Month 2: One setting, every device

Profile types

A configuration profile pushes settings to devices. For Windows, the settings catalog is the main tool: thousands of settings you search and pick, generated from Windows configuration service providers (CSPs). Templates group common jobs: Wi-Fi, VPN, certificates, Delivery Optimization, Domain Join, kiosk, custom OMA-URI. Administrative templates (ADMX) are in the settings catalog too.

Exam tip First choice on the exam for most Windows settings: settings catalog. Custom OMA-URI only when nothing else exposes the setting.

Importing custom ADMX files

Some apps ship their own Group Policy templates (an ADMX file plus a language ADML file). Upload them under Devices > Configuration > Import ADMX, uploading any ADMX they depend on first. Then create a profile with the Imported Administrative templates type and configure the app's settings like any other policy.

Import ADMX
 1. kibblepos.admx  + en-US\kibblepos.adml
 2. Status: Available
Create profile > Windows 10 and later
 > Templates > Imported Administrative
   templates

Group Policy analytics

Group Policy analytics shows how your GPOs translate. Export each GPO as XML from the Group Policy Management Console and import it under Devices > Group Policy analytics. The report shows the MDM support percentage and which settings have a matching CSP, which are deprecated and which have no MDM equivalent. You can then migrate supported settings into a settings catalog policy.

Exam tip Settings with no MDM equivalent need a different approach: a script, a remediation, or dropping the setting.

Android Enterprise profiles

Android profiles depend on the enrollment type. Fully managed, dedicated and corporate-owned work profile devices get device restrictions (camera, screen capture, system updates, kiosk mode for dedicated devices), Wi-Fi, VPN and certificates. Personally owned work profile devices get settings that apply inside the work profile only. OEMConfig profiles carry vendor settings, such as Zebra's or Samsung's.

Exam tip Kiosk mode (single app or multi-app) is a dedicated-device setting. You won't find it for BYOD work profiles.

iOS/iPadOS and macOS profiles

iOS/iPadOS: device restrictions (many need a supervised device from ADE), device features (home screen layout, wallpaper, AirPrint), Wi-Fi, VPN, email, and the settings catalog, including Apple's declarative device management (DDM) settings. macOS: settings catalog, device restrictions, extensions, privacy permissions, Platform SSO, shell scripts and custom .mobileconfig files.

Exam tip "Setting needs a supervised iPad" means the iPad must come through Automated Device Enrollment (or Apple Configurator).

Specialty devices

Microsoft Teams Rooms on Windows are Windows devices: enroll them (often with Autopilot self-deploying) and target device-based profiles. HoloLens 2 runs Windows Holographic for Business: enroll through Autopilot for HoloLens and use Windows profiles that support Holographic. Zebra Android devices enroll as dedicated or fully managed, and Zebra's own settings arrive through the Zebra OEMConfig app.

Exam tip Intune's specialty device management (Plan 2 or Suite) covers AR/VR headsets, large smart screens and some meeting room devices.

Include, exclude and conflicts

Assign a profile to included groups and optionally excluded groups. Don't mix user and device groups across include and exclude. If two profiles set the same setting to different values on one device, the report shows Conflict and the device may keep an older value. Fix it by removing the duplicate setting.

Exam tip A Conflict status is never fixed by waiting. One setting, one source of truth.

Assignment filters

An assignment filter narrows a group assignment by device properties. Intune checks the filter when the device checks in, so you don't wait for group membership to update. A filter is Include or Exclude and uses rules like device.model, device.manufacturer, device.osVersion, device.deviceName, device.deviceOwnership or device.enrollmentProfileName.

Filter: KC-POS-Terminals (Windows)
(device.deviceName -startsWith
   "KC-PC-POS")

Assignment: All devices
  Filter mode: Exclude
  Filter: KC-POS-Terminals

Exam tip "All devices except" or "only one model, quickly" = filter. "Use the same set for Conditional Access too" = group.

Enrollment time grouping

With enrollment time grouping, the device is added to a chosen static device group during enrollment, so the policies and apps assigned to that group arrive while the device is still setting up. Autopilot device preparation uses it. Dynamic groups can take minutes or longer to pick up a new device, which is too late for setup.

Exam tip Dynamic group = membership updates eventually. Enrollment time grouping = member from the first minute.