Microsoft Intune Interview Questions – Part 2: Configuration Profiles, Security Baselines & Troubleshooting

In Part 1, we covered Intune architecture, enrollment, Microsoft Entra device identity, Windows Autopilot and device management.

This part focuses specifically on how Intune actually configures Windows devices.

A senior Intune administrator should understand:

• Configuration profiles
• Settings Catalog
• Administrative Template settings
• Security baselines
• Windows Configuration Service Providers
• OMA-URI
• User vs device assignments
• Filters
• Applicability rules
• Policy conflicts
• Policy monitoring
• Policy troubleshooting
• Policy architecture
• Real-world configuration failures

A critical principle is:

Do not create multiple Intune policies that manage the same setting unless you have deliberately designed and tested the interaction.

Microsoft documents that overlapping configuration sources can create conflicts, including between security baselines, endpoint security policies and configuration profiles.

Continue the Microsoft Intune Interview Series

← Previous Part: [Part 1: Fundamentals, Enrollment & Device Management] | Complete Series: [Microsoft Intune Interview Questions & Answers – Complete Series] | Next Part →: [Part 3: App Management, Win32 Apps & Troubleshooting]

Microsoft Intune Configuration & Policy Interview Questions

1. What is an Intune configuration profile?

A configuration profile contains device settings that Intune can deploy to managed devices.

Examples include:

• Password settings
• Windows Defender configuration
• Firewall settings
• Windows Update settings
• Browser configuration
• Device restrictions
• OneDrive settings
• Network configuration

Conceptually:

Intune
   ↓
Configuration Profile
   ↓
Assignment
   ↓
Managed Device
   ↓
Settings Applied

2. What are the main ways to configure Windows devices in Intune?

Common approaches include:

• Settings Catalog
• Security baselines
• Endpoint security policies
• Templates where still applicable
• Custom profiles using OMA-URI/CSP
• Administrative Template settings through the Settings Catalog

Microsoft’s current Intune experience increasingly uses the unified Settings Catalog approach.

3. What is the Settings Catalog?

The Settings Catalog is a centralized collection of configurable settings available in Intune.

Instead of searching through many separate profile templates, administrators can search for a setting directly.

For example:

Settings Catalog
      ↓
Search "BitLocker"
      ↓
Select required setting
      ↓
Configure
      ↓
Assign

Microsoft currently describes the Windows Settings Catalog as containing thousands of settings, including Administrative Template settings.

4. Why is the Settings Catalog important?

It provides a more centralized way to configure supported settings.

Advantages include:

• Easier searching
• Large collection of settings
• Better visibility of individual settings
• Easier policy organization
• Support for Administrative Template settings
• Reduced need for custom OMA-URI configuration

A senior administrator should prefer a native Settings Catalog setting when it provides the required configuration rather than creating unnecessary custom CSP policies.

5. What happened to the older Administrative Templates profile type?

This is an important current interview point.

The older:

Templates
→ Administrative Templates

profile type in the Intune admin center has been deprecated and made read-only.

Microsoft recommends using the Settings Catalog for Administrative Template settings.

Administrative Template settings are available within the Settings Catalog.

Therefore, avoid saying:

“I always create a new Administrative Templates profile.”

A more current answer is:

“For Windows Administrative Template settings, I would normally use the Settings Catalog.”

6. What are Administrative Templates in Intune?

Administrative Templates provide settings historically familiar from Group Policy.

For example:

Computer Configuration
User Configuration
Administrative Templates

Intune exposes many of these settings through the Settings Catalog.

Under the hood, Windows MDM uses Policy CSP mechanisms to apply many of these configurations.

7. Is Intune Group Policy?

No.

Intune is not simply cloud-hosted Group Policy.

Traditional Group Policy uses:

Active Directory
      ↓
Group Policy
      ↓
Domain-joined Windows

Intune uses cloud management mechanisms such as:

Microsoft Entra ID
      ↓
Intune
      ↓
MDM / CSP
      ↓
Windows

Some Intune settings correspond to traditional Group Policy settings, but the underlying management architecture is different.

8. What is a Configuration Service Provider (CSP)?

A Configuration Service Provider, or CSP, is a Windows management interface used by MDM solutions to configure Windows settings.

Intune uses Windows CSPs to configure many Windows settings.

Conceptually:

Intune
   ↓
MDM
   ↓
Windows CSP
   ↓
Windows Setting

Microsoft documents the relationship between Intune settings and Windows CSPs.

