Dynamically remove apps from managed Windows 11 devices
Geändert
Services
Windows
Simplify Microsoft Store app management with dynamic removal on more devices across your enterprise. Use policy to remove any preinstalled MSIX/APPX app by referencing its Package Family Name (PFN). It's available to Enterprise and Education devices running Windows 11, versions 25H2 and 24H2. Starting with the April 2026 Windows non-security update, you can use Group Policy or custom OMA-URI for mobile device management (MDM). Additional Microsoft Intune capabilities are coming later. When will this happen:October 2025: The policy, “Remove default Microsoft Store packages from the system”, first became available. March 13, 2026: The expanded policy became available to Windows Insiders in the Dev and Beta channels. April 2026 Windows non-security update: The expanded policy is broadly available for use with Group Policy and custom OMA-URI. Future releases: Additional Intune capabilities a
preventOrFixIssuenormalMC1294316
An updated version of the April 2026 Scan Cab is available
Major Change
Geändert
Services
Windows
IMPORTANT:This notice is only relevant for environments where:Visual Studio 2026 with .NET version 10.0.6 is used Scan Cab is used to check for update compliance The April 2026 Scan Cab was deployed before 10:30 AM PT on April 28, 2026 An updated version of the April 2026 Scan Cab was made available at 10:30 AM PT on April 28, 2026. This Scan Cab includes new metadata corresponding to updates for Visual Studio 2026. The Microsoft update for Visual Studio 2026 released on April 28, 2026, includes additional protections to address CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability. See the Additional information section of this message for details. How this affects your organization:IT administrators who downloaded the Scan Cab before 10:30 AM PT on April 28, 2026, should re-acquire and re-deploy it if the Scan Cab is used to assess updates for environments where Visual Stud
stayInformednormalMC1293341
Assess Secure Boot certificate status with Microsoft Defender
Major Change
Geändert
Services
Windows
Microsoft Defender now provides IT teams centralized visibility into Secure Boot 2023 certificate readiness across your device fleet. A new assessment categorizes your devices automatically as exposed, compliant, and not applicable. In the Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations. For exposed devices, remediation guidance is directly available through the recommendation. When will this happen:The new Secure Boot 2023 certificate assessment is now available in Microsoft Defender. June 2026: Secure Boot 2011 certificates begin expiring and need to be replaced. How this will affect your organization:When certificates expire in June 2026, devices that haven't transitioned to the newer Windows UEFI CA 2023 certificates will no longer be able to receive new security protections for the early boot process. To help organizations prepare, Microsof
stayInformednormalMC1289507
New IT admin policy: Remove Microsoft Copilot app
Geändert
Services
Windows
Improve user experience with a single Microsoft Copilot app to use on any given device. The new RemoveMicrosoftCopilotApp policy setting allows you to uninstall Copilot from devices in your organization in a non-disruptive way. It only applies to devices and users that meet the following conditions: Microsoft 365 Copilot is also installed. Copilot wasn’t installed by the user. Copilot wasn’t launched in the last 28 days. It’s available as a Policy CSP and Group Policy. When will this happen:The policy is broadly available as of April 14, 2026. It’s part of the April 2026 Windows security update and later. How this will affect your organization:This policy simplifies the user experience by providing a single Copilot app to use on any given device. What you need to do to prepare:No action is needed if your organization prefers the default experience and allows users to use Copilot by choic
stayInformednormalMC1288264
Ask Microsoft Anything about Secure Boot certificate updates
Major Change
Geändert
Services
Windows
Microsoft is hosting two upcoming Ask Microsoft Anything (AMA) events focused on updating Secure Boot certificate updates across your Windows estate before certificate expirations begin in June 2026. These AMAs are designed to help you get clarity on what’s changing and how to plan for deployment across your environment. Bring your questions and get practical guidance directly from Microsoft experts. When will this happen: Secure Boot certificates on Windows devices begin expiring in June 2026. The upcoming AMAs will take place on April 23, 2026 and May 18, 2026. What you need to do to prepare:Review the Secure Boot playbook to understand requirements, affected scenarios, and available tooling, then add one or both upcoming AMAs to your calendar:Secure Boot AMA – April 23, 2026, 8:00 AM PDT Secure Boot AMA – May 18, 2026, 8:00 AM PDT Post your questions in the comments section of each pa
stayInformednormalMC1287681
An updated version of the April 2026 Scan Cab is available
Major Change
Geändert
Services
Windows
IMPORTANT: This notice is only relevant for environments where:ASP.NET Core is used Scan Cab is used to check for update compliance The April 2026 Scan Cab was deployed before 10:00 PM PT on April 21, 2026 An updated version of the April 2026 Scan Cab was made available at 10:00 PM PT on April 21, 2026. This Scan Cab includes new metadata corresponding to updates for ASP.NET Core. The Microsoft update for ASP.NET Core released on April 21, 2026, includes additional protections to address CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability. See the Additional information section of this message for details. How this affects your organization:IT administrators who downloaded the Scan Cab before 10:00 PM PT on April 21, 2026, should re-acquire and re-deploy it if the Scan Cab is used to assess updates for environments where ASP.NET Core is used. No action is required for envir