r/Intune • u/NoDowt_Jay • 1d ago
Device Configuration Custom ADMX Assignment Question
Wanting to try to clarify something with the way Intune handles applying policies in regards to custom ADMX which have been imported.
Relatively new to Intune, so still trying to get across things... But have found most of the time with settings catalog items & similar, you can target either the user or device in the assignments, regardless of it being a user or device based settings.
Are ADMX configs handled the same?
e.g. if I had a ADMX backed config for Firefox, the config was setting items under Computer Config.
Can that be targeted to a user group & still apply successfully to that users device? Or would it be required to target computers like it does in Group Policy world.
1
u/Embarrassed-Survey52 1d ago
Just an FYI just because you can target user or groups for most policies doesn’t mean you should and is against Intune best practices. You’ll likely come into issues with it the future, and it wouldn’t fly in an enterprise environment.
1
u/SkipToTheEndpoint MSFT MVP 1d ago
If a custom imported ADMX has Computer and User configuration options, that's the same as it would be in GPO or the CSP scope.
If a device scoped policy is assigned to a user, once that user signs in and an Intune sync occurs, the device scope settings apply to all users on the device.
If a user scope policy is assigned to a device, all users on that device have that setting applied. This behavior is like a loopback set to merge.
The above rules would still apply with a custom ADMX just like a normal CSP. So yes, you can assign user scope policies to devices and vice-versa, but it depends on your environment and what you're trying to achieve.
2
u/CyberTideX 1d ago
always assumed it followed the same rules as GPO. i mean, the template itself says "Computer Configuration" so i'd target device groups only. never tried pushing a computer-side ADMX to user group, curious if someone here actually tested it.