9. What is OMA-URI?

OMA-URI stands for:

Open Mobile Alliance Uniform Resource Identifier

In Intune, custom OMA-URI settings can be used to configure supported Windows CSP settings that are not conveniently exposed through the normal Intune UI.

Example structure:

./Device/Vendor/MSFT/Policy/Config/...

The exact URI, data type and value depend on the specific CSP setting.

10. When would you use OMA-URI?

Use OMA-URI when:

1. The required Windows CSP setting exists.
2. The setting is not available through the normal Intune interface.
3. You have validated the CSP documentation.
4. You understand the data type and expected value.

Do not use OMA-URI simply because it is possible.

If the same setting exists in the Settings Catalog, the native setting is usually easier to maintain.

Microsoft specifically notes that many settings are now available through built-in Intune profiles and Settings Catalog, reducing the need for custom OMA-URI configurations.

11. What is a Security Baseline?

A security baseline is a predefined collection of security settings representing Microsoft’s recommended security configuration for a supported product or platform.

Instead of configuring hundreds of security settings individually:

Security Baseline
      ↓
Preconfigured security recommendations
      ↓
Customize where required
      ↓
Assign to devices

Microsoft describes security baselines as groups of preconfigured settings intended to represent a recommended security posture.

12. What is the difference between a Security Baseline and a Configuration Profile?

Configuration Profile

Used to configure selected settings according to your organization’s requirements.

Security Baseline

Provides a broader collection of security-focused settings based on Microsoft’s recommendations.

Example:

Configuration Profile
→ Configure BitLocker settings

Security Baseline
→ Multiple recommended Windows security settings

A baseline is therefore not simply another name for a configuration profile.

13. Should you deploy a Security Baseline without reviewing it?

No.

A baseline represents Microsoft’s recommended security posture, but your organization may have different requirements.

Before deployment:

1. Review every important setting.
2. Identify settings that affect business applications.
3. Compare against existing policies.
4. Test with a pilot group.
5. Document exceptions.
6. Monitor conflicts.
7. Deploy gradually.

Microsoft allows administrators to customize baseline profiles according to organizational requirements.

14. What is the difference between Endpoint Security policies and Configuration Profiles?

Endpoint security policies are purpose-built for security workloads.

Examples include:

• Antivirus
• Firewall
• Disk encryption
• Account protection
• Attack surface reduction

Configuration profiles are broader and can manage many device settings.

Microsoft specifically describes endpoint security policies as streamlined security-focused policies.

15. Why should you avoid configuring the same security setting in multiple policy types?

Suppose you configure:

Firewall = Enabled

in:

• Security baseline
• Endpoint security policy
• Settings Catalog profile

Now imagine another profile sets:

Firewall = Disabled

You have created a policy conflict.

This can result in:

• Conflicted status
• Unexpected configuration
• Troubleshooting difficulty
• Administrative ambiguity

Microsoft recommends planning which policy type owns a setting and avoiding overlapping configuration.

16. How does Intune handle configuration policy conflicts?

This is an important point:

Do not assume that the newest policy automatically wins.

When multiple configuration sources attempt to configure the same setting with different values, Intune can report a conflict and the setting may fail to apply.

Microsoft documents that conflicts between configuration policy sources generally require manual resolution.

Therefore, the correct approach is:

Identify conflict
      ↓
Find all policies configuring setting
      ↓
Determine intended owner
      ↓
Remove duplicate configuration
      ↓
Re-evaluate device

17. Does Intune always give priority to the most restrictive configuration?

No.

This is a common interview mistake.

For configuration policies, you should not assume:

More restrictive = automatically wins

Conflicting configuration settings can be flagged as conflicts and require resolution.

There are separate rules for compliance policies, where multiple compliance policies use the more secure/most restrictive result for overlapping settings. That behavior should not be generalized to all Intune policy types.

18. What is policy assignment?

Assignment determines which users or devices receive a policy.

For example:

Policy
 ↓
Assignment
 ↓
Finance Devices

Assignments can target:

• User groups
• Device groups
• Included groups
• Excluded groups

Correct assignment design is essential for predictable deployment.

19. What is the difference between assigning a policy to a user group and a device group?

User group assignment

The policy follows the targeted users to devices where the policy is applicable.

Device group assignment

The policy targets the devices in the group.

For example:

User Group:
Finance Users

Device Group:
Finance Laptops

These are not interchangeable.

