Intune Settings Catalog: Create, Assign and Troubleshoot Windows Policies

Before you begin

This chapter assumes you already have a lab tenant and one Windows 11 test PC enrolled in Intune. All names below are invented for the lab: a device called LAB-WIN11-01, a group called Lab-Pilot-Windows-Devices and so on. Swap in your own.

The point is not Microsoft Edge. Edge just gives us settings that are visible to a human, harmless and easy to undo. What you are practising is the habit that matters in Intune: decide who should receive a policy before deciding what it says, start with one device, then check from both ends (the Intune console and the PC) that it landed.

The Windows settings catalog is a single list of the settings Windows exposes to device management, generated from its configuration service provider (CSP) definitions, including the Group Policy-style administrative templates (ADMX). When you create a settings catalog policy you start empty and add only the settings you want to own. Microsoft's documentation says the policy you create is a device configuration profile, and that it is applied when the device next checks in.

• A Windows 11 PC, enrolled in Intune and joined to Microsoft Entra ID, that you are happy to change. A virtual machine is fine for this chapter.
• An Intune licence for the pilot user, as covered in the licensing chapter of this series. Microsoft's licensing page says an Intune licence is required for any user or device that benefits from the service, and lists the plans that include it. Check your own plan there rather than assuming it.
• For creating and monitoring the policy: an account with at least the Policy and Profile Manager built-in Intune role. For the read-only checks alone, Read Only Operator is enough. For the admin-centre Sync action: Help Desk Operator or higher.
• For creating groups: by default any Entra user can, according to Microsoft's group documentation. Editing someone else's group needs more, such as Groups Administrator.
• For creating the assignment filter: Microsoft's filter article lists signing in as an Intune administrator. Use your lab tenant for this.

Decide who gets the policy before you write it

Every assignment answers two questions: which group of users or devices is the starting audience, and does a filter narrow that audience further? Microsoft describes the Entra group as the limiting group, so you choose the smallest one that does the job. A filter can then include or exclude devices within it based on device properties, but it can never widen the audience.

Device or user group? Microsoft's advice is to assign to a device group when the setting should follow the PC regardless of who signs in, and to a user group when it should follow the person across their devices. The settings in the catalog also carry their own scope: some are tagged (User) or (Device). A device-scoped setting assigned to a user still ends up applying to every user of the PC once that user signs in and a sync happens. A user-scoped setting assigned to a device applies to all users of that device. Matching the group type to the setting scope keeps behaviour predictable.

For this lab we use a static group of devices holding one machine. Static (Assigned) membership has no processing delay, unlike dynamic device groups, which Microsoft warns can lag behind enrolment. We then add an assignment filter for Windows 11 and Entra-joined devices. In a real tenant that filter lets one policy go to a broad group while skipping devices it should not touch, and it is evaluated at check-in rather than waiting on group calculation. An independent practitioner write-up reaches the same split: groups for who owns the rollout, filters for device traits that change.

Two traps worth knowing now. First, excluding the wrong kind of group does not work: Microsoft's support matrix says assigning to a device group while excluding a user group (or the reverse) is not supported, because Intune does not evaluate user-to-device relationships. Second, All devices and All users are one click away and reach every enrolled PC or licensed user in the tenant. Leave them alone until a policy has earned it.

Create the pilot group and the filter

This section changes nothing on any PC. It creates two objects in your tenant that the policy will use shortly. The filter's Preview step is your first proof that targeting is right, so do not skip it.

1. Sign in to the Microsoft Intune admin centre and select Groups, then New group.
2. Set Group type to Security and Membership type to Assigned. Name the group Lab-Pilot-Windows-Devices. Under Members, select No members selected, open the Devices tab, tick your lab PC and choose Select. Keep users and devices in separate groups, because Microsoft warns that mixed groups cause unpredictable policy behaviour. Select Create.
3. Go to Tenant administration, then Assignment filters, then Create. Choose Managed devices.
4. On Basics, name the filter Lab - Windows 11 Entra joined and set Platform to Windows 10 and later. Select Next.
5. On Rules, select Edit in the Rule syntax area and enter the expression below. Windows 11 builds start at 10.0.22000, and Intune still calls Entra-joined devices Azure AD joined in this property, so use that exact value. Select OK.
   textCopy

   (device.operatingSystemVersion -ge 10.0.22000.0) and (device.deviceTrustType -eq "Azure AD joined")

6. Select Preview devices. Your lab PC should be listed. If it is not, look at the device's OS version and join type under Devices, then All devices before touching the rule. Select Next, skip Scope tags, then select Create.

Build the policy with three reversible settings

The three Edge settings are Show Home button on toolbar, Configure the home page URL and Enable favorites bar. You will see two of them with your own eyes in the browser, and all three appear in edge://policy. Setting each one back to its default is trivial.

Heads-up on timing: pressing Create in the final step is what assigns the policy. From that moment the pilot PC will receive it at its next check-in. Nothing else in the tenant is touched, because the group contains one device.

