Settings Catalog & Administrative Templates (ADMX)

Configure Windows 10 & 11 system, browser, and security settings using the modern Intune Settings Catalog and Group Policy ADMX templates.

Tags:#Settings Catalog#ADMX#Group Policy#Configuration Profiles#Edge#MD-102

Overview

The Settings Catalog is the primary, modern configuration framework in Microsoft Intune. It replaces legacy, rigid templates with a unified, searchable repository of all available Windows Configuration Service Provider (CSP) settings and Administrative Templates (ADMX).

Administrators can configure granular settings for Microsoft Edge, Windows Security, Start Menu layout, Windows Update policies, and OneDrive silently without relying on legacy on-premises Active Directory Group Policies.

---

When to Use

Scenario	Recommendation	Technical Rationale
New Configuration Baseline	Use Settings Catalog	Microsoft's modern standard; offers granular searching, conflict reporting, and single-setting editing.
Custom Third-Party Software (Chrome/Firefox/Adobe)	Import Custom ADMX	Upload vendor `.admx` and `.adml` files directly into Intune under Imported Administrative Templates.
Legacy Template Migration	Use Group Policy Analytics	Analyze on-prem GPO XML exports to identify CSP equivalencies before importing into Settings Catalog.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Manage devices
        └── Configuration
            └── Create
                ├── Platform: Windows 10 and later
                └── Profile type: Settings catalog

---

Step-by-Step Implementation

Step 1: Create a Settings Catalog Profile

Go to Devices > Configuration > Create > New policy.
Select Windows 10 and later > Settings catalog.
Name: POL-Win11-Corporate-Baseline.

Step 2: Add and Configure Key Baseline Settings

Click + Add settings and search for:

Microsoft Edge:
Configure whether a user can turn on InPrivate browsing = Disabled
Default search engine URL = https://www.bing.com/search?q={searchTerms}
OneDrive:
Silently move Windows known folders to OneDrive (KFM) = Enabled (Specify your Tenant ID)
Silently sign in users to the OneDrive sync app with their Windows credentials = Enabled
System:
Allow Storage Sense = Enabled
Allow Clipboard History = Disabled (if high-security finance/health requirement)

Step 3: Assignment & Filters

Assign to: SG-Corporate-Windows11-Devices.
Apply Intune Assignment Filters if necessary (e.g., target only laptops, exclude virtual desktops).

---

PowerShell Commands

Inspect Applied Intune MDM Policies Locally on Windows Endpoint:

PowerShell

# Query registry path for Intune MDM policy results
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\*" | Format-List

# Export comprehensive MDM Diagnostic HTML report
mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning -cab C:\MDMDiag.cab

---

Troubleshooting Matrix

Issue	Root Cause	Resolution
Setting Shows 'Conflict'	Two separate configuration profiles configure the exact same CSP setting with conflicting values.	Review Profile Conflicts in Intune. Remove device from one of the conflicting profiles, or merge settings into a single Settings Catalog profile.
Setting Shows 'Error 0x87d1fde8'	Remediation / setting failed; often indicates the setting requires a newer Windows build or Enterprise/Education edition.	Verify the OS edition matches requirement (some settings are Enterprise-only and fail on Windows Pro).

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Rules:

Conflict Resolution: If two Configuration Profiles conflict, Intune flags a Conflict state and does NOT apply either setting. (Unlike Compliance policies, which apply the most restrictive rule).
Group Policy Analytics: Used to analyze on-premises GPOs and reports the percentage of settings supported by modern Intune MDM CSPs.

PREVIOUS TOPIC3.5 Windows Firewall & Network Protection via Intune NEXT TOPIC4.2 Endpoint Privilege Management (EPM) Policies