If you cannot control what settings are on every company laptop, you may as well leave the front door unlocked every night. That is the precise problem that managing device configuration profiles solves: it lets an IT administrator remotely enforce settings across hundreds or thousands of devices without touching a single one physically. For the MD-102 exam, this is the bread and butter of endpoint administration — the mechanism that turns chaotic, individual devices into a unified, secure fleet.
Jump to a section
A simple way to picture Managing Device Configuration Profiles
Inside a large office building with hundreds of rented rooms. The building owner, Ms. Chen, wants every room to feel professional and secure without needing to visit each one personally. So she creates a single, laminated "Room Rulebook." This booklet has clear rules: every room must have a working fire extinguisher, all desk drawers must lock automatically after 5 p.m., and every light bulb must be energy-efficient. She doesn't hand out the rulebook to each tenant and hope they follow it. Instead, she places a digital copy of the rulebook in the building's central management system and pushes it to every room's smart keypad. Every time a tenant swipes their keycard to enter, the system checks the room against the rulebook and automatically turns the desk locks on and dims the lights to energy-saving mode. The force of this central rulebook is that it applies instantly to all rooms — new rules take effect the moment she saves them. If a new tenant moves into Room 304, they automatically get the same desk lock and light settings without Ms. Chen writing a new rule. She spends zero time running around the building; she just maintains the rulebook. Managing device configuration profiles in Microsoft Intune works exactly this way: the IT admin writes a single profile (the rulebook) and pushes it to every laptop, phone, or tablet in the company. All devices obey the same security settings without manual tweaking.
The specific force here is that the rulebook is not optional — it is enforced by the central system, just as a configuration profile is enforced by Intune and the device operating system.
Device configuration profiles are the primary tool Microsoft Intune gives you to define and enforce settings on devices you manage. Think of a profile as a digital checklist: it lists every security setting, feature setting, and compliance rule that a device must follow. When you assign a profile to a group of devices, Intune automatically pushes those settings down to each device, where the operating system applies them.
Let's define the key terms clearly. Microsoft Intune is a cloud-based service that manages devices — laptops, phones, tablets — from a central dashboard. A configuration profile is a collection of settings grouped together for a purpose: maybe for all Windows 11 laptops, or for all iOS phones used by sales staff. The profile is stored in the cloud inside Intune. When you assign the profile to a group (for example, a Microsoft Entra ID group containing all marketing users), Intune communicates with each device's operating system to apply those settings. The device checks in with Intune regularly — typically every 8 hours on Windows — and if a new profile is assigned, it downloads and applies it immediately.
Why does this exist? Before Intune and cloud-based endpoint management, an IT department had two choices. They could use Group Policy in an on-premises Active Directory environment — which required the device to be joined to the corporate network and a domain controller to be available — or they could manually configure each device one by one. Both approaches are slow, expensive, and error-prone. Configuration profiles in Intune flip this: they work over the internet from anywhere, require no physical domain join, and apply automatically even if the device is in a coffee shop across the city.
What exactly can a configuration profile control? The options are vast, but the exam focuses on several key categories:
Device restrictions: These control the device's built-in hardware and software behaviours. For a Windows laptop, you can block the use of the camera, turn off the Bluetooth radio, disable the Microsoft Store, or require a password of a minimum length. For an iOS phone, you can prevent the user from changing the wallpaper, disable screenshots, or block specific apps.
Endpoint protection: This category controls security software settings. You can enforce Windows Defender Antivirus to run real-time protection, schedule scans, and set the cloud-delivered protection level. You can also manage Windows Defender Firewall rules, BitLocker encryption for drives, and Windows Hello for Business PIN requirements.
Administrative templates: These are identical to the old Group Policy administrative templates (ADMX files). They allow you to configure hundreds of Windows settings — like the Start menu layout, Lock screen image, or Internet Explorer security zones — using familiar checkboxes. The exam tests that you understand an administrative template is simply a profile type that mirrors classic Group Policy settings.
Custom profiles: For settings not covered by built-in options, you can use Open Mobile Alliance - Device Management (OMA-URI) paths. These are direct configuration paths that Windows, iOS, or Android understand. For example, you might push a specific registry key change to Windows devices using a custom OMA-URI profile.
