You have a hybrid deployment of Azure AD that contains 50 Windows 10 devices. All the devices are enrolled in Microsoft Intune.
You discover that Group Policy settings override the settings configured in Microsoft Intune policies.
You need to ensure that the settings configured in Microsoft Intune override the Group Policy settings.
What should you do?
To ensure that settings configured in Microsoft Intune override Group Policy settings, you should create an Administrative Templates device profile in the Microsoft Intune admin center. Administrative Templates device profiles allow you to configure a wide range of settings, similar to Group Policy settings. Once these profiles are applied, they can take precedence over the Group Policy settings on enrolled devices.
Given answer is correct. REF: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict#mdmwinsovergp
tested in intune !
Have you checked Administrative templates? If you are unable to find override group policy settings feature in administrative template, then you can choose custom.
Here's why: Administrative Templates device profiles in Microsoft Intune allow you to configure a wide range of settings, similar to Group Policy settings. When applied, these profiles can take precedence over Group Policy settings on enrolled devices.
That's it, you can look it up in Intune > Device Configuration Profiles > Administrative Templates > Turn off Local Group Policy Objects processing.
B is correct: This policy setting prevents Local Group Policy Objects (Local GPOs) from being applied. By default, the policy settings in Local GPOs are applied before any domain-based GPO policy settings. These policy settings can apply to both users and the local computer. You can disable the processing and application of all Local GPOs to ensure that only domain-based GPOs are applied. If you enable this policy setting, the system does not process and apply any Local GPOs. If you disable or do not configure this policy setting, Local GPOs continue to be applied. Note: For computers joined to a domain, it is strongly recommended that you only configure this policy setting in domain-based GPOs. This policy setting will be ignored on computers that are joined to a workgroup. Setting type: Device
The key is the wording here: "You need to ensure that the settings configured in Microsoft Intune override the Group Policy settings." This means GPO setting MUST be applied but when it conflicts with Intune, Intune should prevail. Option "C" can "Turn off Local Group Policy Objects processing." which stops ALL GPO to be processed, so this NOT what the scenario describes here. (mdmwinsovergp can be set via Settings Catalog as well btw)
B is correct.
https://www.anoopcnair.com/mdm-wins-over-gpo-group-policy-intune-policy/
B is correct Sign in to the Microsoft Endpoint Manager admin center (Endpoint.Microsoft.coom) Select Devices -> Windows -> Configuration profiles > Create profile. In Create Profile, You can select Platform: Windows 10 and later and Profile: Select Settings catalog (preview). Click on Create button. In Configuration Settings, select Add settings and use the following search keyword “MDM Wins Over GP.” You need to choose the MDM Wins Over GP policy from the list. https://www.anoopcnair.com/mdm-wins-over-gpo-group-policy-intune-policy/#:~:text=Option%20%231%20(New%20Method)%20%E2%80%93%20Intune%20Settings%20Catalog%20%7C%20Create%20MDM%20Wins%20Over%20GPO%20Policy
B seems correct
Admin templates > control policy conflict > MDM Wins over GP (The MDM policy is used and the GP policy is blocked)
MDM Wins over GP is below Admin Templates, but it is not under the Admin templates tree though.
To ensure that the settings configured in Microsoft Intune policies override the Group Policy settings for Windows 10 devices enrolled in Intune, you should do the following: C. From the Microsoft Intune admin center, create an Administrative Templates device profile.
The option where MDM wins over GP is not found in Settings Catalogue > Administrative Templates but instead in Settings Catalogue > Control Policy Conflict. So in the given options, B is the correct answer.
To ensure that the settings configured in Microsoft Intune override the Group Policy settings, you should create a custom device profile from the Microsoft Intune admin center (Option B). In this custom device profile, you need to define a custom policy named ControlPolicyConflict/MDMWinsOverGP
C. From the Microsoft Intune admin center, create an Administrative Templates device profile. Functionality: Administrative Templates in Intune are similar to Group Policy settings and allow you to manage settings on Windows 10 devices through Intune. Overrides Group Policy: By configuring these settings in Intune, you can ensure they take precedence over local Group Policy settings The other options do not override GPOs
In my viewpoint, custom profile can do more than just over-ride GPO settings. However, our first priority will be using the built-in features which you can already find in Administrative templates and even you can then see the stats such as which GPOs were implemented, which were not or which made conflict. I would say custom profiles should be used if we can't find the settings we require all in one place or is not available in the built-in options.
B. From the Microsoft Intune admin center, create a custom device profile. Ref: https://www.anoopcnair.com/mdm-wins-over-gpo-group-policy-intune-policy/#:~:text=Option%20%231%20(New%20Method)%20%E2%80%93%20Intune%20Settings%20Catalog%20%7C%20Create%20MDM%20Wins%20Over%20GPO%20Policy
I'm not certain that the Admin Template answer is actually the correct because its really found in the Settings Catalog and doesn't outright credit itself as an Administrative Template
Although B can do the same , A standard template is available in C
To ensure that the settings configured in Microsoft Intune take precedence, you can create an Administrative Templates device profile in the Microsoft Intune admin center. This allows you to configure the settings and policies for Windows 10 devices directly through Intune, ensuring that they override any conflicting Group Policy settings.