Windows Configuration Profiles, ADMX and Group Policy Analytics

What it is

A device configuration profile is a set of settings that Intune applies to enrolled devices. For Windows, you can build profiles from the settings catalog, from templates, from administrative templates (the cloud version of Group Policy), or from custom OMA-URI settings. You can import ADMX files for settings that Windows does not include, and use Group Policy analytics to see which on premises Group Policy settings can move to Intune.

How it works

Profile types for Windows

You create profiles under Devices, Windows, Configuration, Create, New policy, and choose the platform (Windows 10 and later) and the profile type.

Prefer the settings catalog: it covers more settings, shows the supported OS and avoids the confusion of overlapping templates. Many older templates are being deprecated. Use custom OMA-URI only when no setting exists. Because the CSP path is typed by hand, errors fail silently, so check the profile status.

Administrative templates and ADMX import

Administrative templates list thousands of Windows, Microsoft Edge and Office policies, grouped into Computer configuration (applied to the device) and User configuration (applied to the user). Settings are Enabled, Disabled or Not configured.

To manage a third party or custom ADMX setting (Chrome, Firefox, a business app):

1. Go to Devices, Manage devices, Import ADMX.
2. Upload the ADMX file and its matching ADML language file.
3. After the import is Available, the new settings appear in the settings catalog and administrative templates.

Only the settings must be supported by Windows' ADMX ingestion (policies that edit the registry under the supported hives). The imported ADMX is in the tenant, and settings apply to Windows devices.

Group Policy analytics

Group Policy analytics helps you migrate from Group Policy. It reads an exported GPO and reports which settings Intune can deliver.

1. In the Group Policy Management Console, export a GPO as an XML report (Save Report).
2. In Intune, go to Devices, Manage devices, Group Policy analytics, and Import the XML.
3. Read the report: for each setting, whether it has MDM support, whether it is deprecated, and its value. A summary shows the percentage of settings that Intune supports.
4. Use Migrate to build a settings catalog policy from the supported settings, then test and assign it.

The tool does not change the GPO, and it only sees the settings in the file. Settings with no MDM equivalent need a different approach, such as a script or an ADMX import.

Targeting and conflicts

Assign profiles to groups, and use assignment filters to narrow the target. When several profiles set the same setting to different values, the device reports a conflict and the setting may not apply. Check the profile's Per setting status. Settings from compliance policies override configuration policies. If Group Policy and MDM both set a setting on a hybrid device, the MDMWinsOverGP policy can make MDM win.

Profiles apply at enrollment and then at check in. Windows devices sync every 8 hours or so, and a Sync remote action forces it. Deleting a profile removes most settings the profile applied, though some stick (they only reset when changed).

A worked scenario

A company is moving from Group Policy to Intune. The admin exports the main GPOs, imports them into Group Policy analytics and sees that 78 percent of the settings have MDM support. She selects Migrate to create a settings catalog policy for the supported ones. The company uses Google Chrome, so she imports the Chrome ADMX and ADML files and configures its homepage and extension rules in the settings catalog. A legacy tool that only has a registry key is handled with a custom OMA-URI.