MDM Monthly: September 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for September 2025, covering Microsoft Intune and Windows 11, Apple iOS and macOS, Android Enterprise and Jamf.

September was a version month. Apple shipped iOS 26 and macOS Tahoe 26, Windows 11 version 25H2 reached general availability, and Intune raised its minimum supported Apple versions. Google’s bulletin carried two Android flaws with exploitation notes. The details follow.

Executive Summary

Apple released iOS 26 and macOS Tahoe 26 on September 15, and Intune’s 2509 release now requires iOS and iPadOS 17 or later and macOS 14 or later.
Google’s September bulletin lists two Android flaws with limited, targeted exploitation, and Android Company Portal versions older than 5.0.5421.0 lost support on October 1.
Windows 11 version 25H2 reached general availability on September 30 as an enablement package for 24H2 devices.

Executive view: cost and risk

Opex: Raising minimum versions means helpdesk calls and user communication for each step, and old Company Portal installs that get marked noncompliant create tickets. The 25H2 enablement package is a low-effort update for 24H2 devices, but it still needs a pilot ring.
Capex: Apple devices that can’t run iOS 17 or later, and Macs that can’t run macOS 14 or later, drop out of Intune support. Count them by model now.
Enterprise impact: Android devices that miss the Company Portal cutoff can be marked noncompliant and lose access to corporate resources. Two exploited Android flaws in one bulletin raise the stakes for devices that lag on patch level.
Decision needed: Approve a minimum OS and Company Portal schedule for the next 12 months, and fund the replacement of devices that can’t meet it.

Download the one-page executive brief (PDF)

Apple: iOS 26 and macOS Tahoe 26

Apple released iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, watchOS 26, visionOS 26 and Safari 26 on September 15. The same day it released iOS 18.7 for devices that stay on iOS 18, iOS 16.7.12 and iOS 15.8.5 for devices that can’t update further, and macOS Sequoia 15.7 and Sonoma 14.8. On September 29 it followed with iOS 26.0.1, iOS 18.7.1 and macOS Tahoe 26.0.1. The full list is on Apple’s security releases page.

Intune: the 2509 release and a Company Portal cutoff

From the what’s new archive:

Minimum versions: The September 15 release requires iOS and iPadOS 17 or later and macOS 14 or later.
Multi Admin Approval: It now extends to device categories.
Android Enterprise: New settings block private space and USB access. NFC beaming is deprecated, and “Block volume changes” has no effect on corporate-owned work profile devices.
Inventory: “Resource explorer” is renamed Device Inventory.
Company Portal: Android Company Portal versions earlier than 5.0.5421.0 lost support on October 1, 2025, and devices on older versions can be marked noncompliant.
Windows: A new Enrollment Status Page setting, “Install Windows quality updates,” defaults to Yes for new profiles and No for existing ones. The capability arrives January 13, 2026.
Apps: Enterprise App Catalog gains PowerShell script installer support for Windows apps, on September 29.

Microsoft: two disclosed flaws and Windows 11 25H2

BleepingComputer counts 81 flaws in the September 9 Patch Tuesday, with two publicly disclosed zero-days and none marked exploited.

CVE-2025-55234: A Windows SMB Server elevation of privilege flaw that can be exploited through relay attacks, depending on configuration. The mitigations are SMB server signing and extended protection for authentication. Microsoft notes they could cause compatibility issues with older devices, and auditing support arrived with updates released on or after September 9.
CVE-2024-21907: A denial of service flaw in Newtonsoft.Json used by SQL Server, publicly disclosed in 2024 and fixed through SQL Server updates.

On September 30 Microsoft announced in MC1162857 that Windows 11 version 25H2 has reached general availability. Devices on 24H2 can use an enablement package for a fast upgrade, and Autopatch-managed devices receive it automatically according to their rings. It reaches WSUS on October 14, and Enterprise and Education editions get 36 months of support.

Android Enterprise: two flaws with exploitation notes

Google’s September bulletin, published September 2 with patch levels 2025-09-01 and 2025-09-05, says CVE-2025-38352 and CVE-2025-48543 may be under limited, targeted exploitation. The Hacker News reports that both are privilege escalation flaws, CVE-2025-38352 in the Linux kernel, credited to Google’s Threat Analysis Group, and CVE-2025-48543 in the Android Runtime, and that the bulletin fixes 120 flaws. Three Qualcomm closed-source entries, CVE-2025-21450, CVE-2025-21483 and CVE-2025-27034, are rated Critical.

Jamf: Pro 11.20 and 11.21

Jamf released Pro 11.20 on September 2 and 11.20.1 on September 11. It supports the Apple 26 betas, can deploy a Platform SSO app during Setup Assistant on macOS 26 through Simplified Setup, and adds Return to Service enhancements. Pro 11.21.0 followed on September 30, with impact alert notifications for deployable objects and an option for computers to skip the OS Showcase screen in Automated Device Enrollment.

What to watch

October 1: Older Android Company Portal versions lose support.
October 14: Windows 10 reaches end of support, and Windows 11 25H2 reaches WSUS.
January 13, 2026: The Enrollment Status Page quality update setting becomes available.
June 2026: The first 2011 Secure Boot certificates begin to expire.

My take

My position: Publish a schedule for your minimum OS and app versions, because the vendors raise theirs without asking you.

Vendors raise their minimums on their own calendar. Intune now requires iOS 17 and macOS 14, Android Company Portal has a cutoff date, and Apple has already shipped its next release. If you don’t publish your own schedule, your compliance policy becomes whatever the vendor decides this quarter.

A schedule is cheap to write and expensive to lack. List the minimum OS and app version for each platform, the date each rises, and who is told before it does. Then count the devices that can’t meet the next step and put them into the refresh plan.

The Android bulletin is a related lesson. Two exploited flaws in one month, in the kernel and the runtime, are the kind of thing a patch-level date check can’t describe. A device at 2025-09-05 is fixed, and one at 2025-08-05 isn’t, but the policy only knows the date.

My prediction: by the end of 2027 at least one major UEM will let administrators mark Android devices noncompliant by matching CISA’s Known Exploited Vulnerabilities catalog against the device’s patch level.

What to do next

Publish a 12-month schedule of minimum OS and app versions for each platform.
Count Apple devices that can’t run iOS 17 or macOS 14, and Android devices on old Company Portal builds.
Pilot Windows 11 25H2 on a ring of 24H2 devices before it reaches WSUS on October 14.
Test SMB signing and extended protection in audit mode before enforcing them.
Check Android fleets for patch level 2025-09-05.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.