Intune tenants rarely break all at once. They drift. One admin builds a BitLocker policy in endpoint security, another adds the same settings to a security baseline a year later, and a contractor imports an old Group Policy into the settings catalog. Each change looks fine on its own. Together they create Intune policy conflicts, and conflicting settings often do not apply at all. That is how a device you believe is encrypted ends up not encrypted.
This guide explains how Intune handles conflicts, where to see them, and a repeatable process for cleaning them up. It applies to any tenant using Intune Plan 1, which is included in Microsoft 365 Business Premium, E3 and E5.
How Intune decides which setting wins
Intune has no hierarchy like Group Policy’s local, site, domain and OU order. Policies are assigned to groups, and when two policies touch the same setting on the same device, the outcome depends on the policy type:
Situation
What happens
Compliance policy vs configuration policy on the same setting
The compliance policy value takes precedence.
Two compliance policies on the same setting
The most restrictive value applies.
Two configuration policies with different values
A conflict is reported. The setting may not apply. You must resolve it manually.
Two app protection policies with different values
The most restrictive value generally applies, with some exceptions for numeric fields.
Two policies with the same value
No conflict. The setting applies.
The third row is the dangerous one. “Configuration policy” here includes settings catalog profiles, templates, endpoint security policies and security baselines. They are all different screens that write to the same settings underneath.
Where conflicts usually come from
In the tenants I review, the same sources come up repeatedly:
Baselines plus endpoint security policies. A security baseline configures Defender, BitLocker and firewall settings, and so do the dedicated endpoint security policies. Microsoft’s own guidance is to use one or the other for a given setting, not both.
Old templates next to new settings catalog profiles. Someone rebuilt a device restrictions profile in the settings catalog but left the old template assigned.
Group Policy migration. Imported GPOs often duplicate settings that are already in Intune.
Overlapping groups. A device sits in “All Windows devices” and in “Finance laptops”, and each group has its own version of the same policy.
Multiple admins without a naming standard. Nobody can tell which policy is current.
How to find conflicts
Intune gives you several places to look, from tenant-wide to single setting.
Tenant-wide: assignment failures
Start at Devices > Monitor > Assignment failures. Any configuration policy that failed because of an error or conflict appears here. Select a policy to see affected devices, then a device to see the failing setting.
Per policy: per-setting status
Open a settings catalog policy at Devices > Manage devices > Configuration, select it, and use the per-setting status view. It shows how many devices succeeded, are in conflict or are in error for every setting in the policy. Security baselines have the same view under Endpoint security > Security baselines > (baseline) > Profiles > (profile) > Per-setting status.
Per device: source profiles
For a single device, go to Devices > All devices > (device) > Device configuration and open a policy in conflict. Selecting a setting shows its state and the list of source profiles that configure it. That list is the fastest way to identify the two policies fighting over a setting.
If you use Microsoft Copilot in Intune, it can summarize a policy and point out potential conflicts. It is a useful shortcut, but confirm what it tells you in the reports before you change anything.
A cleanup process that sticks
Fixing conflicts one at a time just moves the problem. This process fixes the cause.
Export your policy inventory. List every configuration, endpoint security, baseline and compliance policy with its type, assignment and last modified date.
Decide one owner per setting area. For example: BitLocker lives only in endpoint security disk encryption, Defender antivirus lives only in endpoint security antivirus, everything else lives in the settings catalog. Write it down.
Remove duplicates from the losing policies. Edit the policy that is not the owner and remove the overlapping settings. Do not leave them set to the same value “to be safe”. The next edit will reintroduce the conflict.
Retire unused policies. Unassigned policies cause no conflict, but they confuse the next admin. Delete them after exporting a copy.
Simplify assignments. Prefer broad groups plus assignment filters over many overlapping groups.
Adopt a naming standard, such as WIN-ES-BitLocker-Prod or MAC-SC-Restrictions-Pilot, so the platform, policy type and purpose are obvious.
Re-check per-setting status after a sync cycle and confirm conflicts have cleared.
Do not forget Group Policy
On hybrid joined or co-managed Windows devices, Group Policy and Intune can both configure the same setting. That conflict does not show in Intune reports, because Intune only sees its own policies. For many settings delivered through the Policy CSP, you can set MDM Wins Over GP in the settings catalog under the Control Policy Conflict category, so Intune takes precedence. Check Microsoft’s documentation for which settings it covers, and still plan to remove overlapping GPOs as you move to cloud management.
Stop drift from coming back
Change control. Require a ticket or note for every policy change. Intune audit logs record who changed what, but not why.
