What we're building next

Apps stay current, and a bad update stops at a few pilot devices. Each app gets an update policy: off, approval, automatic, or pinned to a version. New apps start on approval, and you can change the tenant's default. MDO offers the version that passed the lab unless you set an app to take the latest from Winget. Apps that update themselves, such as browsers and Zoom, keep doing so, and MDO only refreshes the package that new installs get.

Rings are off by default and turned on per app. You mark pilot devices once, with an Intune device category called App Pilot. The new version goes to the app's own groups, limited to those devices by an assignment filter. When you click Promote, the filter comes off and everyone gets it.

The baseline you deploy will match the standard you're scored against. MDO Hardening, MDO's CIS v5 build that keeps Autopilot working, becomes deployable from the Baselines page, with each policy created unassigned and its intended assignment shown beside it.

Updates for the apps already on your devices, including ones MDO didn't deploy. A Discovered view built from Intune's discovered-apps report and matched to MDO's catalog shows the versions found, how many devices have each, and how many are out of date.

Take over updates deploys the app as Required, with a rule that it must already be installed. Devices that have it get updated, and no device gets it for the first time. Making it Available as well is optional.

Close the gaps in your score and keep the policies that already work. For tenants that run OpenIntuneBaseline or their own policies, Fix adds the CIS controls those policies leave out, and nothing else. Where your tenant already sets a different value, Fix shows which policy sets it and lets you choose before anything is created.

Fix assigns its policies to all users or all devices with an assignment filter, not to device groups. Antivirus, firewall, LAPS and BitLocker settings go into Endpoint security policies built from Microsoft's templates.