Three of the four Security Copilot agents Microsoft put in the Intune admin center have been retired. Replace each one with an Intune feature that already does the job: map baselines in the settings catalog and security baselines instead of the Policy Configuration Agent, and keep Multi Admin Approval with human review instead of the Change Review Agent. Handle stale devices with the Entra and Intune lifecycle processes you used before the Device Offboarding Agent. The Vulnerability Remediation Agent is the only agent still available.
When this article was first published in April 2026, it described all four agents as live. This version keeps the useful part, what each agent did, and adds what to do now. For status, setup of the remaining agent, and SCU costs, see Security Copilot agents in Intune: status, setup and SCUs.
Replacement map
| Retired agent | Retired | What it did | Use instead |
|---|---|---|---|
| Policy Configuration Agent | August 31, 2026 | Mapped documents and plain-language requirements to settings catalog settings | Security baselines plus the settings catalog with Copilot tooltips |
| Change Review Agent | August 31, 2026 | Recommended actions on Multi Admin Approval requests for PowerShell scripts | Multi Admin Approval with an approver who reads the script |
| Device Offboarding Agent | June 1, 2026 | Flagged stale or misaligned devices across Intune and Entra ID | Entra stale device process and your existing Intune lifecycle steps |
Microsoft’s retirement notices tell admins to finish active runs, avoid new dependencies on these agents, and move to other processes. The Policy Configuration Agent notice and the Change Review Agent notice share the same text. For offboarding, the Device Offboarding Agent page tells you to go back to “previously used device lifecycle and remediation options in Microsoft Intune.”
Policy mapping without the Policy Configuration Agent
The full walkthrough is in Intune Policy Configuration Agent retired: what to use now. In short:
- Start from an Intune security baseline and customize it.
- Add what’s missing from the settings catalog. The Copilot tooltip on each setting can tell you whether it’s set in other policies and whether Microsoft recommends a value.
- Keep your own list of requirements Intune can’t enforce.
Script approvals without the Change Review Agent
Multi Admin Approval itself isn’t affected. Its access policies still require a second admin to approve changes to protected resources, including Windows scripts, apps, compliance and settings catalog policies, wipe/retire/delete device actions, and RBAC. What’s gone is the agent’s recommendation on each request.
That recommendation pulled identity and threat signals from Entra ID and Defender. It never replaced reading the script. Make the approver’s checklist explicit:
- Read the script body. Look for deletes, registry writes, downloads, and credential handling.
- Check who submitted it and whether that account had recent risky sign-ins in Entra ID.
- Check the assignment scope. A script targeting all devices needs a stronger reason than one targeting a pilot group.
Device cleanup without the Device Offboarding Agent
Use Microsoft’s stale device guidance for Entra ID, which is based on the device’s last activity timestamp. Pair it with your Intune retire, wipe, and delete process. If you also use Multi Admin Approval for device actions, cleanup deletes go through approval too.
The agent that’s left
The Vulnerability Remediation Agent (public preview) uses Defender Vulnerability Management data to prioritize CVEs on managed Windows devices and gives Intune remediation steps. It needs Defender for Endpoint P2 or Defender Vulnerability Management Standalone, in addition to Intune Plan 1 and Security Copilot SCUs. See the setup guide.
For day-to-day questions about your Intune data, Copilot in Intune’s data exploration feature is separate from the agents and wasn’t affected by these retirements.
FAQ
Which Intune Copilot agents were retired?
The Device Offboarding Agent (June 1, 2026), and the Policy Configuration Agent and Change Review Agent (both August 31, 2026).
Is Multi Admin Approval affected by the Change Review Agent retirement?
No. The retirement covers the agent. Multi Admin Approval access policies are documented as a separate Intune feature.
Did Microsoft announce replacements?
The retirement notices don’t name direct replacements. They point admins to existing processes, which is what the table above maps out.
Is Copilot in Intune going away?
No such retirement is documented. The notices cover the named agents only.
Sources
- Policy Configuration Agent, Change Review Agent, Device Offboarding Agent: Microsoft Learn retirement notices
- Vulnerability Remediation Agent, Microsoft Learn
- Use Multi Admin Approval in Intune, Microsoft Learn
- Manage stale devices in Microsoft Entra ID, Microsoft Learn
- Microsoft Copilot in Intune, Microsoft Learn