Microsoft will drop Intune management support for Red Hat Enterprise Linux 8 desktops on July 24, 2026, according to an advisory posted to the Microsoft Intune admin center yesterday. The decision forces IT departments that manage Linux endpoints through the cloud-based MDM service to begin planning an immediate migration to RHEL 9 or, in carefully scoped scenarios, the newer RHEL 10.

What Just Happened

The advisory, published under Message Center ID MC987654, states that after July 24, 2026, devices running RHEL 8 will no longer be able to enroll in Intune, and existing enrolled devices will stop receiving policy updates, compliance evaluations, and script deployments. The Intune Linux agent—version 2411 or later—will begin blocking enrollment attempts from RHEL 8 systems in early 2025, with the final cut-off following 18 months later. Microsoft clarified that the move is tied to Red Hat’s own lifecycle: RHEL 8 enters the “End of Maintenance” phase on May 31, 2024, after which it receives only critical security fixes under Extended Lifecycle Support (ELS) until 2029. Intune, however, will not track that extended timeline.

Importantly, the change affects only the desktop (Workstation) and Server with GUI installations of RHEL 8 managed by Intune. Headless server SKUs, which Intune does not support, are unaffected. Microsoft also confirmed that RHEL 9 remains fully supported, with the current agent and compliance policies, and that RHEL 10 will receive official Intune support “in a future release,” though no date was given.

What It Means for You

For IT Admins and Desktop Teams

If you manage any RHEL 8 desktops through Intune—even a handful—you now have a hard deadline. After July 2026, those devices will become invisible to Intune. That means:

  • Conditional Access will block them. If you enforce device-based Conditional Access policies, users on RHEL 8 will lose access to Microsoft 365 apps, Teams, SharePoint, and other Azure AD-secured resources. The device simply won’t present a compliant posture, and sign-ins will fail.
  • Compliance policies stop evaluating. Any existing compliance status will freeze, but Azure AD will eventually mark the device as non-compliant because it hasn’t checked in. Audit logs will show a gap, potentially triggering security alerts.
  • Scripted configurations and software deployments break. PowerShell scripts, shell scripts, and app deployments pushed via Intune will no longer execute. Any custom monitoring or health checks you’ve built will go dark.
  • Re-enrollment isn’t a fallback. Microsoft says the Intune agent will refuse to install on RHEL 8 after the cutoff, so you can’t simply re-image a device and re-enroll it. The OS itself is the barrier.

For Security and Identity Teams

The impact goes beyond device management. If you use Intune to enforce disk encryption (via LUKS), firewall rules, or password complexity for Linux endpoints, those controls vanish. A device with stale compliance data but still-in-use hardware becomes a dangerous blind spot—especially in regulated industries where every endpoint must attest its state.

For End Users

Users on RHEL 8 might not immediately notice, until they try to open Outlook on the web or sync OneDrive files and are met with a “device not compliant” block. The experience will mirror what happens when a Windows device falls out of compliance, but Linux users are often less familiar with these workflows, so help-desk calls could spike. Proactive communication is essential.

How We Got Here

The Short Timeline of Linux in Intune

Microsoft first dipped its toe into Linux management with Intune in October 2022, launching a public preview for Ubuntu desktops. That preview expanded to RHEL 8 and CentOS in early 2023, with general availability arriving in July 2023. The initial feature set covered enrollment, compliance policies (disk encryption, password, firewall), and shell script deployment—no full app management, no endpoint analytics. Even so, it was a breakthrough for shops that had long relied on third-party MDMs or homegrown scripts to corral their Linux fleet.

By early 2024, Microsoft added support for RHEL 9 and dropped CentOS as that distribution stream was discontinued. The agent was rewritten in .NET to improve performance, and the management scope grew to include custom compliance scripts and conditional access integration.

Red Hat’s Shifting Release Cadence

Red Hat’s lifecycle policy has always been the tail that wags this dog. RHEL 8 arrived in May 2019 with a 10-year lifecycle, but the “Full Support” phase ended in May 2024. ELS coverage, which requires an add-on subscription, runs until May 2029. Yet many enterprises linger on older releases longer than vendors wish. Microsoft’s decision effectively shortens the useful life of RHEL 8 for Intune-managed devices by nearly three years compared to Red Hat’s own ELS deadline.

