This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for November 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, Android Enterprise and Jamf.
November was the first month of Windows 10 Extended Security Updates, and it brought an exploited Windows Kernel flaw. In Intune the story was approvals: a new Admin tasks view and Security Copilot agents that review approval requests. The details follow.
Executive Summary
- Intune’s November releases added an Admin tasks view that centralizes approval requests, and Security Copilot agents that review Multi Admin Approval requests, in public preview.
- Microsoft’s November Patch Tuesday fixed an exploited Windows Kernel flaw, CVE-2025-62215, and shipped the first Extended Security Updates for Windows 10.
- Android’s November bulletin lists one critical flaw, CVE-2025-48593, a Bluetooth remote code execution issue that needs no user interaction.
Executive view: cost and risk
- Opex: Every approval gate needs an approver on call, and Security Copilot agents add review work as well as saving it. Removed Graph APIs for enrollment reporting mean scripts that call them need to move to the enrollment failures report.
- Capex: Windows Backup for Organizations reaching general availability can shorten a device replacement, so test it before you size a refresh. No other capital item this month.
- Enterprise impact: A Windows Kernel flaw exploited to gain SYSTEM privileges and a zero-click Android Bluetooth flaw both bypass user caution. The approval queue is also a risk if requests sit unanswered during an incident.
- Decision needed: Name approvers and a response time for Multi Admin Approval requests, and decide whether the Security Copilot agents are used in production.
Download the one-page executive brief (PDF)
Intune: Admin tasks, agents and Windows Backup
The 2511 release rolled out the week of November 10, with more on November 17. The notable items from the what’s new archive:
Approvals and agents (November 17)
- Admin tasks, in public preview, centralizes Endpoint Privilege Management elevation requests, Defender tasks and Multi Admin Approval requests in one place.
- Security Copilot agents entered public preview. The Change Review Agent evaluates Multi Admin Approval requests for PowerShell scripts, and the Device Offboarding Agent requires administrator approval before it offboards devices.
- Windows Backup for Organizations is generally available.
- iVerify is supported as a mobile threat defense partner, on Android 9 and later and iOS 15 and later.
The 2511 release (November 10)
- Endpoint Privilege Management: Scope tags are enforced on elevation requests.
- Enterprise App Management: Microsoft states service targets of automated validation within 24 hours, and up to seven days for updates that need manual vendor testing.
- Android Enterprise: A new setting blocks assist content sharing with privileged apps, which can block Circle to Search. Administrators can opt in to upgrading managed Google Play accounts to Microsoft Entra ID accounts.
- Removed: The incomplete user enrollment report and three Graph APIs for enrollment abandonment and failure details are gone. Use the enrollment failures report instead.
- Security: Microsoft Tunnel blocks rooted Android devices through the Defender client.
Microsoft: an exploited Kernel flaw and the first Windows 10 updates
BleepingComputer counts 63 flaws in the November 11 Patch Tuesday. The one zero-day was exploited: CVE-2025-62215, a Windows Kernel elevation of privilege flaw exploited through a race condition to gain SYSTEM privileges. Microsoft credits its own threat intelligence and security response teams. Critical flaws include remote code execution in Microsoft Office, CVE-2025-62199, and in Visual Studio, CVE-2025-62214.
It was also the first Extended Security Updates release for Windows 10, KB5068781, and an out-of-band update fixed a bug that had blocked ESU enrollment. Two Windows Administrator Protection elevation flaws, CVE-2025-60721 and CVE-2025-60718, and a Configuration Manager elevation flaw, CVE-2025-47179, are rated Important.
Android Enterprise: one critical flaw
Google’s November bulletin, published November 3 with patch level 2025-11-01, lists one issue: CVE-2025-48593, a critical remote code execution flaw in the System component’s Bluetooth module. It needs no additional execution privileges and no user interaction, and it affects Android 13 through 16. The bulletin doesn’t note exploitation.
Apple: iOS 26.1 and a stolen device fix
Apple released iOS and iPadOS 26.1 and macOS Tahoe 26.1 on November 3, and iOS 18.7.2 on November 5. Apple’s iOS 26.1 security content lists 62 CVE entries, 18 of them in WebKit, and carries no exploitation statement. One fixes Stolen Device Protection being disabled by an attacker with physical access to an iPhone 11 or later, and another lets Mail Drafts load remote content even when “Load Remote Images” is off.
Jamf: Pro 11.22.1
Jamf released Pro 11.22.1 on November 6 as a maintenance release. Its sale to Francisco Partners, announced October 29, is still expected to close in the first quarter of 2026.
What to watch
- December 9: Patch Tuesday.
- January 13, 2026: The Enrollment Status Page quality update setting becomes available.
- First quarter of 2026: Jamf’s sale is expected to close.
- June 2026: The first 2011 Secure Boot certificates begin to expire.
My take
My position: Approval requests and AI agents are building a queue of decisions for your admins, so staff that queue and set response times.
Every control you add to protect the console adds a decision somebody has to make. Multi Admin Approval puts a second person in front of a wipe or a script. Admin tasks collects the requests in one view. The Security Copilot agents will review some of them. Each of those is a good change, and together they are a queue.
A queue with no owner is a quiet failure. If the second approver is on leave when you need an urgent wipe or a script during an incident, the control becomes the delay. If requests sit for days, people start working around it.
I’d name approvers and a backup for each approval type, and set a target response time. Then measure it. The agents are worth a pilot, but they review requests, and a person still has to answer for the decision.
My prediction: by the end of 2027 at least one major UEM will show approval-queue metrics, such as time to approve and rejection rate, in its console.
What to do next
- Name approvers and a backup for each Multi Admin Approval request type, and set a response time.
- Pilot Admin tasks with a small admin group before relying on it.
- Decide whether the Security Copilot agents are used for production reviews.
- Move any script that calls the removed enrollment Graph APIs to the enrollment failures report.
- Test Windows Backup for Organizations on a pilot device before you size a hardware refresh.
- Check Android fleets for patch level 2025-11-01.
Sources
- Microsoft Intune what’s new archive
- BleepingComputer: Microsoft November 2025 Patch Tuesday
- Android Security Bulletin, November 2025
- Apple: iOS 26.1 security content
- Apple security releases
- Jamf Pro 11.22 release notes
I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.
About me · Start here · Predictions
AI tools may have been used to conduct research for this article.
Pingback: How to Secure Intune Admin Roles | TJ Singh