Configure Windows Devices with Intune

What are device configuration profiles?

Profile types for Windows

Profile Type	What It Configures	Example
Settings Catalog	5000+ individual settings, searchable	Disable camera, set wallpaper, configure Windows Update
Templates	Pre-built configurations for common scenarios	Device restrictions, Wi-Fi, VPN, email, PKCS certificate
ADMX import	Group Policy settings imported as ADMX/ADML files	Office policies, Chrome settings, third-party app settings
Custom (OMA-URI)	Direct CSP (Configuration Service Provider) access	Advanced settings not available in the UI

Settings Catalog vs Templates

Feature	Settings Catalog	Templates
Number of settings	5000+ (and growing)	Limited to template scope
Searchable	Yes — search by keyword	Browse by category
Granularity	Individual settings picked one by one	Pre-grouped settings
Conflict detection	Better — per-setting conflict reporting	Profile-level conflict reporting
Recommended by Microsoft	Yes — the future of profile configuration	Still supported but not preferred for new configs
Best for	New configurations, granular control	Quick setup of common scenarios (Wi-Fi, VPN)

Key exam concept: Microsoft recommends the Settings Catalog for new configurations. Templates are still valid but the Settings Catalog offers more settings, better conflict detection, and is actively expanded.

Importing ADMX files

Group Policy admins migrating to Intune often need settings that exist in ADMX templates but aren’t yet in the Settings Catalog. Intune lets you import custom ADMX/ADML files.

How it works

1. Intune admin center → Devices → Configuration → Import ADMX
2. Upload the .admx file (settings definitions) and .adml file (language strings)
3. Create a profile → select “Imported Administrative templates”
4. Configure settings from the imported template
5. Assign to device groups

Common ADMX imports

ADMX Source	Settings Available
Microsoft Office	Office telemetry, macro security, update settings
Google Chrome	Homepage, proxy, extension management
Microsoft Edge	Startup pages, password manager, sync settings
Custom LOB apps	Any application that publishes ADMX templates

💡 Exam tip: ADMX import vs Settings Catalog

Many settings that previously required ADMX import are now available natively in the Settings Catalog. Before importing ADMX files, check the Settings Catalog first — it’s cleaner and easier to manage.

The exam may ask when ADMX import is necessary: for third-party application settings (Chrome, custom LOB apps) or legacy GPO settings not yet in the Settings Catalog.

Built-in Windows and Edge ADMX templates are already available in Intune without importing.

Group Policy analytics: assess before migrating

Importing ADMX files adds policy definitions. Group Policy analytics answers a different question: which settings in an existing on-premises GPO have a supported MDM equivalent?

1. In Group Policy Management, save a GPO report as XML.
2. Import the XML into Intune’s Group Policy analytics.
3. Review MDM support, unsupported or deprecated settings, and the individual setting mappings.
4. Migrate the supported settings into a Settings Catalog policy, review the result, and assign it to a pilot group.
5. Check per-setting device results and resolve conflicting GPO/MDM sources before expanding deployment.

Worked choice: A team has 60 configured GPO settings and wants to know which can move to Intune. Import the GPO report into analytics; uploading ADMX/ADML files alone will not assess those 60 configured settings. A high support percentage is not permission to deploy blindly: unsupported settings still need a decision.

Source: Import and analyse group policies in Intune.

Windows settings backup and restore (formerly Windows Backup for Organizations): backup and restore are separate settings

This feature restores supported Windows user settings on a new or reimaged device. It is not a full disk image and does not replace a separate plan for user files and application deployment.

1. Create a Windows 10 and later > Settings Catalog policy. Under Sync your settings, enable Enable Windows backup and assign it to the intended group.
2. Separately open Devices > Enrollment > Windows > Windows Backup and Restore and enable Show restore page.
3. Check supported Windows builds and join types. Backup supports eligible Entra-joined or hybrid-joined devices; restore requires an eligible Microsoft Entra joined device and an existing backup profile.
4. Pilot with a user who has a backup. Check the device’s enrollment report for the Windows Backup and Restore profile result.

The restore-page setting is tenant-wide, not a group-scoped equivalent of the backup policy. Shared/userless devices and self-deploying Autopilot are not a supported restore path. If using Autopilot for this restore experience, use the supported user-driven flow.

Knowledge Check

A backup policy is assigned to pilot users, but a pilot user sees no restore page on a supported new Entra-joined laptop. What configuration should the administrator check next?

AWhether Show restore page is enabled in Windows Backup and Restore, and whether the user has an existing backupBWhether the device is in self-deploying mode, which is required for restoreCWhether all GPOs have been imported as ADMX filesDWhether a full disk image was uploaded to Intune

Check Answer

Source: Enable Windows Backup for Organizations.