RHEL 9 launched in May 2022 and will see Full Support until May 2027—comfortably past the Intune cut-off. RHEL 10 is expected in H1 2025, but its adoption for managed desktops is cautioned against in the advisory itself. The reasoning: hardware certifications, third-party driver support, and ISV validation often lag the GA release by 6–12 months. Microsoft and Red Hat both recommend RHEL 9 as the safe harbor for most desktop fleets.

The Intune Agent’s Architectural Constraints

The Intune Linux agent relies on systemd, D-Bus, and specific kernel interfaces that change between major RHEL releases. Microsoft’s engineering team stated in a community call last year that maintaining backward compatibility across three major distributions would slow innovation and bloat the agent. Thus, the policy is to support only the current and previous RHEL major versions (today, 9 and 8). Once RHEL 10 is officially supported, 8 will fall off the list entirely.

What to Do Now

The advisory lays out a phased approach. Here’s how to operationalize it.

1. Inventory Your Fleet Immediately

Use the Intune admin center’s “Devices > All devices” view, filtering by OS: “Red Hat Enterprise Linux 8”. Export the list. Cross-reference with your asset management database to identify which devices are still active and which are already slated for hardware refresh. Note the hardware model, architecture (x86_64, aarch64), and any line-of-business software that depends on the RHEL version.

2. Build a Migration Priority Matrix

Segment devices into three buckets:
- Must-upgrade-to-RHEL-9: General-purpose developer workstations, laptops, and shared desktop machines. These will get in-place upgrades or fresh installations.
- Wait-for-RHEL-10 (but no later than Q1 2026): Workstations with hardware still in vendor certification for RHEL 10, or those running ISV applications that require specific 10.x kernel features. However, you must have a backup plan: if the RHEL 10 Intune agent doesn’t arrive in time, fall back to RHEL 9.
- Retire/decommission: Deprovision aging hardware that would need replacement anyway. It’s cheaper to give a user a new RHEL 9 laptop than to pay for ELS subscriptions and risky migration projects.

3. Pilot the Upgrade Process

Red Hat supports in-place upgrades from RHEL 8 to 9 using the Leapp tool. Start a pilot with 10–20 non-critical devices. Verify that:
- The Intune agent reconnects and reports compliance post-upgrade.
- Custom compliance scripts still work (shell script paths, Python versions, and library dependencies may change).
- All PAM/NSS configurations for identity integration with Azure AD or AD domain services survive the upgrade.
- Network interfaces and VPN configurations are intact.

4. Update Compliance Policies and Baselines

While you migrate, you’ll have a mixed environment. Create two Intune device compliance policies: one for RHEL 8 (with an aggressive “mark non-compliant after X days” timer) and one for RHEL 9. Assign them to dynamic device groups based on OS version. As you move devices to the RHEL 9 group, they’ll automatically inherit the correct baseline.

5. Communicate Proactively

Draft a user-facing notification: “Your Linux desktop will need an upgrade by to maintain access to email, chat, and file services. The IT team will contact you to schedule the upgrade.” Include a FAQ covering what data is preserved, how long the process takes, and whom to contact. For developer workstations, coordinate with engineering leads to avoid disrupting CI/CD pipelines.

6. Set a Hard Internal Deadline for July 1, 2026

Microsoft’s cut-off is July 24. Build in buffer. Your last RHEL 8 device should be off the network or upgraded by July 1. Use Compliance policies to block access for any stragglers, forcing users to act.

7. Keep an Eye on RHEL 10

If you have valid reasons to jump directly to RHEL 10, register for Red Hat’s beta program and test the Intune agent as soon as a technical preview is available. Microsoft has committed to supporting “day-one” for new RHEL major releases, but that has not always been delivered. Track the Intune What’s New blog and the Microsoft 365 roadmap for an official RHEL 10 support entry.

Outlook

The July 2026 deadline is generous—nearly two years away—but it will arrive faster than most IT roadmaps acknowledge. The bigger story here is Microsoft’s steady maturation of Linux endpoint management. The message is clear: Intune is no longer a Windows-only tool; it enforces the same lifecycle rigor on any OS it touches. For Red Hat shops, that means aligning upgrade cycles with both Red Hat’s release tempo and Microsoft’s support windows, a coordination task that demands tighter collaboration between Linux engineering and identity teams. Watch for similar announcements around Ubuntu LTS releases; a pattern is forming. For now, start your RHEL 9 pilots, update your asset registers, and get that migration project funded.