The correct choice depends on whether the setting is logically tied to:

• The person
• The device

Microsoft notes that user and device assignment can have different effects depending on whether the underlying setting is user- or computer-oriented.

20. When would you prefer device assignment?

Use device assignment when the configuration belongs to the device itself.

Examples:

• Firewall
• Device encryption
• Hardware restrictions
• Machine-level security settings
• Kiosk configuration

For example:

Warehouse Device Group
       ↓
Firewall configuration

21. When would you prefer user assignment?

Use user assignment when the setting logically follows the user.

Examples may include:

• User-specific application configuration
• User experience settings
• Certain application policies
• User-specific settings

However, always verify how the particular Windows setting is implemented because some settings assigned to users can still affect device behavior.

22. What are exclusions in Intune assignments?

Exclusions allow you to prevent a targeted user or device group from receiving a policy.

Example:

All Windows Devices
        ↓
Security Policy

Exclude:
IT-Test-Devices

This is useful for:

• Pilot devices
• Exceptions
• Testing
• Special-purpose systems

However, excessive exclusions can make policy design difficult to understand.

23. What are Intune assignment filters?

Filters provide more granular targeting for supported Intune policies.

Instead of relying entirely on large groups, filters can evaluate device properties to determine whether a policy applies.

Conceptually:

Assignment
    ↓
Filter
    ↓
Matching Devices

This can help avoid creating many small groups solely for policy targeting.

24. What is the difference between an assignment filter and a security group?

Security group

Defines membership.

Filter

Applies additional criteria when evaluating whether a policy assignment should apply.

For example:

Group:
All Windows Devices

Filter:
Windows 11
AND
Corporate-owned

This can provide more precise targeting without creating a separate group for every combination.

25. What are applicability rules?

Applicability rules allow a Windows configuration profile to apply only when specified conditions are met.

For example, you may have:

Policy
 ↓
Applicability Rule
 ↓
Only devices matching requirement

This is useful when a policy should not apply universally to every device in the assignment.

Microsoft documents applicability rules as part of Windows device configuration profiles.

26. What is the difference between an assignment filter and an applicability rule?

They are related but operate in different parts of policy evaluation.

Assignment filter

Helps determine whether the policy assignment applies to the targeted device/user based on filter criteria.

Applicability rule

Defines whether a configuration profile applies based on supported device conditions.

A useful interview answer is:

“I use assignment targeting and filters to control who or which devices receive a policy, while applicability rules help determine whether a profile is applicable to a particular Windows device.”

27. What is policy status in Intune?

Policy status tells administrators how a configuration deployment is progressing.

Depending on the policy and reporting view, you may see states such as:

• Succeeded
• Pending
• Error
• Conflict
• Not applicable

These statuses help determine whether the issue is:

Assignment
     ↓
Applicability
     ↓
Policy processing
     ↓
Device configuration

28. A policy shows “Not Applicable.” What does that mean?

It does not necessarily mean that Intune is broken.

It can mean the policy does not apply to that device because of:

• Platform
• OS version
• Applicability rules
• Setting applicability
• Assignment conditions
• Device characteristics

Therefore, first determine why the device is considered not applicable.

29. A policy shows “Conflict.” What does that mean?

It generally means multiple policies are attempting to configure the same setting with incompatible values.

For example:

Policy A:
Firewall = Enabled

Policy B:
Firewall = Disabled

The administrator should identify the conflicting policies and establish one intended configuration owner.

30. A policy shows “Error.” What does that mean?

An Error status indicates that Intune was unable to successfully apply some or all of the configuration.

Possible causes include:

• Unsupported setting
• Invalid configuration
• CSP error
• Device-side processing issue
• Incorrect value
• OS limitation
• Policy conflict
• Management channel problem

Do not treat every error as an assignment problem.

31. How would you troubleshoot a configuration profile that is not applying?

Use this sequence:

1. Verify assignment
        ↓
2. Check inclusion/exclusion
        ↓
3. Check filters
        ↓
4. Check applicability
        ↓
5. Check device enrollment
        ↓
6. Check last check-in
        ↓
7. Check policy status
        ↓
8. Check conflicts
        ↓
9. Check device-side processing
        ↓
10. Check CSP/error details

This is much more reliable than repeatedly clicking Sync.

32. How would you determine whether a policy was actually assigned to a device?

In the Intune admin center, examine the policy’s monitoring and assignment information.