How does the assignment work? You choose a group of users or devices (via Microsoft Entra ID dynamic groups) and assign the profile. Intune evaluates who is in the group and pushes the settings. You can also filter profiles: for example, assign a profile to all Windows devices but exclude devices running Windows 10 Home edition. You can set dependencies — require that Device A must have a specific security baseline applied before Profile B can install. The exam calls this "co-management" or "feature update policies" in some contexts, but the core is profile assignment and filtering.
The real power is that profiles are versioned. If you update a profile — say, you change the minimum password length from 8 characters to 12 — Intune automatically re-pushes the updated settings to every device assigned to that profile. You never need to touch the devices again. The exam loves testing the concept of profile versioning: the moment you save a change, it increments the version number. Devices detect the new version at their next check-in and apply the update.
One critical nuance is that configuration profiles are separate from compliance policies. A compliance policy is a set of rules that determines whether a device is considered compliant (e.g., has a password, is not jailbroken, is running a minimum OS version). A configuration profile is a set of settings you want applied. The exam expects you to know the difference: compliance policies are about check-and-remediate; configuration profiles are about enforce-and-configure. They often work together — a configuration profile might set the password policy, and a compliance policy then checks that the password is actually in place.
Plan the Profile
Identify the setting you need to enforce. For example, you need all company laptops to have a password longer than 8 characters. Decide the platform (Windows, iOS, Android, macOS). This step determines which profile type you will choose later.
Create the Profile in Intune
Sign into the Microsoft Intune admin centre. Go to Devices -> Configuration profiles -> Create profile. Select the platform (e.g., Windows 10 and later) and the profile type (e.g., Settings catalog for granular settings, or Device restrictions for a quicker group of common settings).
Configure the Settings
Within the profile, search for the specific setting you want — like 'Minimum password length' under the Settings catalog. Toggle it to '8'. Add any other settings you need, such as blocking the camera or requiring BitLocker. Name the profile clearly, e.g., 'Laptop Security Baseline'.
Assign the Profile to a Group
Select the Microsoft Entra ID group containing the devices or users who should receive this profile. You can use dynamic groups to automatically include devices matching certain criteria (e.g., all Windows devices). Optionally, set assignment priority to avoid conflicts with other profiles.
Monitor and Remediate
After assignment, check the profile's Device status report in Intune. Look for devices marked 'Succeeded' or 'Error'. If errors appear, investigate the error code — common causes include unsupported OS editions. Adjust the profile or exclude the failing device from the assignment. Force a sync on the device if needed.
Update and Maintain
When business requirements change, edit the existing profile. Add or remove settings, then save. Intune increments the version and pushes the update automatically to all assigned devices. Review profiles regularly to remove old ones that are no longer needed.
Let's walk through a realistic scenario at a mid-sized company called "NorthStar Logistics" with 500 employees spread across five cities. None of the employees have IT backgrounds. The company has a mix of Windows 11 laptops, iPhones for sales staff, and some Android tablets used in the warehouse. The IT team consists of two people, Jake and Priya. They are studying for their MD-102 exam and building their first Intune environment.
Jake and Priya's first task is to create a device configuration profile for all company laptops. They open the Microsoft Intune admin centre, browse to Devices -> Configuration profiles, and click "Create profile." They select the platform "Windows 10 and later" and the profile type "Settings catalog" — this is the modern way to choose individual settings from a huge library. They search for "Camera" and find the setting "Allow Use of Camera." They set it to "Block." They add a setting to require a password with a minimum length of 8 characters, and another to disable the Microsoft Store from installing apps without approval. They name it "NorthStar Laptop Security Profile."
The next step is assignment. Jake creates a Microsoft Entra ID group called "NorthStar Windows Laptops" with a dynamic membership rule that includes any device with a device model that starts with "Latitude" or "ThinkPad" — the two brands they use. They assign the profile to this group. Within 15 minutes, every laptop in the company gets the new settings. The warehouse manager calls to say his laptop's camera icon is greyed out. Jake confirms the profile is working.
Now, the sales team uses iPhones. The sales manager is concerned about data leakage because reps often show client presentations from their phones. Priya creates a second profile, this time for iOS. She selects platform "iOS/iPadOS" and profile type "Device restrictions." She finds settings to disable screenshots, prevent the use of AirDrop to unknown contacts, and require device encryption. She also enables "Managed open in" — this prevents a user from opening a company file in an unapproved app (like a personal Dropbox). She assigns this profile to a dynamic group called "Sales iPhones" that includes all iPhones enrolled into Intune via Automated Device Enrollment.