1. In the Intune admin centre select Devices, then Manage devices, then Configuration, then Create, then New policy.
2. Set Platform to Windows 10 and later and Profile type to Settings catalog. Select Create.
3. On Basics, name the policy Lab - Win - Edge basics (pilot) and add a description that says what it is for. Select Next.
4. On Configuration settings, select Add settings. Search for Show Home button on toolbar and tick it. Search for Configure the home page URL and tick it. Search for Enable favorites bar and tick it. These names come from Microsoft's Edge policy documentation. If the picker shows both a plain and a (User) version of a setting, choose the one without (User) so it matches our device group. Close the picker.
5. Set Show Home button on toolbar to Enabled. Set Configure the home page URL to Enabled and enter https://www.bing.com as the URL, which is the example Microsoft's own walkthrough uses. Set Enable favorites bar to Enabled. If the picker added anything else, remove it with the minus icon next to it, because a minus removes the setting from the policy and leaves it unmanaged.
6. Select Next. Leave Scope tags empty and select Next.
7. On Assignments, under Included groups choose Add groups and select Lab-Pilot-Windows-Devices. Then select Edit filter, choose Include filtered devices in assignment, pick Lab - Windows 11 Entra joined and choose Select. If your wizard does not offer Edit filter at this point, finish creating the policy and add it afterwards through Properties, then Assignments, then Edit.
8. Select Next, review the summary and select Create.

Check that the policy actually applied

Check from both ends, because the console and the PC can disagree for a while. A newly enrolled Windows device syncs every few minutes at first, then every 15 minutes for a couple of hours, then roughly every 8 hours. Change-based notifications can take anywhere from immediately to a few hours. If the PC has been enrolled for a while, force a sync instead of waiting; this is a good moment to look at something else for a few minutes.

Reports trail reality. Microsoft notes that the Device assignment status report can take 24 to 48 hours to catch up with assignment or group changes, that filter evaluation results can take up to 30 minutes to appear, and that the per-policy check-in status depends on each device's last check-in. A Pending result straight after saving is normal.

1. In the admin centre, go to Devices, then All devices, select your lab PC and choose Sync, then Yes. On the PC itself, the equivalent is Settings, then Accounts, then Access work or school, select the work account, choose Info, then Sync. The Company Portal app also has Settings, then Sync.
2. On the PC, open Microsoft Edge and go to edge://policy. You should see ShowHomeButton, HomepageLocation and FavoritesBarEnabled listed with the values you set. The toolbar should show a Home button and the favourites bar. If the list looks stale, restart Edge and look again.
3. Optionally, read the registry values Edge policies are stored in. Run this in a normal PowerShell window on the lab PC. It only reads: it needs no administrator rights and changes nothing. You should see ShowHomeButton and FavoritesBarEnabled as 1 and HomepageLocation as your URL. Treat edge://policy as the authoritative view if the two ever differ.
   powershellCopy

   Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' | Select-Object ShowHomeButton, HomepageLocation, FavoritesBarEnabled

4. Back in the admin centre, open Devices, Manage devices, Configuration, then the Policies tab, and select your policy. Under Device and user check-in status you want to see Succeeded for one device. Open Per setting status to see each of the three settings reported individually.
5. Open Devices, then All devices, your PC, then Device configuration. The policy should be listed with a status. Then open Filter evaluation on the same device and confirm your filter shows Match in Include mode. Allow up to 30 minutes for the filter result to appear.

Create a conflict on purpose, then clear it

A conflict happens when different policies set the same setting to different values. In Microsoft's words for configuration profiles, Intune shows the conflict and an administrator has to resolve it manually. The documentation does not promise which value would win, so treat the setting as unreliable until you fix it. Intune does not arbitrate; it files the grievance and waits for you.

Doing this once in a lab is far kinder than meeting it for the first time on a Friday afternoon. The only consequence here is that the Home button setting on your single pilot PC becomes unreliable for a short while.

1. Go to Devices, Manage devices, Configuration. Select the ellipsis next to Lab - Win - Edge basics (pilot) and choose Duplicate. Name the copy Lab - Win - Edge conflict test and save. A duplicate keeps the settings but not the assignments.
2. Open the copy, go to Properties and edit Configuration settings. Set Show Home button on toolbar to Disabled. Use the minus icon to remove the other two settings, so the only overlap is the Home button. Save.
3. Open Properties, then Assignments, then Edit. Add the same Lab-Pilot-Windows-Devices group with the same filter, then Review + save and Save.
4. Sync the lab PC again. On either policy, check Device and user check-in status. The device should now show Conflict for the Home button setting.
5. To find the culprits from the device side, go to Devices, All devices, your PC, then Device configuration, and select the policy row showing Conflict. The next view lists every policy that contains the conflicting setting. Devices, then Monitor, then Assignment failures lists the same problem across the tenant.
6. Decide which policy owns the setting. Here the answer is the first one. Open the conflict test policy, go to Properties, then Assignments, then Edit, remove the group, and save. Sync the PC. After the next check-in the original policy should return to Succeeded. Confirm in edge://policy that ShowHomeButton is back to the value you intended. Console rows can linger for a while after the fix, so judge by the PC first.

If it did not work

Work from the top: is the device in the audience, does the filter match, did the device check in, then what did it report.

