Endpoint management
Configuration profile
Microsoft Intune configuration profile
A configuration profile is the mechanism Intune uses to push settings onto enrolled devices, covering areas like Wi-Fi and VPN connection settings, certificate deployment, device restrictions such as disabling the camera or USB storage, email profile configuration, kiosk mode, and a very broad range of Windows, iOS/iPadOS, macOS, and Android-specific settings that would previously have been delivered through Group Policy Objects, Apple Configurator, or Android Enterprise's own management console.
Why Configuration profile matters in a Microsoft estate
Configuration profile matters for endpoint teams because device, app, compliance, update, and troubleshooting signals often sit across several Microsoft admin areas. Linking these terms back to Intune and device-reporting routes helps readers move from definition to action.
How Configuration profile shows up in practice
Under the hood, most Windows configuration profile settings are delivered through Configuration Service Providers, CSPs, the same underlying mechanism Windows itself exposes for MDM-based configuration. Intune offers two overlapping ways to build them: templated profiles, which present a curated, purpose-built set of settings for a specific scenario such as Wi-Fi or endpoint protection, and the Settings Catalog, which exposes the full, granular list of available CSP settings directly and is now Microsoft's preferred approach for new profile creation since it's kept current with new CSPs as they're released, whereas some older templates have been deprecated or are missing newer settings entirely.
Profiles are assigned to Entra ID groups, and because a device or user can be in scope for multiple profiles simultaneously, from different admins targeting different groups over time, conflicting settings between profiles are one of the most common and hardest to diagnose problems in a mature Intune estate: two profiles each setting the same underlying CSP to a different value produces a conflict that Intune reports but doesn't resolve automatically, and the device will show that specific setting as being in a conflict or error state until an admin identifies and resolves the overlap. Without deliberate profile naming conventions and a clear map of what each profile targets, that overlap can take real investigation to track down.
Configuration profiles are distinct from, but easily confused with, compliance policies and endpoint security policies: a configuration profile enforces a setting by directly configuring the device, while a compliance policy only checks whether a state is true and reports pass or fail without independently changing anything, and endpoint security policies are really configuration profiles in effect but exposed through a separate, security-focused part of the console covering areas like disk encryption, firewall, and antivirus specifically. In practice, configuration profile sprawl, dozens of overlapping profiles built up over years by different admins, some targeting groups that no longer reflect current organisational structure, is one of the more common and less visible sources of operational risk and troubleshooting overhead in long-running Intune tenants. Periodic profile audits, consolidating overlapping profiles and retiring ones targeting stale or empty groups, is standard estate hygiene rather than a one-off migration task.