Verify:

• Target group
• Exclusion
• Filter
• Device membership
• Policy status
• Per-device status

You should establish:

Was it assigned?

before investigating:

Why didn't it apply?

33. What should you check if the device is not in the targeted group?

Check:

1. Group type
2. Group membership
3. Dynamic membership rules
4. Device attributes
5. Membership evaluation
6. Whether the correct device object is being referenced
7. Whether stale/duplicate device objects exist

Dynamic groups may not update instantaneously, so assignment timing should also be considered.

34. What is a dynamic device group?

A dynamic device group automatically evaluates device attributes and changes membership according to its membership rule.

Example concept:

Windows 11
+
Corporate-owned
+
Department = Finance

Devices matching the rule become members automatically.

This is useful for scalable Intune targeting.

35. Why should you avoid creating hundreds of static groups for Intune policy targeting?

A large number of manually maintained groups can create:

• Administrative overhead
• Membership errors
• Policy sprawl
• Difficult troubleshooting
• Poor scalability

Where appropriate, dynamic groups and filters can reduce unnecessary group proliferation.

However, they should be designed carefully because complex dynamic membership logic can itself become difficult to maintain.

36. What is policy sprawl?

Policy sprawl occurs when an organization creates too many overlapping policies without a clear architecture.

For example:

Firewall-01
Firewall-02
Firewall-Test
Firewall-New
Firewall-Final
Firewall-Final2
Firewall-Production

This makes it difficult to determine which policy controls the actual setting.

A mature Intune environment should have:

• Clear naming
• Ownership
• Documentation
• Defined policy purpose
• Limited overlap
• Lifecycle management

37. How would you design an Intune policy architecture?

I would establish policy ownership.

For example:

Security Baseline
        ↓
Baseline security configuration

Endpoint Security
        ↓
Security workloads

Settings Catalog
        ↓
General Windows configuration

Applications
        ↓
Application deployment/configuration

Compliance
        ↓
Device compliance requirements

Then document which policy type owns each important setting.

This prevents accidental duplication.

38. Can a Security Baseline conflict with an Endpoint Security policy?

Yes.

For example:

Security Baseline
→ Defender setting A

Endpoint Security Policy
→ Same setting A
→ Different value

This can create a configuration conflict.

Microsoft explicitly identifies security baselines and endpoint security policies as possible overlapping sources of configuration.

39. How would you troubleshoot a Security Baseline conflict?

I would:

1. Identify the conflicting setting.
2. Identify all policies configuring it.
3. Determine the intended source of truth.
4. Review the baseline.
5. Review endpoint security policies.
6. Review Settings Catalog profiles.
7. Remove duplicate configuration.
8. Re-evaluate the device.
9. Verify the final state.

The objective is not merely to make the error disappear.

The objective is to establish a clear configuration owner.

40. What is the relationship between Intune and Windows Policy CSP?

The relationship is approximately:

Intune
   ↓
MDM
   ↓
Windows Policy CSP
   ↓
Windows Configuration

The Intune portal provides an administrative interface, while Windows CSPs provide the underlying management mechanisms for many Windows settings.

Microsoft provides mappings between Intune Graph API entities and Windows CSPs.

41. How would you troubleshoot a custom OMA-URI policy?

Check:

1. OMA-URI

Is the URI correct and case-sensitive where required?

2. Data type

Is the configured data type correct?

3. Value

Is the value formatted according to the CSP documentation?

4. CSP support

Does the Windows version support the CSP?

5. Assignment

Is the policy assigned to the correct device?

6. Conflict

Is another policy configuring the same setting?

7. Device-side result

Check the Windows MDM/CSP processing status.

42. Why should custom OMA-URI policies be minimized?

Because they can be harder to maintain.

Problems include:

• Complex URIs
• Documentation dependency
• Difficult troubleshooting
• Limited administrator familiarity
• Potential OS-version differences

If a native Settings Catalog setting becomes available later, consider migrating the custom configuration to the native setting after testing.

43. A policy works on Windows 11 but not on another Windows edition. What should you check?

Check:

• Windows version
• Windows edition
• CSP support
• Policy applicability
• Feature availability
• Licensing where relevant
• Policy documentation

Not every Windows setting is available on every edition.

Microsoft notes that some Settings Catalog settings aren’t included in all Windows editions.

