Intune Configuration Linter

How it works

Paste one profile object or an array of profiles. The linter reads the assignments, the settings and the profile type, then reports findings across six categories. Because conflicts only appear when policies overlap, paste every policy that targets the same devices or users.

What it checks

Validation. Profiles with no name, no settings, or settings with no value.
Assignment. Profiles that are not assigned to any group and therefore never apply.
Deprecation. Policy types Microsoft has deprecated in favour of the settings catalog.
Conflict. The same setting set to different values across policies.
Compatibility. Scope mismatches, such as a device-scope setting referencing HKCU.
Precedence. Settings configured at both user and device scope.

How conflicts actually resolve

Intune's behaviour depends on the policy types involved, and the linter states the rule it is applying rather than guessing:

Two configuration profiles that set the same setting to different values cause a conflict, and the setting is not applied.
A compliance policy takes precedence over a configuration profile for the same setting.
Between two compliance policies, the most restrictive value applies.
Where a setting exists at both user and device scope, user scope takes precedence.

Resolve conflicts by assigning profiles to non-overlapping groups, excluding the overlap, or aligning the values so only one policy manages a setting per target.

Supported scenarios

Reviewing a set of policies before you roll them out.
Auditing a tenant for unassigned and deprecated profiles.
Finding why a setting is not applying across overlapping policies.

Common problems

Conflicts only appear when overlapping policies are linted together — paste them all.
The linter is advisory. It flags patterns that commonly go wrong, not every possible misconfiguration.
Detection rules are covered by the Detection Rule Linter, not here.

Detection Rule Linter · OMA-URI Policy Builder · All tools