Intune configuration profiles and policies

Intune does its work through policies. Settings and features are added to configuration profiles, which you assign to user or device groups; the next time a device checks in, the settings apply. Profiles are platform-specific: Android, iOS/iPadOS, macOS, tvOS, visionOS and Windows each have their own settings and their own profile types, plus Linux with shell scripts and Android AOSP with its own templates.

When you create a device configuration profile you choose one of two policy types. Templates group settings by feature (VPN, Wi-Fi, email, kiosk, certificates, device restrictions) for a guided setup. The Settings catalog lists all available settings in one place — thousands of settings on Windows, generated from the configuration service providers (CSPs), Apple Profile-Specific Payload Keys and declarative device management on Apple, and Android Enterprise / AOSP settings — and is the modern, GPO-like approach Microsoft recommends for granular control. The catalog is where new capabilities land: the macOS Endpoint protection template, for instance, was deprecated in the August 2024 (2408) release in favor of catalog settings.

The same rule applies across the rest of Intune: there is one place per policy family, and knowing which family a setting belongs to is most of troubleshooting. Compliance policies, app protection policies, enrollment restrictions and RBAC all follow the pattern below, each with its own list and its own precedence rules.

Policy types at a glance

The policy families, their targets, and where each one is created in the Microsoft Intune admin center.
Policy type	Targets	What it does	Where it is created
Device configuration — Templates	User or device groups	Logical groups of settings per feature: kiosk, VPN, Wi-Fi, email, certificates, device restrictions, custom (OMA-URI on Android, Apple Configurator files on Apple), BIOS/DFCI, edition upgrade, delivery optimization, wired networks, and more.	Devices > Manage devices > Configuration > Create > New policy → Profile type: Templates
Device configuration — Settings catalog	User or device groups	Every setting in one picker, with search and filters; per-setting status and conflict reporting; import/export JSON; duplicate profiles. Defaults mirror the OS defaults; the minus sign = Not configured (Intune stops managing the setting).	Devices > Manage devices > Configuration > Create > New policy → Profile type: Settings catalog
Compliance policies	User or device groups; platform-specific rules	Define the conditions a device must meet (minimum OS, encryption, passcode, jailbreak/root detection, health attestation); feed Compliance Status into Entra Conditional Access; drive actions for noncompliance.	Devices > Compliance > Create policy (after selecting a platform); tenant-wide compliance policy settings under Endpoint security > Device compliance
App protection policies	User groups (optionally by device-management state)	MAM: app-level PINs, cut/copy/paste restrictions, save-as rules, encryption, jailbroken/rooted blocks, selective wipe of org data — with or without MDM.	Microsoft Intune admin center, app protection policy creation (also reachable from the OneDrive admin center 'Global' policy)
Enrollment restrictions	Users (by platform, version, manufacturer, ownership) and device-count limits	Two types: device platform restrictions and device limit restrictions (1-15 devices). One default policy applies to all user and userless enrollments until higher-priority policies are assigned.	Devices > Device onboarding > Enrollment > Device platform restriction; enrollment device limit restrictions
Intune RBAC roles	Groups of admins	Granular permissions by management category and action (read/write/update/delete). Built-in roles: Application Manager, Endpoint Security Manager, Help Desk Operator, Policy and Profile Manager, Read Only Operator, and more; custom roles supported.	Tenant administration > Roles > All roles
Scope tags	Role assignments	Freeform text tags that limit which Intune objects (policies, apps, devices) an admin sees and manages; admins see objects only when their assignment carries a matching tag.	Tenant administration > Roles (scope tag on the role or the role assignment)
Security baselines	Device groups	Baselines from Microsoft's recommended settings, applied as configuration; managed by the Endpoint Security Manager role.	Endpoint security in the admin center

Role-based access control is the tool for handouts: assign the least-privileged built-in role instead of the Entra Intune Administrator or Global Administrator roles for daily work. Accounts created after June 2021 can administer Intune without an Intune license. The scope tag on a role controls visibility of the role itself; the scope tag on a role assignment limits visibility of the objects it grants.

Settings catalog in practice

How the catalog differs from templates

You start from scratch and add only the settings you want to control. Unselected defaults stay at the OS default; that is a documented feature, not a bug — the catalog's defaults are the same defaults as the device OS.
A setting removed with the minus sign becomes Not configured: Intune no longer manages it, it disappears from the policy, and the setting can be changed on-device again at the next check-in.
Settings names carry (User) or (Device) scope tags. Device-scope settings write to HKLM, user-scope to HKCU; if a setting exists in both scopes and is assigned to both, user scope takes precedence.
Scope behaves predictably: a device-scope policy assigned to a device applies to all users; assigned to a user, it applies to all users on that device once the user signs in and syncs; a user-scope policy assigned to a device behaves like loopback processing set to merge.
Filters narrow the picker: Windows OS edition filters, or Android enrollment mode (fully managed, corporate-owned work profile, dedicated). Edge/Office/OneDrive settings are unaffected by OS edition filters.
Conflicts are visible per setting: the report shows how many devices applied, conflicted, or errored on each setting. Assignment failures live under Devices > Monitor.
Profiles can be exported to JSON and re-imported, and Duplicate copies a profile with its settings and scope tags but without its assignments — the standard pattern for staging a similar policy.

