Every MDM Monthly issue ends its “My take” with a prediction. I score each one here when its window closes, whether it was right or wrong. Status is Open, Hit, Partly or Miss. Open rows get a note when I find evidence, and I score one early only when the outcome is unambiguous. Last checked October 15, 2026.
| Issue | Prediction | Window | Status | Evidence |
|---|---|---|---|---|
| January 2025 | Microsoft ends Intune support for Android device administrator on the remaining devices without Google Mobile Services, including Teams devices | By the end of 2026 | Partly | Window open. Checked October 15, 2026. Microsoft’s documentation says Teams certified devices stay on device administrator management until AOSP user-associated management is available for them. |
| February 2025 | At least one major UEM lets administrators search the fleet by CVE from the console, without a separate security product, and list the devices that are still exposed | By the end of 2026 | Partly | Window open. Checked October 15, 2026. Iru Endpoint’s vulnerability management lets admins search by CVE ID and lists affected devices, but I haven’t confirmed it is licensed separately, so I’m not scoring it. On June 25, 2026 Microsoft announced a Vulnerability Remediation Agent in public preview that lists exposed systems, but it relies on Defender Vulnerability Management. |
| March 2025 | None of Microsoft, Jamf or Omnissa lets administrators create new legacy-command Apple software update policies | By the end of 2026 | Open | Window open. Checked October 15, 2026. Microsoft is ending support for creating legacy Apple software update policies in Intune, with no date given, as I wrote in the March 2026 issue. That is one of the three vendors in the prediction. |
| April 2025 | The major UEMs report which AI features are enabled on each managed device, not just offer settings to block them | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| May 2025 | At least one of Ivanti, Jamf or Omnissa announces an end-of-sale or end-of-support date for its self-hosted MDM server | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| June 2025 | Microsoft Intune and at least one other major UEM each offer a built-in report of Secure Boot certificate status per device | By the end of Q1 2027 | Open | Window open. Checked October 15, 2026. Microsoft’s February 2026 guidance for monitoring Secure Boot certificate status in Intune uses a detection-only remediation script, not a built-in report. |
| July 2025 | The major UEM vendors route any AI-initiated change to production through multiple admin approvals | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| August 2025 | At least one of Microsoft, Jamf or Omnissa ships a first-party console report of the time from exploited-flaw disclosure to fleet patched | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| September 2025 | At least one major UEM lets administrators mark Android devices noncompliant by matching CISA’s Known Exploited Vulnerabilities catalog against the device’s patch level | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| October 2025 | Microsoft announces an end-of-support date for WSUS | By the end of 2027 | Open | Window open. Checked October 15, 2026. In April 2025 Microsoft postponed ending driver synchronization to WSUS. No end-of-support date for WSUS has been announced in the sources I checked. |
| November 2025 | At least one major UEM shows approval-queue metrics, such as time to approve and rejection rate, in its console | By the end of 2027 | Open | Window open. Checked October 15, 2026. Nothing to score yet. |
| December 2025 | The major UEMs require managed device attestation for new Apple enrollments by default | By the end of 2027 | Open | Window open. Checked October 15, 2026. Intune’s managed device attestation for new Apple enrollments is on Microsoft’s roadmap for general availability in March 2026. The entry doesn’t say it is required by default. |
| January 2026 | Even after the Windows Production PCA expires on October 19, a tail of devices will be waiting on OEM firmware, and remediation will still be open in Q1 2027 | By the end of Q1 2027 | Open | Window open. Microsoft paused Secure Boot certificate updates on some firmware combinations in July, which points the same way. |
| February 2026 | At least one major UEM ships a first-party report of devices that can’t run the current major OS, so the refresh list comes from the console | By the end of Q2 2027 | Open | Window open. |