44. A policy worked yesterday but stopped applying after a Windows update. What would you investigate?

I would establish whether the problem is:

Policy configuration
        OR
Windows support
        OR
CSP behavior
        OR
Assignment
        OR
Device-side processing

Then compare:

• Windows build
• Policy status
• CSP documentation
• Recent Intune changes
• Recent Windows changes
• Device-side event/log information
• Other affected devices

If only one device is affected, investigate the device.

If thousands are affected immediately after an update, investigate the common configuration/change path.

45. How would you safely deploy a new Intune policy to 5,000 devices?

I would not immediately assign it to all 5,000.

Use a staged rollout:

Test
 ↓
IT Pilot
 ↓
Small Production Group
 ↓
Larger Production Group
 ↓
Organization-wide

At each stage:

• Monitor success
• Check conflicts
• Check user impact
• Check application compatibility
• Review errors
• Validate security impact

Only proceed when the previous stage is stable.

46. How would you roll back a bad Intune configuration?

First determine whether the policy is:

• Incorrect
• Conflicting
• Causing a device issue
• Affecting a large population

Then:

1. Stop further expansion.
2. Remove or modify the problematic assignment.
3. Restore the known-good configuration.
4. Sync/evaluate affected devices.
5. Verify the actual device state.
6. Monitor recovery.
7. Document the incident.

For critical settings, maintain a documented known-good configuration.

47. What is policy versioning and why is it important?

Intune policies should have clear naming and documentation that identifies:

• Purpose
• Owner
• Scope
• Version/change
• Date
• Reason

Example:

WIN11-SEC-FIREWALL-PROD-v3

This makes change tracking easier.

For major environments, change management should exist outside the Intune portal as well.

48. A configuration policy is successful on 99% of devices but fails on 1%. How would you investigate?

Do not immediately modify the policy globally.

Compare the affected devices with successful devices.

Check:

OS version
Edition
Enrollment state
Group membership
Filter
Applicability
Conflicting policies
Device health
CSP support
Local configuration

The goal is to identify what is different about the failed population.

49. How would you troubleshoot a policy that works for one user but not another?

Compare:

• User group membership
• Device group membership
• Exclusions
• Filters
• Device ownership
• Device platform
• Device OS version
• Enrollment state
• Existing policy conflicts
• Last check-in

Remember that the difference may be the device, not the user.

50. How would you troubleshoot a policy that works on one device but not another?

Compare the two devices systematically:

Working Device
       VS
Failing Device

Check:

• Microsoft Entra device state
• Intune enrollment
• OS version
• OS edition
• Group membership
• Filters
• Applicability
• Policy status
• Conflicts
• CSP support
• Last check-in

This “known-good vs known-bad” comparison is one of the most effective endpoint troubleshooting techniques.

51. Design a clean Intune policy architecture for 5,000 Windows devices.

A possible design:

                    Intune
                      |
        +-------------+-------------+
        |             |             |
     Security     Configuration   Compliance
        |             |             |
     Baselines     Settings       Compliance
     Endpoint      Catalog        Policies
     Security
        |
        +-------------+-------------+
                      |
                  Assignments
                      |
            +---------+---------+
            |                   |
        Pilot Groups       Production
            |                   |
          Test              Deployment

Policy ownership should be clearly documented.

For example:

Firewall
→ Endpoint Security

BitLocker
→ Endpoint Security

General Windows Settings
→ Settings Catalog

Recommended Microsoft Security Configuration
→ Security Baseline

Access Decision
→ Conditional Access

The exact ownership model can vary, but the organization should avoid multiple policies controlling the same setting unnecessarily.

Real-World Intune Policy Troubleshooting Scenarios

Scenario 1 — Policy says “Succeeded” but the setting is not visible

Check:

1. Is the setting user-based or device-based?
2. Is the user/device correctly targeted?
3. Is another policy configuring the setting?
4. Does the Windows edition support it?
5. Is the setting actually visible through the expected Windows interface?
6. Has the device processed the latest configuration?

Do not assume that “Succeeded” means every possible user-facing symptom must immediately change.

Scenario 2 — Policy says “Conflict”

Use:

Policy Status
      ↓
Conflicting Setting
      ↓
Find All Policies
      ↓
Identify Owner
      ↓
Remove Duplicate
      ↓
Re-evaluate

Scenario 3 — Policy says “Not Applicable”

Check:

• OS version
• OS edition
• Applicability rules
• Filters
• Platform
• Device characteristics
• Setting-specific applicability

Scenario 4 — Policy says “Error”

Investigate:

• Exact setting
• Error code
• CSP
• Device OS
• Assignment
• Conflicts
• Device-side MDM processing

Do not delete the policy before understanding the error.

