Manage and maintain devices
Configuration versus compliance
Two policy families do different jobs. Configuration profiles (settings catalog, templates such as administrative templates, Wi-Fi/VPN, custom OMA-URI) change device state. Compliance policies evaluate state and drive Conditional Access; they do not fix a device. A device must satisfy every compliance policy assigned to it, while conflicting configuration settings surface as a conflict on the setting itself.
Targeting and lifecycle
Assign to Microsoft Entra groups, refine with filters, and delegate with Intune RBAC roles and scope tags. Dynamic groups require Microsoft Entra ID P1. Remote actions matter: retire removes company data only, wipe resets the device, Fresh Start reinstalls Windows, and Autopilot reset returns a device to a business-ready state while keeping enrollment. Configure device cleanup rules so stale records expire.
Updates and maintenance
Windows update rings control quality and feature update deferrals, deadlines, grace periods, and active hours. Use feature update policies for version targeting and Delivery Optimization to manage bandwidth.
Traps
Candidates pick a compliance policy to enforce a setting, assign a device-scoped setting to a user group, or forget that scripts and remediations run in the system context and need correct detection logic.
Rule of thumb
Ask 'set or assess?' If the goal is to change a setting, use a configuration profile. If the goal is to gate access, use a compliance policy.