MDM Monthly: March 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for March 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, Android Enterprise and Jamf.

March carried six exploited Windows flaws, several of them reachable through a file a user mounts or opens, plus an exploited iOS flaw and two Android flaws with exploitation notes. On the management side, Intune and Jamf both made declarative Apple updates easier. The details follow.

Executive Summary

Microsoft’s March Patch Tuesday fixed six exploited zero-days, most of them triggered by mounting a crafted virtual disk, plugging in a USB drive or opening a crafted file.
Apple’s iOS 18.3.2 fixed an exploited WebKit flaw, CVE-2025-24201, and Google’s March bulletin lists two Android flaws with limited, targeted exploitation.
Intune added automatic Apple software update policies and a Samsung Knox partnership, and Jamf Pro 11.15 introduced Blueprints for declarative configuration.

Executive view: cost and risk

Opex: Declarative update policies replace per-OS manual policy edits, which saves recurring labor, but the move needs a pilot and a user-experience decision. Blocking virtual disk mounting and tightening USB controls are policy changes that need testing.
Capex: Samsung Galaxy devices gain hardware-backed attestation, which favors Samsung in a refresh when you need device integrity checks. No other capital item this month.
Enterprise impact: Six exploited Windows flaws in one month, several reachable through a file a user opens or mounts, show that user behavior remains part of the attack path. A WebKit sandbox escape on iPhones used against targeted individuals puts high-risk roles first.
Decision needed: Approve a plan to move Apple update enforcement to declarative policies, and decide whether virtual disk mounting is blocked for standard users.

Download the one-page executive brief (PDF)

Microsoft: six exploited zero-days

BleepingComputer counts 57 flaws in the March 11 Patch Tuesday, with seven zero-days. Six were exploited:

CVE-2025-24983: A Win32 Kernel Subsystem elevation of privilege flaw, local SYSTEM through a race condition.
CVE-2025-24984: An NTFS information disclosure flaw that needs physical access and a malicious USB drive.
CVE-2025-24985: A Fast FAT file system driver remote code execution flaw, triggered by mounting a malicious VHD.
CVE-2025-24991: An NTFS information disclosure flaw, triggered by mounting a malicious VHD.
CVE-2025-24993: An NTFS remote code execution flaw, triggered by mounting a malicious VHD.
CVE-2025-26633: A Microsoft Management Console security feature bypass, triggered by a malicious .msc file.

One was publicly disclosed: CVE-2025-26630, a Microsoft Access remote code execution flaw. Six flaws are rated critical, all remote code execution, including Remote Desktop Client, Remote Desktop Services, Windows DNS Server and the WSL2 kernel. Three of the exploited flaws are triggered by mounting a VHD and one needs a malicious USB drive, so those are the two input paths worth reviewing. The Windows 11 cumulative updates are KB5053598 and KB5053602, and the Windows 10 update is KB5053606.

Apple: an exploited WebKit flaw and iOS 18.4

On March 11 Apple released iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, visionOS 2.3.2 and Safari 18.3.1. Apple’s advisory lists CVE-2025-24201, a WebKit flaw where “maliciously crafted web content may be able to break out of Web Content sandbox.” Apple says the fix supplements an attack that was blocked in iOS 17.2, and that it is aware of a report the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.

On March 31 Apple released iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4 and tvOS 18.4, plus iOS 16.7.11 and iOS 15.8.4 for devices that can’t update further. See Apple’s security releases page.

Intune: automatic Apple updates and a Samsung partnership

From Petri’s summary of the 2503 release, published April 1:

Apple software updates: Automatic managed software update policies keep iOS, iPadOS and macOS devices on the latest OS version. Before, administrators had to update policies by hand for each new OS version and delay. Groups and time delays let administrators release an update to a pilot set first.
Samsung: A new partnership adds Knox features to Intune. Knox Mobile Enrollment can enroll multiple Android Enterprise devices at once, for dedicated, fully managed and corporate-owned work profile devices, and Samsung Galaxy devices gain hardware-backed attestation.
Windows: Windows 365 Frontline shared mode gets Autopilot device preparation in public preview, and Remote Help is available for Azure Virtual Desktop multisession VMs.

Jamf: Pro 11.15 and Blueprints

Jamf released Pro 11.15 on March 18. It introduces declaration configurations with Blueprints, which group management settings in one place and scope them to devices. Devices apply the settings on their own and report state changes to the MDM server asynchronously, and Blueprints require OIDC-based single sign-on set up in Jamf Account. It also adds Apple Intelligence restrictions for computers and mobile devices.

Android Enterprise: two flaws with exploitation notes

Google’s March bulletin, published March 3 with patch levels 2025-03-01 and 2025-03-05, says CVE-2024-43093 and CVE-2024-50302 may be under limited, targeted exploitation. The System component carries eight critical remote code execution flaws, all in Bluetooth, plus a critical Bluetooth elevation of privilege flaw, CVE-2025-22409, and a critical denial of service flaw, CVE-2025-0081.

What to watch

April 8: Patch Tuesday.
Spring: Android 16 and Apple’s WWDC are expected, and both tend to change management settings.
October 14: Windows 10 reaches end of support.

My take

My position: Move Apple software updates to declarative management now, because Intune and Jamf both ship the tools and the legacy commands have no future.

Updating Apple devices through legacy MDM commands has always meant a policy per OS version and a calendar of manual edits. March showed that both major Apple management paths have moved on. Intune’s automatic update policies keep devices current with pilot groups and delays, and Jamf’s Blueprints put the settings on the device and let it report back.

The reason to move now is the exploited-flaw pattern in this issue. An iOS flaw used against targeted individuals is the kind of thing where you want a fast, boring, repeatable way to push a version. A policy that already knows what the latest OS is beats one a person has to edit.

I’d pick a pilot group, build one automatic update policy with a short delay, and watch it through the next point release. Keep the old policy in place until the new one has done a full cycle. Then retire the old ones one group at a time.

My prediction: by the end of 2027 none of Microsoft, Jamf or Omnissa will let administrators create new legacy-command Apple software update policies.

What to do next

List every Apple software update policy and note which use legacy commands.
Build one automatic update policy in Intune, or one Blueprint in Jamf, and pilot it.
Block VHD mounting for standard users if there is no business need, and review USB controls.
Apply the March 11 Windows updates and prioritize Remote Desktop Services and DNS servers.
Update iPhones and iPads to iOS 18.3.2, then iOS 18.4.
Check Android fleets for patch level 2025-03-05.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.