Skip to content

Timings and limits

"It's been an hour and nothing happened" is the most common Intune complaint. Usually nothing is wrong: the change just hasn't been picked up yet. These are Microsoft's published estimates as of October 2026. Real-world timing varies with network, device state and service load.

Device check-in

Maintenance check-ins happen roughly every 8 hours on all platforms, and Intune allows at most one maintenance sync every 6.5 hours. Newly enrolled devices check in more often:

Platform After enrollment
Windows Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, then around every 8 hours
Android and AOSP Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, then around every 8 hours
iOS/iPadOS Every 15 minutes for 1 hour, then around every 8 hours
macOS Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, then around every hour

Changes to assignments also trigger a push notification, which online devices act on anywhere from immediately to a few hours later. Adding an app as Available doesn't trigger a notification.

Other timings

What How long
Entra group membership change reaching Intune Usually within about 5 minutes. Large dynamic groups can take much longer to evaluate in Entra ID first.
Group and filter changes reaching enrollment restrictions About 15 minutes
Intune Management Extension checking for new Win32 apps Every hour, and after a restart of the device or the service
Remediations policy retrieval After restart, at user sign-in, and every 8 hours
Remediations result reporting (recurring scripts) On change, plus a full report every 7 days
App protection policy refresh (registered users) Typically every 30 minutes while the app is in use
App protection retry for unlicensed or untargeted users Every 12 hours
Changes to an existing app protection policy Up to 8 hours for signed-in users
App configuration for SDK apps Every 30 minutes with an app protection policy, every 720 minutes without
Selective wipe check in protected apps Every 30 minutes and at sign-in
Profile removal after a user leaves an assigned group Up to about 7 hours or more
Windows Update service processing a new Windows update policy Typically within 10 minutes
Log Analytics: audit and operational logs Sent immediately, visible within about 30 minutes
Log Analytics: compliance and device inventory Exported once every 24 hours, up to 48 hours
PIM elevation to the Entra Intune Administrator role Usually within 10 seconds
PIM for Groups elevation into an Intune role assignment Up to 15 minutes

Limits

Enrollment

Limit Value
Device limit per user (enrollment restriction) 1 to 15 (default policy, plus up to 25 custom device limit policies)
Device enrollment manager account Up to 1,000 devices
Corporate identifier CSV file 5,000 rows or 5 MB per file; up to 10 Windows CSV files in the admin center
Enrollment Status Page profiles 51 (default + 50)
ESP blocking apps Up to 100
Autopilot device preparation Up to 25 apps and 10 PowerShell scripts during setup
Autopilot device name template 15 characters
Apple push certificate, ADE and VPP tokens 365 days (push certificate has a 30-day grace period)
Windows bulk enrollment token Up to 180 days

Apps and scripts

Limit Value
Win32 app size 30 GB
Win32 PowerShell script installer 50 KB
Remediation script packages 200 per tenant
Remediation output kept 2,048 characters
Win32 default installation time 60 minutes (configurable)

Device actions and reports

Limit Value
Wipe actions per tenant per day 500
Retire actions per tenant per day 1,000
Delete actions per tenant per day 1,000
Bulk device action Up to 100 devices
Device cleanup rule threshold 30 to 270 days
Compliance status validity period 1 to 120 days (default 30)
Compliance setting in Error before it counts against the device Up to 7 days
Multi-device query ~50,000 rows, 3 joins, 10 queries per minute, 1,000 per month
Device query export 50,000 rows

Security

Limit Value
BitLocker recovery keys stored per device in Entra ID 200
Windows LAPS password age (Entra ID backup) 7 to 365 days
Windows LAPS password length 8 to 64 characters
Cloud PKI certification authorities per tenant 3
Cloud PKI CRL validity 7 days, refreshed every 3.5 days

Windows updates

Setting Range
Quality update deferral 0 to 30 days
Feature update deferral 0 to 365 days
Update deadlines (quality and feature) 2 to 30 days
Grace period after a deadline 0 to 7 days
Feature update uninstall period 2 to 60 days
Expedited update restart deadline 0 to 2 days

Learn more