The exam also covers monitoring profiles. Jake and Priya can see the report "Device status" for each profile. If a device fails to apply a setting (for example, a Windows device running a Home edition that cannot accept BitLocker settings), Intune reports a conflict or error. Priya learns she can filter by "Succeeded" or "Error" and drill into the specific device. She then writes a PowerShell script to run as a remediation — a newer feature called proactive remediations that can fix the error automatically.
Six months later, the company adds a new policy: all laptops must have BitLocker encryption enabled. Jake edits the existing laptop profile, adds the BitLocker settings, and saves. The profile version increments automatically. Every laptop checks in within a few hours and begins the encryption process. No one on the IT team has to visit a single laptop. This is the daily reality for an endpoint administrator: they write profiles, assign them, monitor success, and adjust. The MD-102 exam tests not just the creation steps but the troubleshooting and remediation workflows an admin uses to ensure profiles apply correctly.
The MD-102 exam will test your understanding of device configuration profiles in several distinct ways. Expect at least 10-15 questions on this topic, making it one of the most heavily weighted sections. The exam uses single-answer multiple choice, case studies, and sometimes drag-and-drop ordering.
The exam loves to test the difference between profile types. You must memorise which settings go where. Here are the key types they ask about:
Settings catalog: This is the newer, preferred method for Windows 10/11 devices. It contains thousands of individual settings you can toggle. The exam will ask you to identify a scenario where you should use Settings catalog instead of a Device restrictions profile because it offers more granularity.
Device restrictions: This is the older but still used profile type. It groups common settings like password, camera, Bluetooth, and storage. The exam will present a scenario and ask you to choose the correct profile type — if the scenario involves blocking a hardware feature like the camera, Device restrictions is the right answer.
Administrative templates: These are for Windows settings that were traditionally managed by Group Policy (ADMX files). The exam will test you that administrative templates are equivalent to importing Group Policy settings into Intune. A common trap is that they present a scenario asking for a setting that exists in an ADMX file and ask you to choose a different profile type — the correct answer will always be Administrative templates when the setting originates from a Windows Group Policy template.
Endpoint protection: This covers antivirus, firewall, BitLocker, and Windows Defender Credential Guard. The exam will test that you cannot configure BitLocker settings in a Device restrictions profile; you must use an Endpoint protection profile.
Another key exam area is assignment and filtering. The exam will present a scenario where you have two profiles with conflicting settings — for example, Profile A blocks the camera, Profile B allows the camera — and both are assigned to the same device. Intune resolves conflicts by priority. The profile with the highest assignment priority wins. You must remember that assignment priority is set manually by the admin. The default priority is 1 (highest) to any number (lower). The exam loves a trap: asking what happens when two profiles have the same priority. The answer is that Intune resolves it non-deterministically — it can pick either setting, so you should avoid duplicate priorities.
The exam also tests profile versioning. Expect a question like: "An admin updates a configuration profile but some devices have not received the change. What is the most likely cause?" The correct answer is that the device has not checked in with Intune yet. Devices check in every 8 hours by default, or on restart. The admin can also send a sync command from the Intune admin centre to force a check-in. The trap answer is "the profile is not assigned to the correct group" — but if the device already had the old profile, it is in the group.
Another exam favourite is the difference between a configuration profile and a compliance policy. They will ask: "You need to ensure a device must have a password before it can access company email. Which should you use?" The answer is a compliance policy, because compliance policies block access. A configuration profile merely sets the password requirement but does not block access if the user bypasses it. The exam will trick you by asking for "enforce" vs. "check."
Finally, the exam tests whether you can identify the correct platform. If the question mentions Windows 365 Cloud PCs, you use a Windows configuration profile. If it mentions macOS, use a macOS profile. Never mix platforms. The exam will give a scenario with iOS devices and a setting that only exists on Windows to see if you choose the wrong profile type.
Memorise this: profile types map to platforms. Device restrictions exist for Windows, iOS, Android, and macOS separately. Settings catalog is only for Windows. Administrative templates are only for Windows. Endpoint protection for Windows. Do not cross platforms.
A device configuration profile is a collection of settings pushed remotely from Microsoft Intune to a group of devices.
Profile types include Settings catalog, Device restrictions, Administrative templates, Endpoint protection, and Custom (OMA-URI).
Devices check in with Intune approximately every 8 hours; profiles are applied after the next check-in or a forced sync.
