attack, and Microsoft announced the end of native SMS and voice sign-in for Entra. Apple’s 26.6 releases arrived on the 27th with no exploitation notes, Jamf shipped three builds in three weeks, and Google’s July Android bulletin listed no vulnerabilities at all.

Executive Summary

Microsoft’s July Patch Tuesday was the largest on record by Security Affairs’ count, with exploited zero-days in Active Directory Federation Services and SharePoint Server.
Microsoft is ending native SMS and voice sign-in for Entra on February 1, 2027, and passkeys become the default sign-in experience starting September 1.
Jamf Pro 11.30.2 fixes a macOS 26.6 enrollment failure, and Google’s July Android bulletin listed no vulnerabilities.

Executive view: cost and risk

Opex: A passkey registration campaign costs helpdesk time and user communication. Microsoft says organizations that keep SMS or voice must use a third-party telecom provider and pay its costs, with pricing shared on September 18, so compare that with the cost of registering users. The record patch volume also adds ring-testing labor.
Capex: Shared devices and kiosks have no individual user to register a passkey, so list them early. They are where design changes, and sometimes device changes, land.
Enterprise impact: Exploited flaws in AD FS and SharePoint sit in identity and collaboration infrastructure. After February 1, 2027, users who rely on SMS or voice and haven’t registered a passkey can’t sign in.
Decision needed: Set a registration deadline well ahead of February 1, 2027. Decide which users, if any, keep SMS or voice through a paid provider, and add passkey re-registration to every tenant migration plan.

Download the one-page executive brief (PDF)

Microsoft: a record Patch Tuesday, two exploited zero-days and Intune 2607

Patch Tuesday, July 14. Counts vary by tracker, from about 570 to 620 CVEs. Security Affairs, citing the Zero Day Initiative, counts 621, 63 of them rated Critical, and calls it the largest release ever. Three zero-days matter here:

CVE-2026-56155, Active Directory Federation Services: An elevation of privilege flaw that is actively exploited. It needs local access and low privileges. If you run AD FS for hybrid identity or device registration, patch it first.
CVE-2026-56164, SharePoint Server: An elevation of privilege flaw caused by missing authentication that can be reached over the network. It is also actively exploited, and Malwarebytes reports that CISA added both exploited flaws to its Known Exploited Vulnerabilities catalog.
CVE-2026-50661, Windows BitLocker: A security feature bypass that needs physical access. It is publicly disclosed but not known to be exploited. Lost and stolen laptops are exactly where it matters, so confirm your BitLocker policies and TPM-plus-PIN settings while you patch.

The critical list also includes unauthenticated remote code execution in Windows DHCP Server (CVE-2026-50518) and in the RDP Server (CVE-2026-56190), plus a Hyper-V VMSwitch flaw (CVE-2026-57092) that lets an attacker in a virtual machine reach the host.

Out-of-band update, July 18. Microsoft released KB5121767 for Windows 11 25H2 and 24H2 after the July update caused performance and power problems on Dell PCs running the Intel Innovation Platform Framework driver. Microsoft had already blocked the July update on those devices. Only affected PCs need the fix, and because it is cumulative, anything not yet on the July update picks it up anyway. Optional preview builds followed on July 28, per Microsoft’s release health page.

Entra: passkeys by default, SMS and voice end. In a July 13 post, Microsoft announced that passkeys become the default sign-in experience in Entra ID and that native SMS and voice authentication ends. This applies to the public cloud, and other clouds follow later. The dates are September 1 (rollout begins, and users enabled for SMS or voice are enabled for passkeys and prompted at their next MFA sign-in), September 18 (Microsoft shares supported telecom providers and pricing), October 30 (admins can configure a provider) and February 1, 2027 (Microsoft-provided SMS and voice ends). After that, users who rely on SMS or voice must register a passkey to sign in.

Intune service release 2607 (week of July 27). Microsoft’s what’s new page lists these changes:

Samsung: Knox E-FOTA brings firmware update management for corporate-owned Samsung devices (COSU, COBO and COPE), including version control and scheduled downloads.
macOS: Custom compliance now supports scripts and JSON rules, as it already did for Windows and Linux.
Windows security: Controlled Configuration for Microsoft Defender antivirus, in preview, makes Intune and Defender for Endpoint settings authoritative over Group Policy, Configuration Manager and local scripts.
Windows management: Registry value collection in device inventory policies, a Sync action that runs a full sync of policies, apps and scripts, and regional selection for Microsoft Store apps so you can deploy from markets such as Japan or Spain.
Enrollment: Admins can show or hide the Apple ID, Diagnostics Data and Location Services screens for tvOS and visionOS Automated Device Enrollment, and zero-touch enrollment now has its own RBAC permission.