Templates are not going away wholesale — kiosk, VPN, Wi-Fi, email and certificate templates still exist as a grouping option. But capability moves toward the catalog: on macOS, the Endpoint protection and Extensions templates were deprecated in the August 2024 (2408) release — existing policies keep working, new ones must use the settings catalog (FileVault, Firewall, Gatekeeper/System Extensions payloads). Windows custom profiles (OMA-URI) and Apple Configurator imports remain the escape hatches for settings Intune does not model.

Order of precedence and conflict rules

What wins when two policies collide

Same setting, different values, different policies = a conflict. The settings catalog exposes per-setting statuses and a Conflicts view in policy reporting; Devices > Monitor > Assignment failures lists policies that failed to deploy because of an error or conflict.
Compliance policy beats configuration profile. If a compliance policy and a device configuration policy both set the same setting, the compliance policy wins — even if the configuration setting is more secure.
Between multiple compliance policies, Intune applies the most secure of the assigned policies.
For policy-level status on a device with several compliance policies, each status has a severity and the highest one wins: Unknown (1) < NotApplicable (2) < Compliant (3) < InGracePeriod (4) < NonCompliant (5) < Error (6).
Co-management: authority is per workload. You choose which of the co-management workloads (compliance policies, device configuration, endpoint protection, etc.) Configuration Manager hands over to Intune; Configuration Manager keeps everything else. A workload can be piloted on a separate collection first.
Assignments are scope-tagged: an admin sees and manages an object only when their role assignment scope (groups) and scope tags cover it. Multiple role assignments with different scope tags widen effective access — review Admin permissions under Tenant administration > Roles before you scale.
Nothing applies instantly: settings land at the next device check-in and policy refresh cycle, and users can force a sync from Company Portal. For supported Windows devices there is a preview client-driven compliance evaluation that re-checks compliance when local state changes.

Platform coverage notes

Where each platform's configuration actually lives

Windows: Settings catalog (thousands of CSP-generated settings, including ADMX-backed administrative templates) plus templates for kiosk, VPN, Wi-Fi, email, biometrics, DFCI, edition upgrade. Group Policy analytics reports how on-prem GPO settings translate to MDM. PowerShell scripts run through the Intune Management Extension.
iOS/iPadOS: Device features templates (AirPrint, notifications, lock screen), certificates (SCEP/PKCS), device restrictions, email. Settings catalog: DDM and passcode settings; iOS/iPadOS 15+ User Enrollment devices use declarative device management automatically when DDM works.
macOS: Same template families, plus preference files (plist) and shell scripts — with settings catalog settings replacing plists for newer features. Catalog covers FileVault, firewall and Gatekeeper after the 2408 template deprecation.
Android: Android Enterprise management modes available (fully managed, corporate-owned work profile, dedicated, personally owned work profile, plus AOSP). OEMConfig is the standard for OEM-specific features; the catalog has Android AOSP and Android Enterprise settings with enrollment-mode filters. Device administrator mode is deprecated for GMS devices.
Linux: No settings catalog or enrollment restrictions: configuration happens through shell scripts, and compliance supports Linux (currently Ubuntu Desktop 24.04 LTS / 26.04 LTS and RHEL 9/10) with an allowed-distros condition.
tvOS / visionOS: Settings catalog supports importing Apple Configurator or Profile Manager profiles; variables are not supported in imported profiles.

FAQ

What is the difference between Templates and the Settings catalog?

Templates are logical groupings of settings around one feature or concept — kiosk, VPN, Wi-Fi, email, certificates. The settings catalog lists every available setting in one searchable place, similar to Group Policy but cloud native. Microsoft's own guidance: use templates when you want the grouping, use the catalog when you want to see all firewall or all BitLocker settings or recur to a specific setting. New settings continually arrive in the catalog, and some templates are deprecated there as they are superseded.

Two policies set the same setting to different values — which one wins?

The setting is in conflict, and Intune resolves by rule: a compliance policy setting overrides the same setting from a device configuration policy (even if the configuration value is more secure); between multiple compliance policies, the most secure policy takes effect. Use per-setting status reporting and Devices > Monitor > Assignment failures to find which policy and device are fighting.

Do configuration profiles apply immediately?

No — devices apply new settings at their next check-in and policy refresh cycle. Users can force a sync from Company Portal. For supported Windows devices, client-driven compliance evaluation (preview) can request a compliance re-evaluation when local state changes; the settings catalog per-setting status updates on the same check-in cadence.

Which role should my Intune admins get?

Use a built-in Intune RBAC role for the task: Policy and Profile Manager covers compliance policies, configuration profiles, Apple enrollment, corporate device identifiers and security baselines; Help Desk Operator does remote actions and assignments; Endpoint Security Manager covers baselines and compliance. View roles and monitor effective permissions at Tenant administration > Roles. Avoid the Entra Global Administrator and Intune Administrator roles for daily work — Microsoft explicitly discourages them.

IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
VLSM calculator — split a block into right-sized subnets by host requirements.