• Policy not listed under the device's Device configuration: it is not targeted. Check the device (not just the user) is in the static group and that the filter shows Match under Filter evaluation. Remember a filter cannot add devices that the group does not already contain.
• Filter says No match: re-run Preview devices on the filter and compare the property values Intune holds for the PC. Null values can behave unexpectedly with not-equals operators, so prefer positive matches where you can.
• Stuck on Pending: the PC has not checked in or has not reported back. Sync it. In the Troubleshoot pane under Troubleshooting + support, Microsoft treats a last check-in older than 24 hours as a sign of a device problem.
• Not applicable: the setting is unsupported on that Windows version or edition, or a user-scoped setting arrived before a user was signed in. Microsoft's CSP reference lists version and edition requirements. Early check-ins can also show user-scoped settings this way.
• Error: open the per-device report to see the setting and the error code, then look the code up in Microsoft's documentation.
• Conflict that will not clear: check every place that can configure the same setting, not only the settings catalog. Microsoft lists Group Policy analytics, endpoint security and security baselines as other places policies get created.
• Succeeded in Intune but nothing in edge://policy: restart Edge, then compare with the registry check above. If the registry holds the value and Edge does not show it, you are in Edge territory rather than Intune.
• Need device-side evidence: on the PC go to Settings, Accounts, Access work or school, choose the work account and Info, then Create report and Export. The files land in C:\Users\Public\Documents\MDMDiagnostics; open MDMDiagHtmlReport.html for a summary of MDM configuration and policies. Event Viewer holds the same story under Applications and Services Logs, Microsoft, Windows, DeviceManagement-Enterprise-Diagnostic-Provider, Admin. These reports include management details such as the management URL, device identifiers and certificates, so keep them out of tickets and chat threads.

Optional: export a read-only policy inventory with Microsoft Graph

This is not required to finish the chapter. It gives you a repeatable list of policies to keep alongside your notes. It only reads from Intune and writes one CSV file to the folder you run it from; running it again overwrites that file. The CSV contains your policy names, so handle it like any internal document.

Microsoft Graph is the web API behind the admin centre. The endpoint used here is in the beta version of Graph. Microsoft supports Intune beta APIs but says they change more often than v1.0, so re-check this before relying on it. The signed-in account needs the DeviceManagementConfiguration.Read.All delegated permission, and the first sign-in will ask for consent to it. In some tenants that consent needs an administrator. The list can also include policies from other Intune areas that share the same underlying model, so the script reports the template family too.

1. In PowerShell on your admin workstation, install the Graph authentication module for your own account only. It comes from the PowerShell Gallery, so PowerShell may ask you to confirm trusting that repository.
   powershellCopy

   Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

2. Run the script below. It signs you in interactively, reads every page of results by following the next-page link, and exports selected columns. It stores no secrets or tokens in the file.
   powershellCopy

   Connect-MgGraph -Scopes 'DeviceManagementConfiguration.Read.All' -NoWelcome
   $uri = 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies'
   $policies = @()
   while ($uri) {
       $page = Invoke-MgGraphRequest -Method GET -Uri $uri
       $policies += $page.value
       $uri = $page.'@odata.nextLink'
   }
   $policies | ForEach-Object {
       [pscustomobject]@{
           Name           = $_.name
           Platforms      = $_.platforms
           Technologies   = $_.technologies
           TemplateFamily = $_.templateReference.templateFamily
           SettingCount   = $_.settingCount
           IsAssigned     = $_.isAssigned
           LastModified   = $_.lastModifiedDateTime
       }
   } | Export-Csv -Path .\settings-catalog-policy-inventory.csv -NoTypeInformation -Encoding UTF8
   Disconnect-MgGraph

3. Open the CSV. You should see a row for Lab - Win - Edge basics (pilot) with IsAssigned showing True and a setting count of 3.

Roll back the lab policy and know the limits

Removing a policy does not automatically mean the old behaviour comes back. Microsoft says what happens when a policy is deleted or unassigned depends on the Windows CSP: some remove the setting and some keep it, which is called tattooing. So always confirm on the PC rather than assuming. If a value does stick, Microsoft's assignment documentation describes deploying a replacement policy for it; use that route instead of editing the registry by hand.

What this chapter does not cover: it was written from current Microsoft documentation and has not been run on a real device or a live tenant, so confirm each portal label as you go. It does not cover security baselines, endpoint security policies, compliance policies, update rings, apps, Conditional Access or user-scoped settings in depth, and it is not a production rollout plan. Treat the group, filter and one clean policy as the lab foundation for later chapters. Keep a note of which policy owns which setting; that note becomes your policy register.

1. Delete the conflict test policy if it still exists: Devices, Manage devices, Configuration, ellipsis, Delete.
2. On Lab - Win - Edge basics (pilot) go to Properties, Assignments, Edit, remove the group, then Review + save and Save. Or delete the policy if you do not want to keep it.
3. Sync the PC, then check edge://policy and the Home button and favourites bar. Back to the default means rollback worked. If any setting remains, follow the replacement-policy approach above and check again.