In the week of July 13, Multiple Managed Accounts support for Outlook on iOS/iPadOS started rolling out gradually, so you may not see it in your tenant yet. The service release lists no deprecations.

Apple: iOS 26.6 and macOS Tahoe 26.6, with no exploited flaws noted

On July 27 Apple released iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6 and Safari 26.6, each with published security content. In the iOS 26.6 and macOS Tahoe 26.6 advisories, Apple doesn’t say it is aware of exploitation for any entry, so this is a scheduled update cycle and not an emergency one.

The fixes follow a familiar pattern. Memory safety bugs in the kernel, WebKit and media parsers such as ImageIO and Model I/O dominate. The macOS advisory also lists sandbox escapes, Screen Sharing Server and Accounts entries, and Gatekeeper and quarantine bypasses, which are the ones that matter most to teams that rely on those controls for unmanaged downloads.

For management teams the practical item is Jamf’s. Jamf Pro 11.30.2 fixes an issue where Macs running macOS 26.6 or later could fail Automated Device Enrollment or user-initiated enrollment with error code 71. If you refresh or reprovision Macs, hold the 26.6 image back or move to that Jamf build first. More on that below.

Apple’s bigger management story in July is what’s coming. Its WWDC26 documentation, published in June, says legacy software update commands stop working in the 27.0 releases, so declarative software updates are the only path. The details are in the What to watch section.

Jamf Pro 11.30, 11.30.1 and 11.30.2

Jamf shipped three builds in July, per its 11.30.x release page.

Jamf Pro 11.30 (July 14): A new Last Contact inventory attribute shows when a computer or mobile device last checked in, and you can use it as smart group and advanced search criteria. It is a quick way to find stale devices. Jamf Cloud upgrades ran by region on July 24 and 25.
Entra ID connection change (breaking for existing connections): New connections in Jamf Account read group data with the GroupMember.Read.All and User.Read permissions instead of Directory.Read.All. Existing connections need their Groups Scope value updated to take the narrower permissions. The SSO work also adds support for the Entra ID consent flow for multi-tenant applications and embedded domain verification.
Jamf Pro 11.30.1 (July 23): A maintenance release whose changes are in the release notes on Jamf’s Learning Hub.
Jamf Pro 11.30.2 (July 31): Per Jamf’s announcement, it fixes a vulnerability in Jamf Pro’s XPC validation (no CVE ID listed) and the macOS 26.6 enrollment failure with error code 71. Self-hosted environments should upgrade.

Android Enterprise: an empty security bulletin and Android Management API changes

Google published the July Android Security Bulletin on July 6 with patch levels 2026-07-01 and 2026-07-05, and it states that the bulletin contains no security vulnerabilities. There is nothing to roll out for security this month, which makes July a good time to clean up patch-level compliance rules and check which devices are falling behind.

The more useful reading is the Android Management API H1 2026 update, also from July 6:

Android XR (new): Admins can manage company-owned XR headsets and AI glasses with the same Android Enterprise controls used for phones and tablets.
Application roles (migration required): The new roles field replaces extensionConfig in ApplicationPolicy, and Google says extensionConfig is deprecated. If your EMM or custom tooling still sets it, plan the change.
Policy additions: autofillPolicy lets admins disable the autofill service, privateDnsSettings manages private DNS on fully managed and company-owned work profile devices, and userInitiatedAddEsimSettings blocks users from adding eSIM profiles on Android 15 and later.
Provisioning: provisioningInfo is available for up to 24 hours after provisioning, so retrieve it within that window.

Google’s Android Management API release notes add that support for Android 6.0 is now deprecated, with no end date. Devices on 6.0 can still enroll but stop receiving API updates. AMAPI SDK 1.8.2 shipped, and a bug that could trigger consumer Factory Reset Protection on company-owned devices after a reset, even with no FRP admin emails set, is fixed.

