Configuration profiles¶
Configuration profiles are how you set things on devices: restrictions, Wi-Fi, browser settings, Office settings, Windows features and hundreds more. Create them under Devices > Manage devices > Configuration > Create > New policy.
Which profile type to use¶
| Profile type | Use it when | Notes |
|---|---|---|
| Settings catalog | Almost always. It's the default choice. | Thousands of searchable settings for Windows, macOS, iOS/iPadOS and Android Enterprise, including ADMX-backed settings for Office, Edge and Windows components. New settings land here first. |
| Templates | The setting only exists as a template | Still needed for Wi-Fi, VPN, certificates (trusted, SCEP, PKCS), email, domain join, kiosk and some device restrictions. |
| Custom | Nothing else exposes the setting | Windows OMA-URI, or an Apple .mobileconfig file. Intune can't validate custom payloads, so test carefully. |
| Imported administrative templates | A third-party app ships ADMX files | Import the ADMX and ADML, then configure the settings like any other ADMX policy. |
| Endpoint security and security baselines | Security settings (antivirus, firewall, disk encryption, ASR, account protection) | Covered in Endpoint security and Security baselines. |
Prefer the settings catalog over older templates
Older templates such as Device restrictions and Administrative templates still work, but Microsoft adds new settings to the settings catalog. Use the catalog for new work, and migrate old template profiles when you next touch them. That avoids two profiles fighting over the same setting.
Working with the settings catalog¶
- Search, don't browse. Use Add settings, search for a keyword such as
BitLockerorCopilot, then select the category and tick the settings you want. - User or device scope (Windows). Settings whose name ends in (User) apply to the signed-in user. If you assign a user-scoped setting to a device group, it applies to every user who signs in to those devices.
- Read the setting's tooltip. It links to the CSP documentation, which shows the supported Windows editions and versions. A setting that shows Not applicable on a device is usually unsupported on that edition or version.
- One purpose per profile. Group settings by function (for example Edge security, OneDrive, Windows Update notifications) rather than one giant profile. Smaller profiles are easier to pilot, troubleshoot and roll back.
- Duplicate to test. Use Duplicate on an existing profile to create a pilot version, change it, and assign it to a pilot group.
Platform notes¶
- Windows settings are delivered through configuration service providers (CSPs). Some settings need the Enterprise or Education edition and silently don't apply to Pro.
- When you remove a profile, some CSP settings revert and others stay as they were (tattooing). To be sure a setting goes back, assign a profile with the value you want.
- Use Group Policy analytics (Devices > Manage devices > Group Policy analytics) to import a GPO backup, see which settings Intune supports, and migrate them straight into a settings catalog profile.
- Many settings now use Apple's declarative device management (DDM), which the device enforces on its own and reports on quickly. Prefer DDM settings where they exist, for example software updates and passcode.
- Custom
.mobileconfigprofiles are delivered as-is. If two custom profiles configure the same payload, macOS applies one of them unpredictably. - Some settings need the device to be supervised (enrolled through Automated Device Enrollment) or need user-approved MDM.
- Many restrictions only work on supervised devices. User enrollment devices support a much smaller set of settings.
- Settings removed from a device when you unassign the profile go back to Apple's defaults, except a few roaming settings.
- Available settings depend on the management type: personally owned work profile, corporate-owned work profile, fully managed or dedicated.
- Most Android settings aren't removed from the device when you unassign a profile. Assign the value you want instead.
- Use OEMConfig apps for vendor-specific settings on Samsung, Zebra and other rugged devices.
Naming conventions¶
Agree on a naming pattern before you have 400 profiles. One that works well:
<Platform>-<Type>-<Purpose>-<Scope>-<Version>
WIN-SC-EdgeSecurity-AllDevices-v2
MAC-SC-PlatformSSO-Corp-v1
IOS-TPL-WiFi-Corp-v1
AND-SC-WorkProfileRestrictions-BYOD-v1
Use the Description field for the why: the ticket number, who requested it, and what it replaces.
Monitoring and reporting¶
| What you want to know | Where |
|---|---|
| Did a profile apply to a device? | The profile's Device and user check-in status |
| Which setting failed? | The profile's Per setting status, or the device's Device configuration page |
| Which profiles failed across the tenant? | Devices > Monitor > Assignment failures |
| Which settings conflict? | Device > Device configuration shows Conflict, then open the setting to see the competing profiles |
| Did a filter include or exclude a device? | Device > Filter evaluation |
Status reporting lags behind what's on the device. If the device shows the setting but the portal says Pending, wait for the next check-in before you troubleshoot.
Conflicts in practice¶
A conflict means two profiles set the same setting to different values. Intune doesn't pick a winner between configuration profiles; the setting usually doesn't apply at all, and the device reports a conflict. Common causes:
- The same setting in a settings catalog profile and an older template or baseline.
- An endpoint security policy and a security baseline both configuring Defender or BitLocker.
- Two teams each creating "their" profile for the same feature.
Fix it by deciding which profile owns the setting and removing it from the other. Compliance policies are an exception: compliance settings win over configuration settings. See Intune fundamentals.
Copilot in Intune can help
If you have Security Copilot, Copilot in Intune can summarize a policy, explain individual settings, and help find the source of a conflict. Treat its answers as a starting point and confirm in the reports.