Scenario 5 — New policy affects thousands of devices unexpectedly

Immediately:

1. Stop expansion.
2. Determine the assignment scope.
3. Check exclusions.
4. Check filters.
5. Identify the exact affected setting.
6. Roll back or correct the policy.
7. Validate recovery.
8. Document the change.

Useful Intune Troubleshooting Tools

Intune Admin Center

Use:

• Device configuration status
• Per-setting status
• Device status
• Policy assignment
• Conflict reporting
• Enrollment reports
• Device diagnostics

Windows MDM Diagnostic Information

On Windows devices, MDM diagnostic information can help determine:

• Applied policies
• Enrollment information
• MDM processing
• CSP-related information

Event Viewer

Useful areas include:

Applications and Services Logs
    Microsoft
       Windows
          DeviceManagement-Enterprise-Diagnostics-Provider

The DeviceManagement-Enterprise-Diagnostics-Provider (DM-EDP) logs are particularly useful when troubleshooting Windows MDM policy processing.

Quick Revision

Exam Answer Summary

Settings Catalog

A centralized Intune interface containing a large collection of configurable device settings.

Security Baseline

A collection of Microsoft-recommended security settings that can be customized and deployed.

CSP

Windows Configuration Service Provider used by MDM solutions to configure Windows.

OMA-URI

A URI-based mechanism for configuring supported CSP settings when native Intune configuration isn’t sufficient.

Policy Conflict

Occurs when multiple configuration sources attempt to configure the same setting with incompatible values.

Assignment

Determines which users or devices are targeted.

Filter

Provides additional targeting criteria for supported assignments.

Applicability Rule

Determines whether a configuration profile applies to a particular Windows device.

Senior Interview Tip

If an interviewer asks:

“What would you do if an Intune policy isn’t applying?”

Don’t answer:

“I would force a sync.”

A senior-level answer is:

“First I would establish whether the device is actually targeted. I would verify group membership, exclusions, filters and applicability. Then I would check the device’s enrollment state and last check-in, followed by the policy’s per-device status. If the policy is reporting conflict or error, I would identify the exact setting and determine whether another configuration profile, security baseline or endpoint security policy is managing the same setting. Finally, I would validate the Windows CSP/device-side processing and compare the affected device with a known-good device.”

That demonstrates a structured troubleshooting methodology rather than a single action.

Progress

Part 1

Intune Fundamentals, Enrollment & Device Management

Covered:

• MDM
• MAM
• Enrollment
• Microsoft Entra Join
• Hybrid Join
• Autopilot
• ESP
• Company Portal
• Device ownership
• Primary users
• Shared devices
• Co-management

Part 2

Configuration Profiles, Settings Catalog, Security Baselines & Policy Troubleshooting

Covered:

• Settings Catalog
• Administrative Templates
• Security Baselines
• Endpoint Security
• CSP
• OMA-URI
• Assignments
• Filters
• Applicability
• Policy conflicts
• Policy troubleshooting
• Production rollout
• Policy architecture

Next Part

Continue the Microsoft Intune Interview Series

← Previous Part: [Part 1: Fundamentals, Enrollment & Device Management] | Complete Series: [Microsoft Intune Interview Questions & Answers – Complete Series] | Next Part →: [Part 3: App Management, Win32 Apps & Troubleshooting]

Part 3 – Microsoft Intune Application Management, Win32 Apps, Microsoft Store Apps & Application Troubleshooting

The next part will focus specifically on:

• Intune application management
• Win32 applications
• Microsoft Store applications
• MSI/LOB applications
• Required vs Available applications
• Detection rules
• Dependencies
• Supersedence
• Return codes
• Install/uninstall commands
• User vs device context
• IME troubleshooting
• Application installation failures
• Detection failures
• Application replacement
• Real-world application deployment scenarios

Official Microsoft Intune Documentation

For the latest Microsoft Intune documentation, supported capabilities and current configuration guidance, refer to Microsoft Learn.

Microsoft Intune Documentation:
https://learn.microsoft.com/en-us/intune/

Microsoft’s documentation is the authoritative source for current Intune capabilities because enrollment methods, supported platforms, policies and management features can change over time. (Microsoft Learn)