What is ahead for Microsoft Intune in 2027? From SCCM to AI-assisted device management

Microsoft has made its choice about the future of device management, and it is Intune. Configuration Manager, the on premises tool many IT teams have relied on for well over a decade, is moving to a single release a year. At the same time, Microsoft has folded premium Intune features into standard Microsoft 365 licences and experimenting with AI agents in the Intune admin center. 

For IT leaders planning budgets and roadmaps for 2027, that adds up to a significant shift. This article explains what Microsoft Intune is, how it overtook SCCM and what is coming next, so you can make the most of what you are already paying for. 

Key takeaways 

• Microsoft Intune is Microsoft’s cloud service for managing and securing laptops, phones and tablets, and it is where Microsoft is putting all new device management innovation. 
• Configuration Manager (SCCM) moves to one release a year from autumn 2026. It is not being retired, but new features are going to Intune. 
• Several Intune Suite capabilities are now included in Microsoft 365 E3 and E5, so many organisations already own more than they use going into 2027. 
• AI agents in Intune are still evolving. Several early Security Copilot agents have already been retired, so plan around the capability rather than any single feature. 
• More features mean more risk of a messy tenant. Good design and governance matter more than ever. 

What is Microsoft Intune? 

Before looking ahead, a quick recap. What is Microsoft Intune? It is a cloud-based endpoint management service that lets IT teams control company devices and data from a single web console, the Microsoft Intune admin center, without servers on site. 

It does two jobs. Intune MDM applies device-level controls such as settings, security, apps, updates and remote wipe, with the scope of control depending on how the device is enrolled. App protection, also called mobile application management, protects organisational data within supported apps such as Outlook and Teams, and can work with or without device enrolment. Most organisations use both, tied together with Conditional Access in Microsoft Entra ID. 

From SCCM to Intune: how we got here 

For years, Windows device management meant System Center Configuration Manager, now Microsoft Configuration Manager. It was powerful but built for a world where devices sat on the corporate network and IT built them on site. 

Microsoft’s cloud alternative started life as a lighter service and grew up alongside the shift to Microsoft 365, hybrid working and zero touch deployment. Co-management let organisations run both tools side by side and move workloads across one at a time. Over time, the cloud service has gone from the add-on to the main event.

What is ahead for Intune in 2027 

1. Configuration Manager takes a back seat 

Microsoft has announced that Configuration Manager will move from two releases a year to one, starting with version 2609 in September 2026, with version 2709 planned for September 2027. As Petri reported, Microsoft says Configuration Manager will continue to serve on premises devices, but that Intune is the future and will receive all new innovation. 

In practice, that means 2027 is the year many organisations should be finishing their move to cloud-based Intune device management, not starting it. If you still rely on SCCM for builds, patching or app delivery, now is the time to plan which workloads move first. 

2. More of the Intune Suite in your existing licence 

Several capabilities that used to be paid Intune Suite add-ons are now included in Microsoft 365 E3 and E5. According to Petri: 

• Microsoft 365 E3 gains Remote Help, Advanced Analytics, Microsoft Tunnel for mobile application management, specialty device management and firmware updates. 
• Microsoft 365 E5 also gains Endpoint Privilege Management, Enterprise Application Management, Microsoft Cloud PKI and Security Copilot in Intune. 

If you hold either licence, these features should already be available in your tenant. The opportunity for 2027 is obvious: features that once needed a separate business case are already there, waiting to be configured. 

3. AI agents: early days and moving fast 

Microsoft has introduced several Security Copilot agents for Intune, designed to review changes, suggest policies, tidy up stale devices and prioritise vulnerabilities. The picture is already changing. According to Microsoft, the Device Offboarding Agent was removed on 1 June 2026, and the Policy Configuration and Change Review agents became unavailable on 31 August 2026. The Vulnerability Remediation Agent, which uses Defender data to help prioritise which vulnerabilities to fix first, is still in public preview. 

