Microsoft Pulls Configuration Manager 2609 After Entra ID Group Discovery Bug Wipes Group Data

If you were planning to install Configuration Manager 2609 this month, stop and read this first. Microsoft unpublished the current branch 2609 update on November 11, 2026, after finding an issue that can unexpectedly remove discovery data for Active Directory groups and Microsoft Entra ID (formerly Azure AD) groups when Microsoft Entra ID Group Discovery is enabled. According to the Microsoft Learn summary of changes for 2609 (KB2377842), devices or users can drop out of collections whose membership rules depend on those groups. Microsoft says a corrected version of 2609 will be released later.

For health care IT teams, this is not an abstract bug. Collections are how Configuration Manager (formerly SCCM) decides which machines get which patches, applications, and compliance baselines. If a collection quietly empties out, the deployments targeting it quietly stop reaching anyone.

At a glance

Affected: Sites running or planning to install 2609 (package GUID 8B9745E4-B815-49D6-8FAA-5FDC8B3DF4FC) with Microsoft Entra ID Group Discovery enabled. Separately, sites upgrading from 2603 or earlier with ODBC Driver 18.7.1.1 installed.

Not on 2609 yet: wait for the corrected release.
Already on 2609: check whether Entra ID Group Discovery is enabled and verify group-based collection membership now.
On 2603 or earlier: do not install ODBC Driver 18.7.1.1. Stay on 18.6.2.1.
Record member counts for critical deployment collections.
Watch the KB2377842 page for the replacement build.

What happened and when

Version 2609 followed the usual current branch rollout. It became available to the early update ring, which requires running an opt-in script, on September 30, 2026. It went globally available on October 26, 2026, and was unpublished on November 11, 2026, according to the Intune Admin News change tracking for KB2377842. That means the update was generally available for about two weeks, long enough for plenty of sites to install it.

The trigger Microsoft has identified is Microsoft Entra ID Group Discovery. When that discovery method is enabled, discovery data for both Active Directory groups and Entra ID groups can be removed unexpectedly. Any collection with a membership rule that references those groups can then lose members. Microsoft has not published a detailed root cause, and as of today the Learn page does not list recovery steps for sites that already installed the build.

What admins are reporting

System Center Dudes posted the unpublishing notice on X on November 11, and it was amplified by well-known members of the Configuration Manager community. On the r/SCCM thread about the unpublishing, one admin reported that the upgrade "broke all the User collections" because discovery stopped populating users, affecting flat and direct memberships in their environment. Others recommended staying a version behind, or at minimum checking whether Entra ID Group Discovery is enabled before going further. Some said they do not use Entra groups and still planned to wait.

Treat the community reports as signals, not confirmed scope. There are no widespread reports of total site failure, but at least one practitioner describes breakage that sounds broader than Microsoft's description. Whether sites using only on-premises Active Directory Group Discovery can be affected is still an open question.

Why this matters in a hospital or clinic

Picture a solo IT administrator at a small rural hospital. Their monthly software update deployment targets a collection built from an AD group of clinical workstations. Their nurse station application targets a user collection built from an AD group of nursing staff. If 2609 strips the group discovery data, both collections can lose members without any error in the deployment itself. The deployment still shows as deployed. It just has fewer targets, possibly zero, and compliance reports built on those collections start telling a misleading story.

That silent failure is the real risk. Missed patches on clinical workstations, applications that never reach new staff, and compliance baselines that stop evaluating tend to surface weeks later, usually at a bad time. Lean environments that rely heavily on group-based collections, and that do not have someone checking member counts regularly, are the most exposed. If you run co-management with Intune, cross-check Intune collection or assignment impacts as well.

If you already installed 2609

Start by confirming whether Microsoft Entra ID Group Discovery is enabled. In the console, go to Administration > Hierarchy Configuration > Discovery Methods. Then review the collections that matter most: patch deployment collections, application deployment collections, and anything feeding compliance baselines. Compare current member counts with what you expect, or with any reports or exports from before the upgrade.

If collections have lost members, your options are limited until Microsoft publishes guidance. The research available today points to two paths: investigating manual re-discovery and collection fixes, or restoring from a site backup. A site restore is a significant operation with its own risks, so do not jump to it on a hunch. If the impact is serious, consider opening a case with Microsoft support before taking drastic steps, and keep checking the KB2377842 page for updated instructions.

In the meantime, a direct-membership collection of known clinical workstations can keep your most important update deployment targeted while group-based collections are unreliable.

If you have not installed 2609

You are in the better position. Wait for the corrected 2609 release, read the release notes when it appears, and confirm the discovery issue is listed as fixed before installing. This is also a good moment to snapshot member counts for your critical collections. A baseline makes it much easier to catch problems after any future upgrade.

The separate ODBC driver warning

Microsoft also updated its What's new in version 2609 documentation with a warning about the ODBC Driver for SQL Server. Version 18.7.1.1 can block site configuration during upgrades from Configuration Manager 2603 or earlier. The validated version, shipped with 2609, is 18.6.2.1. Microsoft's guidance is to complete the update to 2609 before installing 18.7.1.1 if you need it.

With 2609 unpublished, there is no reason to install ODBC 18.7.1.1 right now if you are on 2603 or earlier. Doing so could set up a blocked upgrade when the corrected 2609 arrives. Check the installed ODBC driver version on your site server before you plan the upgrade window.

Other 2609 changes to plan for

When the corrected build ships, the rest of the 2609 changes still apply. According to the What's new page, 2609 updates the SQL Server drivers (ODBC 18.6.2.1 and OLE DB 19.4.2.0), removes the dependency on SQL Server Native Client, no longer supports SQL Server 2016, and removes client support for Windows Server 2012 and 2012 R2. If your site database is on SQL Server 2016, or you still manage 2012-era servers with the Configuration Manager client, use this delay to plan for those changes.

A note on compliance

No HIPAA provision addresses a vendor update bug directly, but collection accuracy is part of how many organizations show their security controls work. Patch and anti-malware deployments driven by collections support risk management under 45 CFR 164.308(a)(1)(ii)(B) (Required) and protection from malicious software under 45 CFR 164.308(a)(5)(ii)(B) (Addressable, which means implement it or document an equivalent alternative, not skip it). Accurate endpoint configuration also indirectly supports the technical safeguards in 45 CFR 164.312, such as access control and integrity. If collections silently lost members, note the gap, what you checked, and what you fixed. That record is useful for your next risk analysis.

What we still do not know

Microsoft has not published the root cause, a date for the corrected 2609, or a recovery procedure for sites that installed the unpublished build. It is also unclear whether environments using only on-premises AD Group Discovery are affected, and whether non-group-based collections or other discovery methods are touched. Until more is known, the safest posture is simple: hold off on 2609, verify your group-based collections if you already have it, and leave the ODBC driver alone.

This article is for informational purposes only and does not constitute legal or compliance advice. Covered entities and business associates should consult qualified legal counsel or compliance professionals before making decisions pertaining to HIPAA or IT infrastructure.