> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/intune.md). # Intune {% hint style="warning" %} This page covers Augmentt Secure's management of **Microsoft Intune** (device configuration, compliance, and app policies across your client tenants). It is unrelated to "Intune Autopilot," a separate Augmentt onboarding product — if that's what you're looking for, this isn't the right page. {% endhint %} Intune manages device configuration and compliance, app management and protection, and enrollment/deployment profiles through Microsoft Intune — across every client tenant, from Augmentt, instead of the Intune admin center one tenant at a time. Build a policy once, save it as a reusable **Template**, group templates into a **Baseline**, and deploy either to as many tenants as you need with consistent settings and assignments every time. You'll find it at **Secure > Intune**, with **Device Management** (live, deployed policies) and **Templates** (your reusable building blocks) as the two main areas, split across policy categories: * **Device Configuration** — device-level settings profiles (`deviceConfigurations` / `configurationPolicies` in Microsoft Graph) * **Device Compliance** — rules a device must meet to be marked compliant * **App Protection** — data-protection policies for managed apps (MAM) * **App Configuration** — configuration settings pushed into managed apps * **Apps** — mobile app deployments * **Deployment Profiles** — Windows Autopilot enrollment profiles * **Scripts** and **Remediation Scripts** — PowerShell/shell scripts and proactive remediations {% hint style="info" %} "Deployment Profiles" here means Windows Autopilot enrollment profiles specifically — not a synonym for deploying any of the other policy types. Every category above (configuration, compliance, app protection, app configuration, apps, scripts, deployment profiles) has its own independent set of Templates, Baselines, and Policies. {% endhint %} ## Templates, Baselines, and Policies — how they differ This is the core model, and it's worth being precise about it: * A **Template** is a policy's settings, captured and stored in Augmentt, independent of any tenant. You create one either by **importing** an existing policy from a connected customer's live Intune environment, or by starting from one of Augmentt's built-in default templates. A template on its own doesn't exist in anyone's Intune — it's Augmentt's copy of a configuration, ready to be reused. * A **Baseline** is a named collection of Templates of the same category (for example, several Device Configuration templates grouped together) that you deploy as one unit, so a whole set of policies always gets created together and identically, instead of one at a time. * A **Policy** is the live object that exists inside a specific customer's Microsoft Intune — the actual `deviceConfiguration`, `deviceCompliancePolicy`, and so on, created (and assigned to users or devices) via the Microsoft Graph API when you deploy a Template or a Baseline to that tenant. In short: **Templates and Baselines live in Augmentt and are tenant-agnostic; Policies live in the customer's tenant and are what Intune actually enforces.** Deploying copies a Template's settings out into a tenant as a new Policy; it doesn't leave the Policy pointed back at the Template afterward — see [Editing a deployed policy](#editing-a-deployed-policy) below for what that means in practice. {% hint style="warning" %} **Naming collision to watch for:** Microsoft also has a feature literally called "security baselines" in Intune — Microsoft-authored, pre-configured device configuration profiles for security hardening (Windows, Microsoft Defender, Edge, and so on). Augmentt's **Baseline** is a different, unrelated concept: it's *your own* grouping of *your own* templates (which can be built from anything — imported policies, Augmentt's defaults, or policies you've designed from scratch), not Microsoft's curated security-hardening bundles. Don't assume the two "baseline" concepts are interchangeable when talking to customers who know Microsoft's terminology. {% endhint %} ## Creating Templates To get started, first create the policy once in a connected customer's Microsoft environment (or use one of Augmentt's built-in default templates as a starting point), then import it as a Template in Augmentt. 1. Go to **Secure > Intune > Templates**. 2. Choose a category from the selector — **Configuration**, **Compliance**, **App Protection**, **App Configuration**, **Apps**, **Deployment Profiles**, **Scripts**, or **Remediation Scripts**. 3. Click **Create New > Template**. 4. Select the source **Tenant**, then the **Platform** (Windows, iOS, macOS, Android, and so on — configuration and compliance policies are platform-specific), then the existing **Policy** from that tenant you want to capture. 5. Give it a **Title** and optional **Description**, then click **Create**. The template is now stored in Augmentt, decoupled from that source tenant. Repeat for every configuration, compliance, app protection, app configuration, or deployment profile you want available for reuse. {% hint style="info" %} Templates you create are scoped to your organization. Augmentt also ships a set of built-in default templates (unaffiliated with any single customer) you can deploy as-is or use as a starting point — you'll see these alongside your own in the template list. {% endhint %} ## Creating Baselines A Baseline groups several Templates of the same category so you can push a whole predefined set of policies to a tenant in one deployment, guaranteeing every tenant onboarded against it ends up with exactly the same policies — no missed or inconsistent settings. 