TenuVaultDesktopPractical guide
How to find conflicting settings and duplicate Intune policies
A conflict happens when two Intune policies configure the same setting with different values for the same device. Intune reports it per device, with the policies involved, after devices have checked in. To find conflicts before they reach devices, compare the settings of all your policies with each other and check which ones can target the same users or devices. The same check finds duplicate profiles that differ only by name. TenuVault runs it as part of its hygiene scan on Pro and MSP.
At a glance
- Intune marks a device Conflict when two settings applied to it cannot be resolved, and the device view lists the policies that contain the conflicting setting.
- Microsoft states that compliance policy settings take precedence over configuration profile settings, and that conflicts between configuration policies must be resolved manually.
- Device reports show conflicts only after devices check in, and only for devices that actually received both policies.
- TenuVault's hygiene scan flags Settings Catalog settings configured with different values in policies whose targets may reach the same devices or users, from the latest backup.
- Without group membership and filter evaluation, a possible overlap stays possible, never proven.
Find conflicts Intune already reports
Open a configuration profile in the Intune admin center and look at its device and user status. A device in the Conflict state received two settings that Intune could not resolve, and an administrator should review it. Select the device to see every policy and profile that contains the conflicting setting.
Microsoft also documents how some overlaps resolve: compliance policy settings take precedence over configuration profile settings, and a conflict between two configuration policies is shown in Intune for you to resolve manually. Fix it by removing the setting from one policy or by changing assignments so the two never meet.
Find conflicts before they reach devices
Device reports only show conflicts that already happened. To catch them earlier, list every setting each policy configures and look for the same setting with different values in policies for the same platform. Then check whether their assignments can reach the same users or devices.
That last step is the hard part. Two policies assigned to different groups can still meet on a user who is in both, and assignment filters can narrow or widen the overlap. A check that cannot evaluate group membership and filters should call such overlaps possible rather than certain.
Find duplicate profiles
Duplicates are policies with identical configuration apart from name, description, assignments and scope tags. They often come from copies made for testing or from importing the same baseline twice. They do not conflict, but they make every later change twice as risky, because someone edits one copy and not the other.
Run the check with TenuVault
In TenuVault, open Governance, Conflicts and hygiene, and click Scan latest backup. The scan reads your latest complete backup and reports conflicting settings, duplicate profiles, unassigned policies, broken references and deprecated settings. Findings that need group, filter or device context to confirm are marked possible.
Each finding shows the policies and setting values involved. You can acknowledge it, mark it as a false positive with a reason, or document the difference as a deliberate customization. The scan never changes or deletes a policy. Conflicts and hygiene is part of Pro and MSP.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
What happens when two Intune policies conflict?+
Intune marks the device Conflict for that setting and lists the policies involved in the device view. Compliance policy settings take precedence over configuration profile settings; a conflict between two configuration policies has to be resolved manually by an administrator.
How do I find which policies cause an Intune conflict?+
Open the profile's device status in the Intune admin center and select a device in the Conflict state. The detail lists every policy and profile that contains the conflicting setting.
Can I find Intune conflicts before devices report them?+
Yes, by comparing the settings of all policies with each other and checking whether their assignments can overlap. TenuVault's hygiene scan does this from your latest backup and marks overlaps that depend on group membership as possible.
Does TenuVault fix conflicts automatically?+
No. The scan reports findings and never changes a policy. You resolve the conflict in Intune, or record it as a deliberate customization with a reason.