The lesson for 2027 is not to build plans around any single AI feature. Agents run on Security Copilot capacity, so they come with their own consumption costs, and Microsoft is clearly still deciding which ones to keep. What will not change is that AI recommends and humans approve. It can speed up Intune management, but it will not replace the need for someone who understands what good looks like. 

4. Windows devices get better at fixing themselves 

Alongside the licence changes, Microsoft is adding recovery and update features for organisations with Windows Enterprise E3. These include Quick Machine Recovery with enterprise controls, point-in-time restore, cloud rebuild for Windows 11 and an update readiness view for Windows Autopatch, which is in preview. Together they point to a future where a broken laptop can often be restored remotely rather than shipped back to the office or rebuilt by hand. 

For professional services firms with staff spread across offices and homes, that could make a real difference to downtime. It also means recovery and update policies need to be designed and tested before they are needed, not switched on in a crisis. 

5. Personal devices stay high on the agenda 

As AI tools spread onto personal phones, protecting company data on devices you do not own becomes more important, not less. Microsoft Tunnel for MAM now being included in E3 is one sign of that. It lets personal phones reach internal, on premises apps securely without enrolling the device, which is useful for firms that still rely on older systems. Expect BYOD and app protection to be a bigger part of Intune conversations in 2027. Our BYOD Control Framework sets out how to decide who should have access from personal devices and how to protect it. 

What this means for Intune management 

The skills that matter are changing too. Knowing where a setting lives is becoming less important than knowing why it should be set a certain way, how it interacts with Conditional Access and what it means for users. Teams that understand the design will get the most from AI assistance. Teams that do not will find it harder to spot when a recommendation is wrong. 

For IT teams, the day to day job is shifting from building and fixing towards reviewing and governing. Instead of hand-crafting every setting, admins will increasingly check what AI suggests. Instead of buying add-ons, they will switch on capabilities they already own. 

That only works if the foundations are solid. AI that suggests policy changes in a tenant full of duplicate, outdated and undocumented settings will make a messy tenant messier. Virtual Engine documents every design decision, sets out the options and its recommendation and has them signed off, so there is always a clear record of why each control exists. That kind of governance is what makes AI assistance safe to use. 

When done well, the results are tangible. Burges Salmon saw its Windows build process become reliable, with an average build time of 40 minutes, after Virtual Engine took on its Windows and application lifecycle. Our endpoint management service takes on proactive day to day administration alongside your team in the same way. 

Why Intune setups still go wrong 

New features will not fix old problems. These are the issues Virtual Engine still sees most often: 

1. 1. It was never finished. The service was switched on during a Microsoft 365 migration, a few policies were added and nobody went back. 

1. 2. Compliance is not enforced. A device can be marked non-compliant, but unless Conditional Access acts on it, the device still gets in. 

1. 3. Personal devices slipped in. Microsoft 365 does not block personal devices by default, and entries in Entra ID such as “Tom’s PC” are often the first clue that devices nobody approved are connecting. 

1. 4. One platform is locked down, another is not. iPhones are protected while browsers on home PCs or Chromebooks still get straight in. 

1. 5. Nobody owns it. Settings change over the years with no record of who changed what or why. 

Getting a clear view of what is connecting and how it is configured is the first step. That is exactly what our endpoint visibility and insight service provides. 

Five things to do before 2027 

• Check your licences. See which Intune Suite capabilities are already available in your tenant and decide which to switch on first. 
• Plan your SCCM exit. Map the workloads still in Configuration Manager and decide which move to Intune first. 
• Clean up before AI arrives. Remove duplicate and unused policies so any AI assistance works from a sound baseline. 
• Decide your BYOD position. Agree who can use personal devices and protect company data with app protection. 
• Budget for Security Copilot. If you plan to use AI features in Intune, check their current status and understand the consumption costs up front. 

Get your Intune tenant ready for 2027 

Whether you are still running SCCM, inheriting a tenant that grew without a plan or wondering how to use the new features coming your way, Virtual Engine can help. Explore The BYOD Control Framework to see how Intune fits into a joined-up approach to BYOD in 2027.