1. Go to **Secure > Intune > Templates**, and choose the same category selector (Configuration, Compliance, etc.). 2. Click **Create New > Baseline**. 3. Select the Templates to include, then click **Create**. You can create as many Baseline variations as you need — for example, separate baselines per compliance framework, per client tier, or per device platform. ## Deploying Policies and Baselines Deploying is what turns a Template (or a Baseline of templates) into a real, live Policy inside a specific customer's Intune tenant — via the Microsoft Graph API, using the credentials from that customer's Microsoft 365 integration. **Deploying a single Policy from a Template:** 1. Go to **Secure > Intune > Device Management > Policies**, and choose the category (Configuration, Compliance, etc.). 2. Click **Deploy > Policy**. 3. Select the **Platform** and the **Template** to deploy, click **Next**. 4. Choose the user/device assignment and any group inclusions or exclusions, click **Next**. 5. Review, then click **Deploy Policy**. **Deploying a Baseline:** 1. From the same **Policies** screen, click **Deploy > Baseline**. 2. Select the **Baseline** to deploy, click **Next**. 3. Expand each policy inside the baseline and set its own user/device assignment and group inclusions/exclusions, click **Next**. 4. Review, then click **Deploy Baseline**. Each policy in a baseline still gets its own assignment step — grouping templates into a baseline standardizes *what* gets created, not *who* it's assigned to; you still target that per tenant. {% hint style="info" %} Under the hood, deploying creates a brand-new object in the customer's tenant (a Graph `POST` to the relevant endpoint, e.g. `/deviceManagement/deviceConfigurations`), then a second call to set its assignments. The customer's tenant ends up with a real, independent Intune policy — it isn't a live link back to the Augmentt template, which is why editing it afterward is a separate flow (below). {% endhint %} ## Editing a deployed policy Once a policy has been deployed to a tenant, you can edit it directly from Augmentt without opening that customer's Intune admin center — Augmentt currently supports editing for Device Configuration, Device Compliance, App Configuration, App Protection, Deployment Profile, and Apps policies. This is a genuinely different flow from creating or updating a Template: **editing here changes the *****live policy***** in the customer's tenant directly** (a Graph `PATCH` to the deployed object, followed by re-applying its assignments) — it does not go back and update the Template it was originally deployed from, and it does not touch any other tenant that template was also deployed to. 1. Go to **Secure > Intune > Device Management > Policies**, and choose the category. 2. Click the policy you want to modify to open its details panel. 3. Click **Edit** in the bottom right of the panel. 4. Update the settings — for configuration policies, expand a category to view and change individual settings; for compliance policies, settings are grouped (Device Health, Device Properties, System Security, etc.) with dropdowns per setting. 5. Use the tenant selector at the top to confirm you're targeting the correct customer environment. 6. Click **Next** to reach **Review & Finish**, then **Save** to push the change. {% hint style="warning" %} Because this writes straight to the live policy, the change takes effect for every device and user it's assigned to as soon as you save — there's no staging step. Review current device compliance, or test on a pilot group first, before editing a policy that's already in production for a client. {% endhint %} {% hint style="info" %} Augmentt doesn't currently track drift between a deployed policy and the Template it came from — editing a live policy (here or directly in Intune) won't be flagged back against its source Template, and the Template itself is unaffected. If you want a tenant's policy to match its Template again, redeploy the Template rather than relying on the two staying in sync automatically. {% endhint %} ## Related pages * [Compliance Audit](/modules/secure/security-posture/compliance-audit.md) — a separate, checklist-driven way to audit and remediate a tenant's overall Microsoft 365 configuration (including some Intune enrollment settings), distinct from the Templates/Baselines/Policies model on this page. ## In this section * [Device Configuration](/modules/secure/intune/device-configuration.md) * [Device Compliance](/modules/secure/intune/device-compliance.md) * [App Protection](/modules/secure/intune/app-protection.md) * [App Configuration](/modules/secure/intune/app-configuration.md) * [Apps](/modules/secure/intune/apps.md) * [Deployment Profiles](/modules/secure/intune/deployment-profiles.md) * [Scripts](/modules/secure/intune/scripts.md) * [Remediation Scripts](/modules/secure/intune/remediation-scripts.md) Each page covers that category's full configuration surface and, where Augmentt ships one, its default/built-in templates with exact values. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/intune.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.