
Intune Upcoming Changes for Apple Devices


Quick, Sausage, Tomato, Cucumber – High, Low, High, Low | This is how I remember the four key metrics of Foundry model comparison:
✅ Quality – Quality index: higher is better
✅ Safety – Attack success rate (%): lower is better
✅ Throughput – Output tokens/sec: higher is better
✅ Cost – Estimated USD per 1M tokens: lower is better
Using Microsoft Foundry’s built-in model browser on the Discover > Models tab, you can compare these metrics. This is just the start of the process. Model evaluation is critical, testing the models performance doing the actual task.

In this video, we build on the data classification work completed in Part 2 and start applying Microsoft Purview Sensitivity Labels to protect organisational data.
We’ll begin by configuring the prerequisites for Sensitivity Labels, including support for PDFs, video files, OneNote, and SharePoint/Teams integration. From there, we’ll explore how labels work, how to design an effective label taxonomy, and how to configure both manual and automatic labelling policies.
In this episode you’ll learn how to:
✅ Enable co-authoring for labelled documents
✅ Enable Sensitivity Labels for PDF files
✅ Enable Sensitivity Labels for video files (MP4)
✅ Enable Sensitivity Labels for OneNote
✅ Validate SharePoint and Teams label support
✅ Understand Sensitivity Label prerequisites
✅ Design an effective label taxonomy
✅ Deploy Microsoft’s default sensitivity labels
✅ Review label groups and label hierarchy
✅ Configure encryption and access controls
✅ Configure content markings and dynamic watermarking
✅ Create custom sensitivity labels
✅ Configure client-side auto-labelling
✅ Configure service-side auto-labelling policies
✅ Publish labels to users
✅ Configure default labels for documents, email and meetings
✅ Require business justification for label downgrades
✅ Understand label inheritance from attachments and meeting content
✅ See the end-user labelling experience in Microsoft Word
You’ll also gain an understanding of the difference between classification and protection, how label groups affect the user experience, and how Sensitivity Labels work alongside trainable classifiers and auto-labelling to build a scalable information protection strategy.
This video is part of a larger series covering:
🔹 Microsoft Purview Data Loss Prevention (DLP)
🔹 Information Protection & Sensitivity Labels
🔹 Auto-Labelling
🔹 Sensitive Information Types (SITs)
🔹 Trainable & Custom Classifiers
🔹 Insider Risk Management
🔹 Device Management & Endpoint Integration
A useful first place to start when diagnosing policy issues.
It allows you to pass specific users, sources or files for assessment for various pre-built scenarios and let the tooling do the analysis while you make a coffee


Microsoft’s Intune supports Defender for Endpoint onboarding on Android as app-driven, with a device counted as onboarded once the user opens the Defender app and completes setup.
Intune can now open Defender automatically during out of box setup on corporate owned fully managed (COBO) and corporate owned work profile (COPE) devices.
If the user doesn’t finish configuration, the Intune setup step stays available so they can open Defender again.
Note that personally owned work profile devices aren’t supported.

