MDM Monthly: March 2026 Updates for Intune, Apple, Android and Ivanti

By /
Summary graphic for the MDM Monthly March 2026 newsletter

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for March 2026, covering Microsoft Intune and Windows 11, Apple iOS and macOS, Android Enterprise, Jamf and Ivanti.

March is the month the UEM itself became the target. On March 11 attackers hit Stryker’s Microsoft environment, and BleepingComputer reports they used Intune’s wipe command against its devices. CISA followed a week later with an alert about endpoint management systems. Around that, Intune extended Multi Admin Approval, Apple announced Apple Business, and Android’s bulletin carried an exploited flaw. The details follow.

Executive Summary

  • BleepingComputer reports that attackers used Intune’s wipe command against Stryker’s devices on March 11, and CISA’s March 18 alert calls for least privilege, strong MFA and second-admin approval on endpoint management systems.
  • Intune’s 2602 release extends Multi Admin Approval to compliance and configuration policies, and Microsoft says Intune will stop supporting creation of legacy Apple MDM software update policies.
  • Apple announced Apple Business on March 24 for an April 14 launch, and Android’s March bulletin carries an exploited Qualcomm flaw, CVE-2026-21385.

Executive view: cost and risk

  • Opex: Second-admin approval adds a few minutes to each wipe, script or app change and removes the single-credential path. Budget for alerting on bulk device actions, a quarterly admin role review, and engineering time to move Apple update policies to declarative management.
  • Capex: Recovery is the capital question. A mass wipe means re-provisioning thousands of devices, so test what your Autopilot, Automated Device Enrollment and spare-device capacity can restore in a week and fund the gap. Apple says Apple Business is free to users of its predecessor services, with paid add-ons in the US only.
  • Enterprise impact: Stryker told investors in an 8-K that the incident caused a global disruption to its Microsoft environment and that the restoration timeline wasn’t known. A compromised admin account in your UEM can reach every enrolled device, so the impact is fleet-wide and immediate.
  • Decision needed: Require Multi Admin Approval and phishing-resistant MFA for every UEM admin role this quarter, and name an owner for a tested mass-wipe recovery plan.

Download the one-page executive brief (PDF)

The Stryker attack and CISA’s alert

Stryker told the SEC in a Form 8-K that a cybersecurity incident on March 11 “resulted in a global disruption to the Company’s Microsoft environment.” The filing says the company has no indication of ransomware or malware and believes the incident is contained, and that it doesn’t know when full restoration will be complete.

BleepingComputer reports that the attack began early on March 11 and that Handala, a group linked to Iran, claimed it. Citing a source, it reports that the attackers compromised an administrator account, created a new Global Administrator, and then used Intune’s remote wipe on nearly 80,000 devices over a few hours, with no malware involved. Stryker hasn’t said how the account was compromised.

On March 18 CISA said it was aware of malicious cyber activity targeting the endpoint management systems of U.S. organizations, and published hardening recommendations. The ones that apply to any UEM:

  • Apply least privilege through role-based access control, using Intune RBAC.
  • Require phishing-resistant multifactor authentication for privileged accounts.
  • Use Entra Conditional Access, with device compliance, risk and network location in the conditions.
  • Require Multi Admin Approval for sensitive changes, such as device wipes, app and script deployments, and changes to RBAC and configuration.

Intune: the 2602 release and what’s ending

Intune’s February service release rolled out the week of March 2. The notable items from the what’s new page:

  • Multi Admin Approval extends to device compliance and device configuration policies.
  • Microsoft is ending support for creating legacy Apple MDM software update policies, because Apple deprecated the legacy MDM update commands in OS 26. Microsoft gave no date, and the replacement is declarative device management updates.
  • Declarative device management assignment filters roll out by late March.
  • The Autopatch update readiness dashboard is new.
  • A new Entra setting, in preview, disables MDM enrollment when a user adds a work account.
  • The Apple settings catalog adds AirPlay Device Name, and Windows Restore is generally available in the settings catalog.
  • In the week of March 16, Remote Help for macOS gained version reporting and automatic updates through Microsoft AutoUpdate.

Two message center posts matter for planning. In MC1248388, dated March 10, Microsoft says Windows Autopatch will enable hotpatch updates by default starting with the May 2026 security update. The baseline months of January, April, July and October still require a restart, and Microsoft expects a tenant opt-out setting on or soon after April 1. And in MC1262523, dated March 26, Microsoft says Secure Boot certificates begin expiring in June 2026 and that devices which miss the update may see startup integrity issues and servicing interruptions. The post links guidance for Intune, group policy and manual deployment, and a sample PowerShell automation guide using group policy.

Microsoft: a Patch Tuesday with no exploited flaws

Microsoft’s March 10 Patch Tuesday included two publicly disclosed zero-days and none that Microsoft marked as exploited: CVE-2026-21262, a SQL Server privilege escalation, and CVE-2026-26127, a .NET denial of service. BleepingComputer counts 79 flaws. Two Office remote code execution flaws, CVE-2026-26110 and CVE-2026-26113, are rated critical and can be triggered through the Preview Pane. The Windows 11 cumulative update is KB5079473.

Apple: a quiet patch month, a legacy-device fix and a new platform

Apple released iOS 26.3.1 on March 4, and macOS 26.3.1 and 26.3.2 on March 4 and March 10, each with no CVE entries on its security releases page.

Three items stand out:

  • March 11, legacy devices: iOS 15.8.7 and 16.7.15 went to devices that can’t update further. Apple says the fix is associated with the Coruna exploit, which was already fixed for newer devices in iOS 17.2 in December 2023. Security Affairs lists the CVEs involved as CVE-2023-41974, CVE-2024-23222, CVE-2023-43000 and CVE-2023-43010. Google’s Threat Intelligence Group reported the kit, which it says contains 23 exploits.
  • March 17, Background Security Improvements: Apple shipped Background Security Improvements for iOS and iPadOS 26.3.1 (a) and macOS 26.3.1 (a) and 26.3.2 (a), with one WebKit fix, CVE-2026-20643, credited to Thomas Espach. Apple’s advisory carries no exploitation statement.
  • March 24, iOS 26.4 and iPadOS 26.4: the release fixes 44 CVEs across 30 components, with no exploitation statement.

Also on March 24, Apple announced Apple Business, which combines Apple Business Essentials, Business Manager and Business Connect. Apple says those three services will no longer be available once Apple Business launches. It includes built-in MDM, Blueprints, Managed Apple Accounts, an Admin API and a companion app. It launches Tuesday, April 14, in more than 200 countries, and Apple says it is free to existing users. The paid add-ons, iCloud and AppleCare+, are US-only, and the companion app and email and calendar features need OS 26.

Jamf: three releases

Jamf shipped Pro 11.25.1, a maintenance release, on March 5. Pro 11.25.2 followed on March 9 and fixes PI-1068, where smart groups using “Device Ownership Type” wrongly included institutional devices. If you scope by ownership type, check your groups. Pro 11.26.0 arrived on March 24 and applies session timeout and inactivity settings from Jamf Account to SSO. Its Entra device compliance integration now supports automatic device registration with Simplified Setup for Platform SSO.

Android Enterprise: an exploited Qualcomm flaw

Google’s March bulletin, published March 2 with patch levels 2026-03-01 and 2026-03-05, says there are indications that CVE-2026-21385 may be under limited, targeted exploitation. It’s a high-severity flaw in a Qualcomm display component. The Hacker News reports that CISA added it to its Known Exploited Vulnerabilities catalog on March 3 with a March 24 deadline. The most severe issue in the bulletin is CVE-2026-0006, a critical remote code execution flaw in System. CVE-2026-0047 is a Framework privilege escalation.

In the Android Management API, the enterpriseDisplayNameVisibility default is now VISIBLE, EAP-PWD is supported, and screenCaptureDisabled now also blocks Circle to Search.

Also on the radar

Ivanti’s CVE-2026-1603, the Endpoint Manager authentication bypass fixed in EPM 2024 SU5, was added to CISA’s catalog on March 9 after exploitation was reported. Ivanti rates it CVSS 8.6. It affects the desktop product, Endpoint Manager, and not the EPMM mobile product.

What to watch

  • April 1: The Autopatch opt-out setting for hotpatch by default is expected on or soon after this date.
  • April 14: Apple Business launches.
  • May: The May 2026 security update is the first to enable hotpatch by default in Autopatch.
  • June 24 and June 27: The 2011 Secure Boot certificates begin to expire. October 19 follows for the Windows Production PCA.
  • October 13: Windows 11 24H2 Home and Pro reach end of servicing.
  • November 10: Windows 11 23H2 Enterprise and Education reach end of servicing.
  • No date given: Intune ends creation of legacy Apple MDM software update policies.

My take

My position: Put a second administrator in front of every destructive action in your UEM, because the admin plane is now the attack path.

The UEM is the most privileged system most companies run, because it can reach every endpoint, push code and erase data. March showed what that means in practice. A compromised administrator account doesn’t need malware when the console has a wipe button.

The fix isn’t exotic. Multi Admin Approval puts a second person between a stolen credential and a destructive action, and Intune now supports it for wipes, scripts, apps, RBAC and policy changes. The cost is a few minutes per sensitive action. The alternative cost is the recovery plan nobody has tested: how many devices can you re-provision in a week, with which staff, using which enrollment path?

I’d start with the admin roles. List who can wipe a device, require phishing-resistant MFA for each of them, and scope the roles by region or business unit so that no single account reaches the whole fleet. Alert on bulk actions. Then test a recovery for a few hundred devices and extrapolate.

My prediction: by the first quarter of 2027 Microsoft will make second-admin approval for bulk device wipe the default for new Intune tenants. Don’t wait for the default. Every UEM admin role should have it this quarter.

What to do next

  • Inventory every UEM admin role, including service accounts and break-glass accounts. Remove standing access that isn’t needed.
  • Require phishing-resistant MFA and Conditional Access for all UEM admin roles.
  • Turn on Multi Admin Approval for device wipe, scripts, apps, RBAC, compliance and configuration policies.
  • Alert on bulk wipe, retire and script actions, and review the alert path out of hours.
  • Run a recovery test: pick a few hundred devices, re-provision them from scratch, and time it. Fund the gap between that result and your fleet size.
  • Move legacy Apple update policies to declarative device management updates, and plan for Apple Business on April 14.
  • Review the hotpatch default for May with your Windows team, and look for the tenant opt-out around April 1.
  • Choose your Secure Boot deployment method and pilot before June 24.
  • Check Android fleets for patch level 2026-03-05.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.

Related Posts

1 thought on “MDM Monthly: March 2026 Updates for Intune, Apple, Android and Ivanti”

  1. Pingback: How to Secure Intune Admin Roles | TJ Singh

Comments are closed.

Scroll to Top