Windows 11 Enterprise multi-session

Windows 11 Enterprise multi-session is a special edition designed for Azure Virtual Desktop (AVD) that allows multiple users to sign in simultaneously — like a terminal server. Intune can manage these VMs with specific considerations.

Key differences from standard Windows 11

Aspect	Windows 11 (standard)	Windows 11 Enterprise multi-session
Users per device	1 at a time	Multiple concurrent users
Primary use	Physical PCs, Cloud PCs	AVD session hosts
Intune enrollment	Standard auto-enrollment	Requires specific enrollment config
Profile targeting	User or device profiles	Device profiles only (user profiles may not apply correctly)
Available settings	Full Settings Catalog	Subset — some settings are per-machine only

ℹ️ Deep dive: targeting multi-session VMs

When creating profiles for multi-session VMs:

• Use device-based configuration profiles (not user-based)
• Some user-scoped settings may not apply because multiple users share the device
• Use filters to target multi-session VMs specifically (filter by OS edition)
• Security baselines are supported but verify compatibility with multi-session

Sam at Tui Solutions uses multi-session VMs for the warehouse team — 30 warehouse workers share 10 AVD session hosts. He creates a device-targeted profile that configures Wi-Fi, disables USB storage, and locks down the desktop.

Assignment filters

Filters let you refine which devices within a group actually receive a profile. Instead of creating dozens of groups, you use one broad group plus filters.

How filters work

1. Create a filter rule based on device properties (OS version, manufacturer, model, enrollment type)
2. When assigning a profile, add a filter in “Include” or “Exclude” mode
3. Intune evaluates the filter at assignment time — only matching devices get the profile

Filter examples

Filter Name	Rule	Purpose
Windows 11 only	(device.osVersion -startsWith "10.0.22")	Target only Windows 11 devices
HP laptops	(device.manufacturer -eq "HP")	Apply HP-specific driver settings
Corporate-owned	(device.deviceOwnership -eq "Company")	Exclude BYOD devices
Not Cloud PC	(device.model -ne "Cloud PC")	Skip Windows 365 Cloud PCs

Filters vs groups

Approach	When to Use
Groups	Primary targeting mechanism — who gets the policy
Filters	Secondary refinement — within that group, which devices specifically
Groups + Filters	Powerful combination: “All corporate devices” group + “Windows 11 only” filter

Key exam concept: Filters do NOT replace groups — they refine group assignments. A profile must be assigned to at least one group; filters narrow the scope within that assignment.

🎬 Video walkthrough

Flashcards

Question

What's the difference between the Settings Catalog and Templates in Intune?

Click or press Enter to reveal answer

Answer

Settings Catalog: 5000+ searchable individual settings, per-setting conflict detection, Microsoft's recommended approach. Templates: pre-grouped settings for common scenarios (Wi-Fi, VPN, email), easier to set up quickly but less granular.

Click to flip back

Question

When do you need to import ADMX files into Intune?

Click or press Enter to reveal answer

Answer

When you need to configure settings for third-party applications (Google Chrome, custom LOB apps) or legacy GPO settings not yet available in the Settings Catalog. Built-in Windows and Edge ADMX templates are already available without importing.

Click to flip back

Question

What's special about configuring Windows 11 Enterprise multi-session devices?

Click or press Enter to reveal answer

Answer

Multi-session VMs (used in Azure Virtual Desktop) require device-based configuration profiles, not user-based. User-scoped settings may not apply correctly because multiple users share the device. Use filters to target multi-session VMs specifically.

Click to flip back

Question

How do assignment filters differ from groups in Intune?

Click or press Enter to reveal answer

Answer

Groups are the primary targeting mechanism (who gets the policy). Filters refine group assignments (within that group, which specific devices). A profile must be assigned to at least one group — filters narrow the scope within that assignment.

Click to flip back

Knowledge Check

Knowledge Check

Sam needs to configure Google Chrome settings (homepage, proxy) on all Tui Solutions Windows devices. The Settings Catalog doesn't include Chrome settings. What should Sam do?

AImport Google Chrome ADMX/ADML files into Intune, then create a profile using the imported templateBUse a custom OMA-URI profile with Chrome CSP settingsCConfigure Chrome via a PowerShell script deployed through IntuneDChrome can't be managed through Intune — use Group Policy instead

Check Answer

Knowledge Check

Sam assigns a device restrictions profile to the 'All Corporate Devices' group. He wants the profile to apply ONLY to Windows 11 devices, not Windows 10. What should he add?

ACreate a separate group for Windows 11 devices and reassignBAdd a compliance policy that blocks Windows 10 devicesCSet the profile to 'Windows 11 only' in the profile settingsDAdd an assignment filter that includes only devices where OS version starts with Windows 11

Check Answer

---

Next up: Config Profiles: Android, iOS & macOS — managing non-Windows devices with platform-specific profiles.