Practical guide

How to find deprecated settings in Intune Settings Catalog policies

Intune keeps deprecated settings in the Settings Catalog and still accepts them in policies, so a policy can carry them for years without a warning. Microsoft marks a deprecated setting only in its name or description, for example [Deprecated] or (obsolete), and Microsoft Graph has no deprecation flag. To find them, compare the setting IDs in your policies with the current catalog, with a Microsoft Graph script or with a hygiene scan in TenuVault.

Start with Community Plans and features

At a glance

Microsoft Graph has no structured deprecation flag on Settings Catalog setting definitions; deprecation appears only in the display name or description.
In a check on 30 October 2026, 622 of 18,620 Settings Catalog definitions called themselves deprecated or obsolete in their name, or described the setting itself as deprecated.
Deprecated settings stay visible in the Intune admin center, and Microsoft Graph still accepts them when a policy is created.
The catalog names no replacement setting and no end-of-support version for a deprecated setting.
TenuVault Pro and MSP flag deprecated settings in the hygiene scan of the latest backup, and the TenuVault restore wizard warns about them before a restore.

How Microsoft marks a deprecated setting

Every setting you can add to a Settings Catalog policy has a definition in Microsoft Graph, under deviceManagement/configurationSettings. A policy stores only the definition ID of each setting it configures, so the definition is where you look to learn whether a setting is deprecated.

There is no deprecated property on a definition. Microsoft writes it into the text instead. The display name carries it in forms such as [Deprecated] Disable Internet Explorer 11 as a standalone browser, Enable renderer code integrity (deprecated) or a name ending in (obsolete). Many Microsoft Edge and Google Chrome policies say it in the description: This policy is deprecated. Settings Microsoft plans to retire can start their description with [to be deprecated].

Read the description carefully. Some descriptions mention a technology that is deprecated, for example browser extension Manifest V2, without the setting itself being deprecated. Only a name that says deprecated or obsolete, or a description that says this policy or this setting is deprecated, is a reliable signal.

Check your policies with Microsoft Graph

You can run the check yourself with any Microsoft Graph client. The read-only permission DeviceManagementConfiguration.Read.All is enough. The steps below use the beta endpoint, which is the one Settings Catalog policies are managed through.

Read the whole catalog with GET /beta/deviceManagement/configurationSettings?$select=id,displayName,description. Do not add $top: on this endpoint it shortens the list without returning a next link. The full list came back in one response of about 18,600 definitions when this guide was written.
Read each Settings Catalog policy with GET /beta/deviceManagement/configurationPolicies/{id}?$expand=settings and collect every settingDefinitionId, including the child settings nested inside groups and choices.
Look up each ID in the catalog. Flag it when the display name contains deprecated or obsolete, or the description says this policy is deprecated or this setting is deprecated. Treat a description that starts with [to be deprecated] as an early warning.
An ID that is missing from a complete catalog read was probably removed from the catalog after the policy was created. Treat it as possible, not certain, and never conclude it from a partial read.

Find them with TenuVault

TenuVault runs the same check for you. In Governance, Conflicts and hygiene, click Scan latest backup. The scan reads your latest complete backup and the current Settings Catalog, and each Deprecated settings finding names one setting and every policy that configures it. Settings announced as [to be deprecated] are listed separately at low severity, and a setting that is missing from a complete catalog read is marked possible only.

The scan never changes a policy. If the catalog cannot be read, the check is shown as not made instead of clean. Findings can be acknowledged, marked as a false positive with a reason, or exported as CSV or JSON. The hygiene scan is part of Pro and MSP.

The restore wizard runs the same catalog check. A Settings Catalog policy with deprecated settings shows a warning before you restore it, so an old backup does not quietly bring a retired setting back. The warning never blocks the restore.

What to do with a deprecated setting

Deprecated does not prove that a setting has stopped working on devices. It means Microsoft no longer recommends it and may remove it. Check the product documentation for the setting, for example the Microsoft Edge policy reference, to learn whether a newer setting replaces it, because the catalog does not say.

Take a backup before you edit the policy, then remove or replace the setting and test the change on a pilot group first. If the change causes problems, you can put the previous version of the policy back from the backup.

Read the technical guides

Product scope reviewed 31 October 2026. Check your installed release and the current plan table before using a workflow.

Frequently asked questions

Does Intune warn me about deprecated settings in my policies?

Not in a central report. Deprecated settings keep their [Deprecated] or (obsolete) label in the Settings Catalog, but the admin center does not list which of your existing policies use them. You find them by comparing your policies with the current catalog, with a Microsoft Graph script or a tool such as TenuVault.

Is there a deprecated flag in Microsoft Graph?

No. Settings Catalog setting definitions have no deprecation property. Microsoft marks deprecation in the display name or the description of the definition, so a check has to read that text.

Do deprecated Intune settings still apply to devices?

Often they still do, at least for a while. Deprecated means Microsoft no longer recommends the setting and may remove it. Check the product documentation for the setting before you remove it, and test the change on a pilot group.

Does the catalog say which setting replaces a deprecated one?

No. The catalog names no replacement and no end-of-support version. Look in the documentation of the product the setting belongs to, for example the Microsoft Edge or Microsoft Defender policy reference.