Also on the radar

Ivanti: Ivanti’s July security update, last updated July 14, covers Ivanti Xtraction only. Ivanti says it has no evidence of exploitation and that no other Ivanti products are affected, so Endpoint Manager and Neurons for MDM have nothing to patch this month.

What to watch

August 11: The next Patch Tuesday.
September 1, September 18, October 30 and February 1, 2027: Microsoft’s Entra timeline for passkeys by default and the end of native SMS and voice sign-in, covered above.
October 13 and November 10: Per Microsoft’s release health page, Windows 11 24H2 Home and Pro reach end of updates on October 13, and 23H2 Enterprise and Education follow on November 10.
Windows 11 26H2: Microsoft hasn’t announced a date. Guru3D’s report of Microsoft’s guidance says it arrives as an enablement package for 24H2 and 25H2, and that Windows on ARM devices running 26H1 can’t upgrade to it directly.
Apple OS 27, no date given: Apple’s WWDC26 device management notes say legacy software update commands, queries, recommended cadence settings and update restrictions stop working in 27.0. They also say management services need TLS 1.2 or later with cipher suites and certificates that meet the new App Transport Security requirements, the AssetCache profile is deprecated in macOS 27, and backups no longer restore enrollment, management or supervision state on iOS, iPadOS and visionOS 27. Apple marks these features as pre-release.
Apple volume purchasing, later this year: Apple says IT will be able to assign auto-renewing app subscriptions to users and buy free apps without license quantities, per its June 30 services update.
Intune and legacy Apple updates: Microsoft said in March that Intune will stop creating legacy iOS/iPadOS and macOS update policies. No date given.
Defender Controlled Configuration: It is in preview in Intune with no general availability date.
Android Management API: The extensionConfig to application roles migration is required, and Android 6.0 support is deprecated with no end date.

My take

My position: The end of SMS and voice sign-in is a registration project that touches enrollment, the helpdesk and tenant migrations, so budget it like a project and not a patch.

The item that will cost the most effort this quarter isn’t the largest Patch Tuesday on record. It is Microsoft ending native SMS and voice sign-in for Entra. Patching is a routine you already run. Moving every user to a phishing-resistant method touches enrollment, help desk volume and, for anyone planning a migration, the tenant boundary.

Enrollment is where I’d look first. Company Portal enrollments, Autopilot and user-enrolled personal devices all lean on MFA prompts, and plenty of those users have only a phone number registered. Shared devices and kiosks are harder, because there’s no individual user to register a passkey. Teams planning tenant-to-tenant moves should assume users register passkeys again in the destination tenant, because the credential belongs to the account in the old one. Put that registration step in the cutover runbook, not in a follow-up ticket.

The cost angle is real too. Microsoft says organizations that keep SMS or voice must use a third-party telecom provider and pay its costs, with pricing shared on September 18. Treat that as a budget line and compare it with the price of a registration campaign.

In order, I would inventory who is still on SMS or voice, pilot passkeys before September 1, run a registration campaign in October, and keep the telecom option for the few cases that truly need it.

My prediction: by the first quarter of 2027, at least one major UEM vendor will let users register a passkey during device setup, and enrollment flows will stop assuming a phone number.

What to do next

Patch AD FS and SharePoint Server for CVE-2026-56155 and CVE-2026-56164 first, since both are exploited, then work through the DHCP, RDP and Hyper-V fixes. Confirm BitLocker policies on laptops while you are there.
Check Dell PCs with the Intel Innovation Platform Framework driver on Windows 11 24H2 and 25H2, and install KB5121767 only where the symptoms apply.
In Entra, report who is enabled for SMS or voice, enable passkeys, and plan a pilot group before September 1.
Move self-hosted Jamf Pro to 11.30.2, update the Groups Scope on existing Entra connections, and test macOS 26.6 enrollment before reprovisioning Macs.
Inventory every Apple software update policy by vendor and tenant, and plan the move to declarative updates. Check that your management servers meet the TLS 1.2 and App Transport Security requirements.
If you use the Android Management API directly, migrate extensionConfig to application roles and plan for Android 6.0 devices.
Report Windows devices by edition and version, and plan to move 24H2 Home and Pro devices before October 13 and 23H2 Enterprise and Education before November 10.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.