July 5, 2024
This repository houses prebuilt Microsoft Intune configuration profiles in JSON format for Windows 10 and Windows 11 that can be imported into Microsoft Intune. (https://intune.microsoft.com).
The profiles are all configured using OMA-URI. There are a few reasons for this approach:
A lot of the OMA-URIs in these configuration profiles are not published by CIS. The OMA-URIs were found here: https://learn.microsoft.com/en-us/windows/client-management/mdm/
Some configuration options were found by finding corresponding ADMX Group Policy files and locating their xml element ids. These are specified using the SyncML syntax as documented here: https://learn.microsoft.com/en-us/windows/client-management/understanding-admx-backed-policies#enabling-a-policy
If you need to implement your own configurations, open the admx file (located at C:\windows\policydefintions) and locate the policy and the corresponding element you want to configure and follow the
To import a profile:
NOTE: To use the new Import script, you may need to "Approve" the requested app access. This is done in the Azure Portal under Enterprise Applications -> Admin consent Requests
New script added July 5, 2024 with multiple audit results.
The Windows 10 template has a few gaps that I have addressed manually in my environment. Please refer to the Audit results to to see if there's anything you should address. This configuration is currently running in an active production environment without any issue.
To verify a configuration applied:
Open Event Viewer on the machine the configuration was deployed to
Open "Application and Services Logs"\Microsoft\Windows\DeviceManagement-Enterprise-Diagnostics-Provider\Admin"
Review any entries with "Error"
Intune remediation failures for User Rights Assignment policies that apply a blank value. (2.2.1 through 2.2.30)
Firefox can be a pain to work with OMA-URIs. I created a stylesheet to make it a lot easier and that can be seen in the screenshot above. To install, go into the "Extras" folder for instructions.