Updating a profile increments its version and automatically re-pushes settings to all assigned devices.
When two profiles conflict, the one with the highest assignment priority wins; avoid duplicate priorities.
Configuration profiles enforce settings; compliance policies check if rules are met and can block access.
Profiles are platform-specific — a profile created for Windows cannot apply to iOS or Android devices.
You can monitor profile deployment status in Intune using the Device status report and remediate errors by adjusting assignments or settings.
These come up on the exam all the time. Here's how to tell them apart.
Configuration Profile
Enforces settings on the device (e.g., sets password length)
Does not block access to resources
Applied continuously; device follows the rules
Compliance Policy
Checks whether settings are in place (e.g., checks password length meets requirement)
Can block access to company email or apps if not compliant
Remediation actions (e.g., send notification) triggered only on check
Settings Catalog
Available only for Windows 10/11 devices
Contains thousands of individual settings you can search and toggle
More granular; can control obscure registry-like settings
Device Restrictions
Available for Windows, iOS, Android, and macOS
Groups common settings into categories (e.g., Password, Camera, Bluetooth)
Less granular; only includes predefined setting categories
Administrative Templates (ADMX)
Mirrors classic Group Policy settings
Controls Windows-specific settings like Start menu layout, Explorer settings
Requires importing ADMX files or using built-in templates
Endpoint Protection Profile
Focuses on security: antivirus, firewall, BitLocker, Credential Guard
Only for Windows devices
Contains settings that affect Microsoft Defender and security policies
Dynamic Group (Microsoft Entra ID)
Membership automatically updates based on rules (e.g., all devices with 'Latitude')
Profile applies automatically when a new device joins the group
No manual effort to add/remove devices
Static Group (Microsoft Entra ID)
Membership is manually maintained by an admin
Must add/remove each device individually
Profile applies only to devices explicitly added
Mistake
A configuration profile and a compliance policy are the same thing.
Correct
A configuration profile enforces settings on the device. A compliance policy checks if the device meets rules and can block access if it does not.
Both are created from the same Intune menu and both apply to devices, so beginners assume they are interchangeable.
Mistake
Once I assign a profile, it applies instantly to all devices.
Correct
Devices check in with Intune periodically (every 8 hours on Windows). A sync can be forced manually from the admin centre or the device.
Cloud services feel instant, so beginners think the push is real-time. The check-in cycle is a fundamental delay they often overlook.
Mistake
If I update a profile, I need to reassign it to the group.
Correct
Updating a profile automatically increments its version, and Intune pushes the new settings to all assigned devices on their next check-in.
This mirrors a misunderstanding of version control — beginners think a change requires starting over.
Mistake
A custom profile using OMA-URI is only for advanced users and is rarely used.
Correct
Custom OMA-URI profiles are common for settings not available in the Settings catalog or Device restrictions, such as specific registry or plist values.
The name 'custom' sounds like an edge case, so beginners ignore it. But the exam tests it because it fills gaps in the built-in profile types.
Mistake
If a device shows an error on a profile, the only option is to delete and recreate the profile.
Correct
You can check the device status report to find the specific error (e.g., setting not supported on that OS version) and adjust the profile or exclude the device.
Beginners panic at 'error' and think the approach must be scrapped, rather than understanding that remediation often means refining the assignment.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A configuration profile enforces settings onto a device (e.g., set password length to 8). A compliance policy checks whether those settings are in place and can block access to company resources if not.
From the Intune admin centre, go to the device, select it, and click 'Sync'. This sends a command to the device to check in immediately rather than waiting for the next scheduled check-in (typically every 8 hours).
Intune resolves conflicts based on assignment priority. The profile with the highest priority (lowest number) wins. If they have equal priority, the result is non-deterministic, so you should avoid creating conflicting profiles with the same priority.
No. Configuration profiles are platform-specific. You must create separate profiles for each device platform (Windows, iOS, Android, macOS). The profile type options change based on the platform you select at creation.
The Settings catalog is a profile type for Windows 10 and later devices that lets you search and toggle thousands of individual settings — more granular than Device restrictions. Use it when you need a specific setting that is not grouped in Device restrictions.
Check the profile version in Intune — it should have incremented. Then confirm the devices are still assigned to the group. Finally, force a sync on the device or wait for the next check-in (up to 8 hours). The update does not happen instantly.
You've finished Managing Device Configuration Profiles. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?