MDM Monthly: June 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for June 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, and Android Enterprise.

June set two long clocks running. Apple used WWDC25 to say how it wants software updates managed, and Microsoft published guidance on the Secure Boot certificates that begin expiring a year from now. Around them sit a Patch Tuesday with an exploited WebDAV flaw, the Android 16 release and Intune’s 2506 service release. The details follow.

Executive Summary

Microsoft published its Secure Boot certificate expiration article on June 26, and it says the 2011 certificates begin expiring in June 2026.
Apple’s WWDC25 deprecated the legacy MDM software update commands, with removal in 2026, and made declarative software update management the way forward.
Microsoft’s June Patch Tuesday fixed an exploited WebDAV flaw, and Qualcomm said Google’s Threat Analysis Group had indications of limited, targeted exploitation of three Qualcomm GPU flaws.

Executive view: cost and risk

Opex: The Secure Boot work is inventory, a pilot and ring-based deployment across Windows devices, plus a helpdesk plan. Moving Apple software updates from legacy MDM commands to declarative management is engineering time in every Apple-managed environment before the legacy commands are removed in 2026.
Capex: Windows devices whose firmware can’t take the new certificates become a refresh question, and a year of notice is enough to fold them into the normal hardware cycle instead of a rush buy. Count them now by model and firmware version.
Enterprise impact: Microsoft says devices that miss the updated certificates keep running but can’t receive new early-boot protections. An exploited WebDAV flaw that needs only a click on a crafted link is a reminder that endpoint exposure is mostly about speed to patch.
Decision needed: Name an owner for the Secure Boot program and approve the firmware inventory. Decide when Apple software updates move to declarative management.

Download the one-page executive brief (PDF)

Apple at WWDC25: declarative updates become the path

Apple announced its year-based OS 26 releases on June 9. SimpleMDM’s WWDC25 recap lists the changes that matter to administrators:

Software updates: The legacy MDM software update commands, restrictions and the com.apple.SoftwareUpdate payload are deprecated and will be removed in 2026. Declarative software update management becomes the default.
Kerberos: Classic Kerberos SSO is deprecated on iOS and iPadOS, and Extensible SSO is the replacement.
MDM migration: Administrators can move Macs to a new MDM service through Apple Business Manager without erasing them. It requires OS 26 and enrollment through Automated Device Enrollment or Apple Configurator, and the new MDM takes over Activation Lock and the FileVault recovery key.
Return to Service: iPhone and iPad resets can keep managed apps for faster redeployment.
Declarative app management: App Store and custom apps can be deployed with version pinning and auto-update controls.
Restrictions: MDM can disable the ChatGPT integration, Image Playground and Writing Tools.

Microsoft: Secure Boot certificates and an exploited WebDAV flaw

On June 26 Microsoft published Windows Secure Boot certificate expiration and CA updates. The certificates Microsoft issued in 2011 begin expiring in June 2026, and the last, the Windows Production PCA, expires in October 2026. Microsoft says devices that don’t get the updated certificates keep starting and running, and standard Windows updates still install, but they can’t receive new early-boot protections such as Boot Manager updates and Secure Boot DB and DBX updates.

Microsoft’s June 10 Patch Tuesday fixed 66 flaws. One was exploited: CVE-2025-33053, a WebDAV remote code execution flaw that needs a user to open a crafted WebDAV URL. BleepingComputer reports that Check Point attributes the exploitation to Stealth Falcon. One was publicly disclosed: CVE-2025-33073, a Windows SMB client elevation of privilege flaw that gives SYSTEM privileges. The same update fixed a Secure Boot bypass in Insyde firmware, CVE-2025-3052, reported by CERT/CC, and critical remote code execution flaws in Windows Schannel, the KDC Proxy Service and Remote Desktop Services.

Intune: the 2506 release

The 2506 service release rolled out the week of June 23. The notable items from the what’s new archive:

Apple AI features: App protection policies get standalone settings for Genmoji, Writing Tools and screen capture. They were previously blocked only when “Send Org data to other apps” wasn’t set to “All apps.”
Android Bluetooth: “Block Bluetooth” set to true turns Bluetooth off even if the user turned it on. “Block Bluetooth Configuration” set to true stops users changing the setting but doesn’t turn Bluetooth off if it’s already on.
Reporting: Policy Reporting Service V3 updates device reports only at device check-in, so a removed policy can show stale status until the next check-in.
Autopilot: Enterprise App Catalog apps can be selected as blocking apps in the Enrollment Status Page.
Certificates: SCEP and S/MIME profiles gain given name and surname subject attributes.
Apple settings catalog: iOS adds Idle Reboot Allowed, and macOS adds a Device Identifiers in Attestation option for Extensible SSO.

Android Enterprise: Android 16 and a quiet bulletin

Android 16 was released on June 10. Bayton’s enterprise review notes that Advanced Protection and Identity Check must be turned on by each user, and that an administrator can’t enforce Advanced Protection through the Android Management API. Apps that target API 36 ignore fixed orientation and resizability on displays 600dp wide or larger, so kiosk and dedicated tablet apps need an audit. Local network access is opt-in in Android 16.

Google’s June bulletin, published June 2 with patch levels 2025-06-01 and 2025-06-05, rates no issue Critical. The most severe is a High-severity System elevation of privilege flaw that needs user interaction.

Separately, Qualcomm said Google’s Threat Analysis Group had indications that CVE-2025-21479, CVE-2025-21480 and CVE-2025-27038, flaws in Qualcomm’s GPU components, may be under limited, targeted exploitation. BleepingComputer reports that CISA added two of them to its Known Exploited Vulnerabilities catalog on June 3 with a June 24 deadline, and that Qualcomm said the fixes reached device makers in May.

What to watch

July 8: Patch Tuesday.
October 14: Windows 10 reaches end of support.
Fall: Apple’s OS 26 releases are expected.
June 2026: The first 2011 Secure Boot certificates begin to expire, with the Windows Production PCA following in October 2026.

My take

My position: Secure Boot certificates expire a year from now, so start the inventory of which devices can take the update while there is still time to replace the ones that can’t.

A date a year out is the right time to find out how big a problem is, because a year is enough to put the answer into a normal refresh cycle. Secure Boot certificates are a fleet problem with a hard date and a quiet failure mode. Devices keep booting, so nobody notices until the day Microsoft needs to ship a boot-level fix and your device can’t take it.

Apple’s message is similar. Software updates managed through legacy MDM commands have a removal date, and the replacement, declarative management, already works. Every month you run both is a month of double the policy to maintain.

I’d start with an inventory. For Windows, list models and firmware versions and mark the ones the OEM has no update for. For Apple, list which update policies still use the legacy commands and move the simplest group first.

My prediction: by the end of the first quarter of 2027 Microsoft Intune and at least one other major UEM will each offer a built-in report of Secure Boot certificate status per device. Until they do, you need your own inventory.

What to do next

Build a Windows inventory by model and firmware version, and mark devices with no OEM firmware update.
Name an owner for the Secure Boot certificate program and plan a pilot ring.
List every Apple software update policy that still uses legacy MDM commands, and plan the move to declarative updates.
Check Android 16 plans for kiosk and dedicated tablet apps that target API 36.
Check Android fleets for patch level 2025-06-05.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.