🎯 Intune Course · Module 4 of 7
Configuration Profiles
📂 Course: Intune & Endpoint Management
📦 Module: 4 of 7
🎯 Exam: MD-102
⏱ Read time: ~22 min
📦 Module: 4 of 7
🎯 Exam: MD-102
⏱ Read time: ~22 min
MD-102 Exam Alignment
MD-102
- Know that the Settings Catalog is the modern approach for Windows configuration profiles — it provides a searchable library of thousands of individual settings across all Windows policy areas
- Know that Administrative Templates (ADMX) in Intune mirror the settings available in on-premises Group Policy — allowing admins to configure registry-backed Windows settings via MDM without domain join
- Know that Filters (Devices → Filters) allow you to target policies and apps to specific devices based on properties like OS version, device model, or ownership type — without creating additional Entra ID groups
- Know that configuration profiles are assigned to user groups (apply when any device the user signs into receives the profile) or device groups (apply regardless of who is signed in)
Exam Tip: When a user has a configuration profile assigned AND a device group also has one assigned, and they conflict, the device assignment wins for device settings, and the user assignment wins for user settings. The Settings Catalog now covers most scenarios that previously required separate Device restriction or Custom OMA-URI profiles.
Configuration profiles are Intune’s primary mechanism for actively pushing settings to enrolled devices. Unlike compliance policies (which evaluate device state), configuration profiles configure the device: they set Wi-Fi credentials, VPN connections, email account settings, device restrictions, certificate deployments, and hundreds of OS-level settings. Every major platform (Windows, iOS, Android, macOS) has platform-specific profile types, and Windows has the most extensive catalog through the Settings Catalog.
📁 Profile Types by Platform
| Platform | Key Profile Types |
|---|---|
| Windows 10/11 | Settings Catalog, Administrative Templates, Device restrictions, Wi-Fi, VPN, Email, Certificates (SCEP/PKCS), Custom (OMA-URI), Delivery Optimisation, Kiosk |
| iOS/iPadOS | Device features, Device restrictions, Wi-Fi, VPN, Email, Certificates, Web content filter, Single sign-on extension, Per-app VPN |
| Android Enterprise | Device restrictions, Wi-Fi, VPN, Certificates, OEMConfig, Kiosk mode (Dedicated Devices) |
| macOS | Settings Catalog, Device features, Device restrictions, Wi-Fi, VPN, Certificates, FileVault encryption |
⚙️ Settings Catalog (Windows)
The Settings Catalog is the modern, recommended approach for Windows device configuration. It provides a single, searchable interface containing thousands of individual policy settings from multiple Windows policy areas.
| Feature | Description |
|---|---|
| Searchable library | Search by setting name, description, or CSP path. Quickly find any Windows policy without knowing where it lives |
| Categories | Settings organised by category: Authentication, Delivery Optimisation, Edge, Firewall, Microsoft Defender, OneDrive, Windows Hello, Windows Update, etc. |
| Policy scope | Each setting shows whether it applies to the User (current logged-on user) or Device (all users of that device) |
| Conflict detection | If two profiles assign conflicting values to the same setting, Intune reports a conflict in the device’s profile status — no silent overwrite |
| Superset of templates | Settings Catalog includes all settings from Administrative Templates plus many additional modern MDM settings |
📋 Administrative Templates (ADMX)
Administrative Templates in Intune mirror the Group Policy settings available in on-premises Active Directory. They cover Microsoft Edge, Microsoft 365 Apps, Windows OS settings, and OneDrive. Use these when migrating from GPO-based management to cloud-native MDM.
💡 ADMX vs Settings Catalog
- Administrative Templates: Traditional ADMX-backed registry settings. Familiar to GPO admins. Good for migrating existing GPO configurations.
- Settings Catalog: Modern MDM-native settings. Broader coverage. Recommended for new configurations. Includes all ADMX settings plus additional MDM-only settings.
- Both can coexist — a device can have both types assigned simultaneously with no conflict as long as they configure different settings.
📶 Common Profile Types
Wi-Fi Profile
Deploys Wi-Fi connection settings to devices so users don’t need to manually enter the network credentials. Essential for corporate WPA2-Enterprise (802.1X) networks.
| Setting | Description |
|---|---|
| SSID | Network name (e.g., “Contoso-Corporate”). Can be hidden (won’t broadcast). |
| Security type | Open, WPA2-Personal (PSK), WPA2-Enterprise (802.1X with certificates or username/password) |
| Connect automatically | Device connects when in range without user interaction |
| Certificate | For WPA2-Enterprise: reference a SCEP or PKCS certificate profile for authentication |
| Proxy | Automatic proxy configuration URL or manual proxy server settings |
VPN Profile
Deploys VPN connection settings. For Windows: supports built-in VPN types (IKEv2, L2TP, PPTP) and third-party VPN clients (Cisco AnyConnect, Palo Alto GlobalProtect, etc.) via custom XML. Per-app VPN (iOS/Android) routes only traffic from specified apps through the VPN tunnel.
Device Restrictions Profile
Restricts device features and user access. Examples: disable camera, disable Bluetooth, require password, block app store access, control screenshots, prevent factory reset. Available for all platforms.
