Week 6, Day 3 — Configuration Profiles, KFM & Windows Update Rings

Day 2 review & the configuration gap

• Ask: "A compliance policy says Defender must be enabled. That's a rule about what a device must have. What about how devices are configured — folder locations, update timing, browser settings, screensaver timeout? Who controls those?" — prime: compliance = access gate; configuration profiles = the actual device settings
• Ask: "In Lab 4-D Bonus B, you designed a KFM deployment plan and researched the registry keys. Where did that plan end up?" — surface it was a design exercise. Today is the implementation.
• Ask: "A user's laptop is on Windows 11 22H2. Microsoft releases 23H2. Who controls when the machine updates in a traditional GPO/WSUS environment? How does Intune change that?" — prime Update rings: cloud-managed deferral without WSUS.
• Frame: compliance is the gate. Configuration profiles define what's inside — what the device looks like, how it behaves, and what happens to users' files.

Configuration profiles — the three delivery mechanisms and what they manage

Configuration profiles push settings silently to devices without user interaction. Three delivery mechanisms cover different use cases — knowing when to use each is an admin design decision.

The three Intune configuration profile types for Windows

Known Folder Move — the Lab 4-D payoff

• KFM via Settings Catalog — KFMSilentOptIn sets the tenant ID and silently redirects Desktop, Documents, and Pictures to OneDrive. KFMBlockOptOut prevents users from undoing the redirection. Together they silently redirect known folders without any user action. Students who completed Lab 4-D Bonus B researched exactly these registry keys — today they deploy them via Intune.
• Windows Update rings — replaces WSUS for cloud-managed devices. Rings define: update channel, deferral period (days after Microsoft releases before install), active hours (no restarts during work), and deadline (maximum days before forced install). Typical production: Pilot ring (IT team, 0-day deferral) and Production ring (rest of org, 7–14 day deferral). IT validates patches don't break anything before Production auto-installs.
• Endpoint Security baselines — Microsoft-curated bundles of ~150 hardening settings aligned to CIS/STIG benchmarks. Applied in one profile: Defender, Credential Guard, exploit protection, BitLocker, Windows Firewall. Much faster than configuring individually. Can be customised post-apply by overriding specific settings.
• Profile conflict resolution — when two profiles configure the same setting differently, Intune reports a Conflict and does not apply that setting. Unlike GPO (last writer wins), Intune surfaces conflicts explicitly. The device profile status shows Conflict for the affected setting — admin must resolve by removing the setting from one profile.

Lab 6-C: Known Folder Move, Update rings, and Endpoint Security baseline

Students deploy KFM via a Settings Catalog profile, configure Pilot and Production Windows Update rings, apply the Windows Security Baseline, and verify all three profiles on WIN-CLIENT-01.

• Step 1 — KFM configuration profile via Settings Catalog (20 min)
  Intune → Devices → Configuration → + Create → New policy. Platform: Windows 10 and later. Profile type: Settings catalog. Name: LL — Known Folder Move.
  Search settings picker for "OneDrive". Add: Silently move Windows known folders to OneDrive (KFMSilentOptIn) — Enabled, Value = your Entra Tenant ID GUID (find at entra.microsoft.com → Overview). Also add: Prevent users from redirecting their Windows known folders to their PC (KFMBlockOptOut) — Enabled.
  Assign to SG — All Windows Devices. Save.
• Step 2 — Verify KFM on WIN-CLIENT-01 (10 min)
  On WIN-CLIENT-01: trigger policy sync (Settings → Accounts → Access work or school → Info → Sync). Wait 5–10 min.
  Check File Explorer — Desktop, Documents, Pictures should show OneDrive sync overlay icons. Address bar should show OneDrive path.
  Verify via registry: open regedit → HKCU\Software\Policies\Microsoft\OneDrive — confirm KFMSilentOptIn and KFMBlockOptOut values exist.
  Or PowerShell: Get-ItemProperty "HKCU:\Software\Policies\Microsoft\OneDrive" | Select-Object KFMSilentOptIn, KFMBlockOptOut
• Step 3 — Create Pilot and Production Update rings (15 min)
  Intune → Devices → Windows → Update rings for Windows 10 and later → + Create profile.
  Ring 1 — LL Update Ring — Pilot: Feature deferral 0 days, Quality deferral 0 days, Active hours 08:00–18:00. Assign to SG — All Windows Devices.
  Ring 2 — LL Update Ring — Production: Feature deferral 14 days, Quality deferral 7 days, Deadline 5 days, Active hours 08:00–18:00. Assign to new group SG — Production Devices (empty for now).
  Record all settings for both rings.
• Step 4 — Apply the Windows Security Baseline (10 min)
  Intune → Endpoint security → Security baselines → Windows 10 and later security baseline → + Create profile. Name: LL — Windows Security Baseline. Accept all defaults — review a few key settings (Credential Guard, Exploit Guard, Defender). Assign to SG — All Windows Devices. Save.
• Step 5 — Verify all profiles in Intune + on device (10 min)
  Intune → Devices → WIN-CLIENT-01 → Device configuration tab. All three profiles should appear and progress from Pending → Succeeded after sync. Click each profile — review per-setting status. Note any Conflict entries.
  From WIN-CLIENT-01, check OneDrive at onedrive.com — a Desktop folder should now appear alongside the Recordings folder from Week 5.

⭐ Bonus: Autopilot hash & custom OMA-URI profile

Reflection & preview

• Ask: "The KFM profile redirected the Desktop to OneDrive. A new user signs into WIN-CLIENT-01 for the first time — does their Desktop also redirect?" — yes, the profile applies to the device and triggers per-user on each sign-in
• Ask: "Pilot ring = 0-day deferral, Production = 14-day deferral. A critical security patch is released Monday. When does each ring install it and why is the stagger valuable?" — surface: IT validates the patch on Pilot before it auto-installs on Production
• Ask: "The Security Baseline and the KFM profile both configure a Defender setting differently. What happens?" — Conflict reported for that setting, not applied, both profiles show Conflict. Admin resolves by removing from one.
• Exit ticket: explain the difference between a compliance policy and a configuration profile — both assigned to device groups, both affect Windows. What is each for? Can a single Intune setting exist in both?
• Preview Day 4: devices are compliant, configured, and have KFM. Day 4 deploys software — Win32 app packaging with IntuneWinAppUtil, Microsoft Store apps, and then crosses platforms entirely to enrol Ubuntu 22.04 via the Intune Linux agent.