What are Intune Configuration Profiles?

SUMMARY:

Creating a configuration profile allows you to configure specific settings and then deploy it to all or some devices. You can configure a wide range of settings, including personalization and security. To read Microsoft's in-depth article on creating configuration profiles, click here.

Table of Contents

Creating Configuration Profiles

Configuration Profile Types

Configuration Profiles for Windows Devices

What are Administrative Templates?

What are Windows Custom Configuration Profiles?

When do Devices Receive Configuration Profiles from Intune?

Creating Configuration Profiles

Configuration Profiles are available for all main device operating systems including Windows, macOS, iOS/iPadOS, Android, and Linux. You can either manage each operating system's config profiles separately under the By platform section or you can manage all of them together under the Manage devices section (see below):

Configuration Profile Types

When creating a configuration profile, you are presented with two profile types (see below):

1. Settings Catalog: allows you to select one or multiple individual settings to configure and deploy for that OS; use this type to build out a custom policy

2. Templates: allows you to select from a list of templates, each containing a preselected group of related settings
   

Configuration Profiles for Windows Devices

Configuration Profiles for Windows devices are comparable to Group Policy Objects deployed through the Group Policy Management Console in an AD DS environment. If you are familiar with GPOs, you will feel right at home with configuration profiles.

NOTE:

You can migrate (export and import) on-premises GPOs to Intune and convert them to configuration profiles. Click here for more information.

What are Administrative Templates?

Remember that there are two configuration profile types: setting catalog and template. If template is chosen, you will see Administrative templates as an option in the drop-down list. If you've imported ADMX files, you will also see Imported Administrative templates (Preview).

IMPORTANT:

The December 2412 Intune release has migrated Administrative Templates to the Settings Catalog. If you don't see them listed under Templates, try looking for them under Settings Catalog. To learn more about this migration, click the link below:

Support tip: Windows device configuration policies migrating to unified settings platform in Intune

Administrative templates represent the group policies (settings) in the Windows ADMX files; Imported Administrative templates (Preview) represent the group policies (settings) in the imported, third-party ADMX files. Intune automatically provides most group policies from the Windows ADMX files; Intune also allows you to import third-party ADMX files. It is important to note that Intune does not use group policies as the legacy Group Policy Editor did; Intune uses the MDM alternative to the Group Policy framework which is the Configuration Service Provider (CSP) framework. A mapping is created between the group policies in ADMX files and the policies in the CSP framework; Intune can target settings within CSP policies using an OMA-URI. To learn more about CSPs, OMA-URIs, and how Intune converts ADMX files, click the link below:

What are OMA-URIs and CSPs in Intune

Creating administrative template-based configuration profiles in Intune is similar to creating GPOs in the Group Policy Editor. There are settings scoped to the computer and settings scoped to the user, similar to GPOs.

What are Windows Custom Configuration Profiles?

Intune provides a very friendly user interface for creating configuration profiles. This online platform provides many "built-in" templates and settings you can easily select and configure. Intune's platform, however, does not have every setting available for you to configure. This is where custom configuration profiles come in.

When you create a custom configuration profile, you tell Intune exactly which setting to configure by specifying an OMA-URI, the setting's value type, and the value itself (see screenshot below). Once ready, Intune will deploy this custom configuration profile to the assigned users/devices. The protocol used to transport this custom configuration profile is the OMA-DM protocol which uses SyncML files to deliver the configuration profile. Once a device receives the profile, the targeted CSP will implement/enforce it. To learn more about CSPs and OMA-URIs, click the link below:

What are OMA-URIs and CSPs in Intune

Custom Configuration Profile Example

For example, if we wanted to use a custom configuration profile to set the desktop image on our computers, we would do the following:

1. Launch the Intune portal.

2. Navigate to Devices > Windows > Configuration.

3. Select +Create and then +New Policy

   1. Platform: Windows 10 and later

   2. Profile Type: Templates

   3. Template Name: Custom

4. Configuration Settings

   1. OMA-URI: ./Vendor/MSFT/Personalization/DesktopImageUrl

   2. Data Type: String

   3. Value: the file or HTTP/HTTPS path to an image file

When do Devices Receive Configuration Profiles from Intune?

After you create the configuration profile, Intune will attempt to notify the assigned devices to check-in. If the first notification fails, Intune will try three more times. If unsuccessful, the device will receive the configuration profile the next time it checks in with Intune (remember that devices check in with Intune every 8 hours). See the quote from Microsoft below:

Intune notifies the device to check in with the Intune service... If a device doesn't check in to get the policy or profile after the first notification, Intune makes three more attempts.

Cover Picture provided by Freepik