Multi Admin Approval. Protect settings catalog and compliance policies so a second admin reviews changes.
Monthly review. Check assignment failures and baseline per-setting status as part of a monthly routine.
Configuration backup. Export policies regularly with the Microsoft Graph API or a backup tool so you can compare versions and roll back.
What happens when two Intune configuration policies set different values?
Intune reports the setting as a conflict and it may not be applied to the device. You need to remove or change one of the policies so only one value is configured.
Can I use security baselines and endpoint security policies together?
Yes, but not for the same settings. Microsoft recommends using either a baseline or an endpoint security policy for a given setting, or assigning them to different device groups.
Does a conflict mean the device is unprotected?
Possibly. A conflicting setting might keep a previous value or not be applied at all. Treat conflicts on security settings such as encryption, firewall or antivirus as urgent.
Not sure whether your Intune policies are fighting each other? Book a free Microsoft 365 security assessment and we will check your configuration for conflicts and drift.
Intune tenants rarely break all at once. They drift. One admin builds a BitLocker policy in endpoint security, another adds the same settings to a security baseline a year later, and a contractor imports an old Group Policy into the settings catalog. Each change looks fine on its own. Together they create Intune policy conflicts, and conflicting settings often do not apply at all. That is how a device you believe is encrypted ends up not encrypted.
This guide explains how Intune handles conflicts, where to see them, and a repeatable process for cleaning them up. It applies to any tenant using Intune Plan 1, which is included in Microsoft 365 Business Premium, E3 and E5.
How Intune decides which setting wins
Intune has no hierarchy like Group Policy’s local, site, domain and OU order. Policies are assigned to groups, and when two policies touch the same setting on the same device, the outcome depends on the policy type:
The third row is the dangerous one. “Configuration policy” here includes settings catalog profiles, templates, endpoint security policies and security baselines. They are all different screens that write to the same settings underneath.
Where conflicts usually come from
In the tenants I review, the same sources come up repeatedly:
How to find conflicts
Intune gives you several places to look, from tenant-wide to single setting.
Tenant-wide: assignment failures
Start at
Devices > Monitor > Assignment failures. Any configuration policy that failed because of an error or conflict appears here. Select a policy to see affected devices, then a device to see the failing setting.Per policy: per-setting status
Open a settings catalog policy at
Devices > Manage devices > Configuration, select it, and use the per-setting status view. It shows how many devices succeeded, are in conflict or are in error for every setting in the policy. Security baselines have the same view underEndpoint security > Security baselines > (baseline) > Profiles > (profile) > Per-setting status.Per device: source profiles
For a single device, go to
Devices > All devices > (device) > Device configurationand open a policy in conflict. Selecting a setting shows its state and the list of source profiles that configure it. That list is the fastest way to identify the two policies fighting over a setting.If you use Microsoft Copilot in Intune, it can summarize a policy and point out potential conflicts. It is a useful shortcut, but confirm what it tells you in the reports before you change anything.
A cleanup process that sticks
Fixing conflicts one at a time just moves the problem. This process fixes the cause.
WIN-ES-BitLocker-ProdorMAC-SC-Restrictions-Pilot, so the platform, policy type and purpose are obvious.Do not forget Group Policy
On hybrid joined or co-managed Windows devices, Group Policy and Intune can both configure the same setting. That conflict does not show in Intune reports, because Intune only sees its own policies. For many settings delivered through the Policy CSP, you can set MDM Wins Over GP in the settings catalog under the Control Policy Conflict category, so Intune takes precedence. Check Microsoft’s documentation for which settings it covers, and still plan to remove overlapping GPOs as you move to cloud management.
Stop drift from coming back
If your tenant has grown through several admins and projects, an Intune health check is the quickest way to map overlaps. Our endpoint security baseline service rebuilds security settings with one owner per area, and the Intune managed service keeps them that way.
Frequently asked questions
What happens when two Intune configuration policies set different values?
Intune reports the setting as a conflict and it may not be applied to the device. You need to remove or change one of the policies so only one value is configured.
Can I use security baselines and endpoint security policies together?
Yes, but not for the same settings. Microsoft recommends using either a baseline or an endpoint security policy for a given setting, or assigning them to different device groups.
Does a conflict mean the device is unprotected?
Possibly. A conflicting setting might keep a previous value or not be applied at all. Treat conflicts on security settings such as encryption, firewall or antivirus as urgent.
Microsoft explains conflict handling in Common questions and answers with policies and profiles in Intune.
Not sure whether your Intune policies are fighting each other? Book a free Microsoft 365 security assessment and we will check your configuration for conflicts and drift.