| March 2026 | Microsoft makes second-admin approval for bulk device wipe the default for new Intune tenants | By the end of Q1 2027 | Open | Window open. |
| April 2026 | Secure Boot certificate expiry produces more support tickets this summer than any single CVE, mostly from devices nobody inventoried: older firmware, unmanaged machines and lab or kiosk hardware | By the end of Q3 2026 | Partly | The firmware part held. On July 10 Microsoft paused the certificate update on some devices and said a firmware update “might not yet be available.” Admins in a July 15 OEM session reported BitLocker recovery and unexplained errors. Ticket volume against any CVE is not public, so I can’t score that half. |
| May 2026 | At least one more exploited vulnerability in an on-premises MDM or UEM server product | By the end of 2026 | Open | Window open. Ivanti’s May 7 EPMM zero-day came before this issue, so it doesn’t count. I haven’t seen another through September. |
| June 2026 | Before OS 27 ships, the major Apple-focused UEM vendors add a report or alert for devices that are not assigned in Automated Device Enrollment | Before OS 27 shipped (September 14, 2026) | Miss | OS 27 shipped on September 14. I found no vendor release announcing this report before then, and the vendor responses in the September issue cover other OS 27 changes. If you know of one, send it and I’ll rescore. |
| July 2026 | At least one major UEM vendor lets users register a passkey during device setup, and enrollment flows stop assuming a phone number | By the end of Q1 2027 | Open | Window open. |
| August 2026 | The major UEM vendors treat declarative updates as the default and legacy update policies as read-only, and compliance reports include exposure checks for services like Screen Sharing next to patch level | By the end of Q1 2027 | Open | Window open. Apple’s OS 27 notes say legacy update management no longer works on 27.0, which moves the vendors this way. |
| September 2026 | Every major UEM ships an MCP server and AI-usage discovery, and buyers compare approval workflows, audit quality and rollback instead | By the end of Q2 2027 | Open | Window open. |
Called it
These are calls I made in the issues, before the events below. They aren’t scored predictions, because I didn’t put a window on them. Each links to the issue where I wrote it and to the evidence. Compiled in October 2026.
| Issue | What I wrote | What happened |
|---|---|---|
| March 2025 | I told readers to move Apple software updates to declarative management now, because the legacy commands have no future. | Apple later set a removal date for the legacy commands, which I covered in the June 2025 issue. Apple’s enterprise release notes now say legacy software update management no longer functions on any 27.0 operating system. OS 27 shipped on September 14, 2026. |
| May 2025 | After the Ivanti EPMM exploit chain I said an on-premises MDM server should be treated like internet-facing infrastructure, with an owner and a patch window measured in days. | Ivanti’s next exploited EPMM flaws had the same short clock. Two zero-days disclosed on January 29, 2026 came with a February 2 federal deadline, and the May 7 flaw came with a May 10 deadline. |
| January 2026 | I told readers the Secure Boot certificate update depends on what each OEM has shipped, so Windows devices need a firmware inventory by model, an owner and a pilot before June 24. | In July Microsoft paused the certificate update on some devices and said a firmware update “might not yet be available.” Admins in a July 15 OEM session reported BitLocker recovery on some HP models. |
| January 2026 | After Ivanti’s two EPMM zero-days I said the decision to take to your security team was whether an internet-facing MDM server should exist at all. | On May 7 Ivanti fixed another exploited EPMM zero-day, and CISA added it to its catalog with a May 10 deadline for federal agencies. |
| February 2026 | I said to pair an exploited-flaw patch lane with a minimum OS version, because Apple’s exploitation statement applied to iOS before 26. | The pattern repeated. Apple’s September 28 CoreGraphics fix carries the same wording, with exploitation against targeted individuals on versions of iOS before iOS 27. |
| March 2026 | I told readers to move legacy Apple software update policies to declarative device management updates, noting that Microsoft was ending support for creating the legacy policies. | Apple’s enterprise release notes say legacy software update management no longer functions on any 27.0 operating system. OS 27 shipped on September 14. |