🎯 Assignment & Filters
| Concept | How It Works |
|---|---|
| Assign to group | Target the profile to an Entra ID user or device group. All members receive the profile. Dynamic groups auto-add/remove members based on attributes. |
| Include/Exclude | Assign to Group A but exclude Group B — useful for applying to “All Devices” but excluding test machines |
| Filters | Refine assignment at delivery time using device properties (deviceManufacturer, osVersion, deviceCategory, deviceOwnership). Example: Apply profile to Group A only if the device is corporate-owned Windows 11. Filter is evaluated on the device at sync time. |
| User vs Device assignment | User groups: profile follows the user across any enrolled device they sign into. Device groups: profile applies to the device regardless of who signs in. Wi-Fi and VPN are typically assigned to device groups. |
PowerShell — Configuration Profiles (Microsoft Graph)
Connect-MgGraph -Scopes 'DeviceManagementConfiguration.ReadWrite.All' # List all configuration profiles Get-MgDeviceManagementDeviceConfiguration | Select-Object DisplayName,LastModifiedDateTime,Id | Sort-Object DisplayName # Get profile deployment status for a specific device Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 'device-id' | Select-Object SettingName,State,ErrorCode | Where-Object {$_.State -ne 'notApplicable'}
💡 Best Practices
- Use the Settings Catalog for all new Windows profiles — it has broader coverage, better conflict detection, and is Microsoft’s recommended path. Reserve Administrative Templates for settings not yet in the Settings Catalog or when migrating existing GPOs
- Use Filters instead of creating many groups — if you need to target a profile to “All corporate Windows 11 devices” create one group (All Windows Devices) and add a filter for OS=Windows 11 and deviceOwnership=Corporate, rather than maintaining a separate group for that subset
- Always check the Device configuration → per-policy status after deployment — any device showing Error or Conflict state means the profile was NOT applied; resolve errors before they affect more devices
🎓 Interview Q&A
Q: An admin deploys a Wi-Fi profile to a user group and a Device restrictions profile to a device group. The same device receives both. Which assignment type determines when each profile applies?
Both profiles are delivered to the device — Intune applies both. The Wi-Fi profile (assigned to user group) applies in the context of the signed-in user — when a specific user logs in, their Wi-Fi profile is applied. If a different user signs in, their Wi-Fi profile applies. The Device restrictions profile (assigned to device group) applies at the device level regardless of who is signed in — the restrictions are enforced for all users of that device. This is why Wi-Fi and VPN are often assigned to user groups while device restrictions and security settings are assigned to device groups.
🎯 MD-102 Mock Test
Module 4 — Configuration Profiles
5 questions · Pass mark: 70%
Q1 OF 5
An admin creates two configuration profiles that both configure the same Windows Defender Antivirus setting, but with different values. Profile A is assigned to a device group; Profile B is assigned to a user group. The same device receives both. What happens?
✅ C. When two configuration profiles assign conflicting values to the same setting, Intune reports a Conflict status and the setting is NOT applied on the device — neither value wins. The device retains whatever value the OS had before. Intune logs the conflict in the device’s configuration state so the admin can identify and resolve it by removing the conflicting setting from one of the profiles.
Q2 OF 5
What is the primary advantage of the Settings Catalog over older Intune profile types like Device restrictions and Custom OMA-URI for Windows?
✅ B. The Settings Catalog’s key advantage is its comprehensive, searchable library of thousands of individual Windows policy settings in a single profile type. Previously, admins needed to know specific OMA-URI paths for custom settings, use separate profile types for different areas, or accept limited choices in Device restrictions. The Settings Catalog surfaces all these settings with descriptions, eliminating the need to manually craft OMA-URI paths.
Q3 OF 5
An admin wants to deploy a Wi-Fi profile to all corporate Windows 11 devices in the Sales department, but NOT to personal BYOD devices or other departments’ Windows 11 devices. What is the most efficient approach?
✅ D. Using a Filter in combination with group assignment is the most efficient approach. Assign the profile to the existing Sales department group, then add a Filter that evaluates device ownership (Corporate) and OS version (Windows 11). The filter is evaluated at the time the policy syncs to each device — only devices that match all filter conditions receive the profile. This avoids creating and maintaining additional groups.
Q4 OF 5
An organisation wants to deploy their corporate WPA2-Enterprise (802.1X) Wi-Fi profile to all enrolled Windows and iOS devices so users automatically connect without entering credentials. What type of profile should be created?
✅ A. Wi-Fi profiles in Intune are platform-specific — you create one for Windows and a separate one for iOS. For 802.1X (WPA2-Enterprise), each profile references a certificate profile (SCEP or PKCS) that provides the client certificate for network authentication. The Wi-Fi profile then references that certificate for EAP authentication, enabling automatic, seamless connection without username/password prompts.
Q5 OF 5
After deploying an Administrative Templates profile to 500 Windows devices, the admin notices 45 devices show “Error” status for the profile. Where should the admin look first to diagnose the error?
✅ C. To diagnose configuration profile errors: go to Devices → Configuration → select the profile → under “Monitor” open Device and user check-in status. Filter by Error. Click a specific device to see the detailed per-setting status, including error codes. Common error causes: setting not supported on that OS version, conflicting value from another profile, or the device doesn’t meet a requirement (e.g., Secure Boot not available on older hardware).
🔒
Module locked — Complete Module 3 first.