My next Purview video is available to watch now!
In this video, we take the next step in configuring Microsoft Purview by exploring one of the most important concepts in any data protection strategy: data classification.
Before you can apply labels, encryption, retention policies, or data loss prevention controls, you first need to understand what data exists in your environment and why it matters to the business.
In this episode, I walk through the different classification tools available in Microsoft Purview and show you how to use them to identify, organise, and understand your information estate.
In this episode you’ll learn how to:
✅ Understand the difference between classification and labelling
✅ Explore built-in Sensitive Information Types (SITs)
✅ Review how Microsoft Purview automatically classifies data
✅ Create custom Sensitive Information Types using Regex
✅ Reduce false positives with supporting elements and confidence levels
✅ Create Fingerprint-based Sensitive Information Types for structured forms
✅ Understand Trainable Classifiers and AI-powered document classification
✅ Create custom Trainable Classifiers using positive and negative training samples
✅ Review and improve classification accuracy through feedback training
✅ Understand Exact Data Match (EDM) classifiers and their use cases
✅ Trigger SharePoint re-indexing to force reclassification of data at rest
✅ Configure On-Demand Classification scans in Microsoft Purview
✅ Use Data Explorer and Content Explorer to investigate classified data
You’ll also gain an understanding of how Sensitive Information Types, Fingerprint Sets, Trainable Classifiers, and Exact Data Match classifiers work together to build the foundation for Information Protection, Data Loss Prevention, Insider Risk Management, and Records Management policies.
This video is part of a larger series covering:
🔹 Microsoft Purview Data Loss Prevention (DLP)
🔹 Information Protection & Sensitivity Labels
🔹 Auto-Labelling
🔹 Sensitive Information Types (SITs)
🔹 Trainable & Custom Classifiers
🔹 Insider Risk Management
🔹 Device Management & Endpoint Integration
Whether you’re deploying Microsoft Purview for the first time or looking to improve an existing deployment, understanding how to classify data correctly is critical to building effective protection and governance controls.
Microsoft announced its Decision-1 model last week. While this is not a new concept, it has placed a spotlight on decision models and their value.
It joins over a dozen widely used models from other vendors. How does it compare?
Anass Kartit compares Decision-1 with other cloud and local decision models in this interesting review:
Microsoft recently announced the upcoming (Jan ’27) integration of Microsoft Purview Data Loss Prevention (DLP) with Intune Mobile Application Management (MAM) protected mobile apps.
Until now, a lot of mobile data protection has focused on controlling actions such as copy, paste, save-as and data transfer between managed and unmanaged apps. This new capability takes things a step further by making those decisions content-aware.
Instead of simply asking “Can the user copy this?”, organisations can now ask “What is the user trying to copy?”
Clipboard actions in supported managed mobile apps can be evaluated against Purview DLP policies before data is shared. That means sensitive information can be identified and protected based on the content itself, helping to reduce the risk of accidental data leakage from mobile devices.

As mobile devices continue to play a larger role in modern work, bringing Purview’s content-aware protections to Intune MAM feels like a logical next step in strengthening data security wherever users work.
Read the M365 roadmap entry for this feature: https://www.microsoft.com/en-gb/microsoft-365/roadmap?id=567311
How can you protect against prompt injection attacks against local AI agents on devices? Well, Intune now has a policy template for Defender’s AI agent runtime protection (in Preview).
In Intune > Endpoint security > Antivirus, create a Windows policy and choose Microsoft Defender AI agent runtime protection. Set AI Agent Protection to Audit and assign a small test device group. Then check Effective settings on the device page in the Defender portal.
Watch out for the scope of that template. It configures agent-native event inspection. Network inspection needs a separate PowerShell platform script through Intune.
I wouldn’t tick the first setting and assume every local AI application was covered.
The prerequisites need attention too. Devices must be onboarded to Defender, with antivirus in active mode and real-time protection enabled. During preview, Microsoft directs test devices to the Beta Channel for platform and engine updates. Keep that on the test ring.
Licensing requires Microsoft Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7, plus Intune for this deployment route.
https://learn.microsoft.com/en-us/defender-endpoint/configure-ai-agent-runtime-protection

I’m excited to share the first video of my Purview deployment series:
Deploying Microsoft Purview – Part 1 – AUDIT LOG | ANALYTICS | ONBOARDING DEVICES
In this video, I walk through the first steps I take when deploying Microsoft Purview in a new environment.
We’ll start by enabling the core foundations that Purview relies on, including Audit Logging, Data Loss Prevention (DLP) Analytics, Insider Risk Management Analytics, and Device Onboarding. These components provide the visibility and telemetry required to build effective data protection and insider risk strategies.
In this episode you’ll learn how to:
✅ Enable the Microsoft Purview Audit Log
✅ Verify audit logging is working correctly
✅ Enable Data Loss Prevention (DLP) Analytics
✅ Enable Insider Risk Management Analytics
✅ Configure Insider Risk integrations and user-level insights
✅ Connect Microsoft Defender for Endpoint with Intune
✅ Deploy Defender onboarding policies from Intune
✅ Onboard devices into Microsoft Purview
✅ Understand alternative onboarding methods including Group Policy, Configuration Manager, and scripts
Check out the video here: