Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune

Written By Anoop C Nair
Last Updated December 3, 2024
Posted In Intune
SHARE

Config Refresh is a feature in Microsoft Intune that helps minimize security policy drift on Windows 11 devices managed through Mobile Device Management (MDM). If policies are accidentally modified or altered, Config Refresh automatically detects the changes and restores the policies to their intended state.

This ensures that devices remain compliant with IT security standards, reducing risks and maintaining consistency across the managed environment. Microsoft Intune offers several tools to manage Windows security and improve user experience. For example, Conditional Access and Device Compliance ensure that only secure devices can access your apps and resources.

With Endpoint Privilege Management, IT admins can allow standard users to perform specific tasks, like installing approved software, without giving them full admin rights. The Settings Catalog is regularly updated with new options to configure Windows devices more effectively.

A new feature called Config Refresh helps maintain compliance by automatically fixing security policies if they are accidentally changed or altered. This post provides all the details of the Config Refresh to Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune.

Patch My PC

Config Refresh Minimize Security Policy Drift on Windows 11

IT administrators can simplify the user experience by removing unnecessary features, such as widgets, on employee devices. This can be achieved by configuring the Intune Widget policy to turn off widgets, ensuring users’ more focused and efficient workspace.

  • Sign in to the Intune Admin Center portal  https://intune.microsoft.com/.
  • Once logged in, navigate to the “Devices” section on the left side of the Intune admin center.
  • Under “Devices,” select “Configuration profiles.”
  • On the configuration page, you will find a set of menus, including options like Widget.
Configuration SettingsSetting Options
Widgets1. Allow Widget
2. Not Allowed
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Table 1
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.1 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.1 – Creds to MS

Widget Successfully Disabled

As shown here, the widget has been successfully turned off. The screenshot below provides more details.

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.2 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.2 – Creds to MS

Re-enabling Widgets via Registry for Admin Users

Users with admin rights can change the device registry to turn the widgets back on. To do this, they must enter 1 as the value data, set the base to Hexadecimal, and click OK.

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.3 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.3 – Creds to MS

Widget Enabled – Non-Compliant with Company Policy

You can now see and use the widget, but this action does not follow company policy.

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.4 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.4 – Creds to MS

Config Refresh uses a scheduled task that runs every 90 minutes by default to reset IT admin policy settings. It can be set to run as often as every 30 minutes and works even when the device is offline without needing to connect to the server. After Config Refresh runs, the widget setting is reset to “disable” as the IT admin intended, making it unusable again.

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.5 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.5 – Creds to MS

The registry will also show the correct configuration after Config Refresh runs. This feature can be enabled in Intune and is available on Windows 11 devices.

Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune - Fig.6 - Creds to MS
Config Refresh Minimize Security Policy Drift on Windows 11 Managed Devices by MDM Intune – Fig.6 – Creds to MS

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Resources

Secure and resilient Windows strategy from Client to Cloud

Author

Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Intune

Simplify Windows Devices to Run Only the Required Applications using Intune

Key Takeaways Hey, let’s learn about Simplify Windows Devices to Run Only the Required Applications using Intune. This policy lets administrators replace the default windows shell with a custom or lightweight shell. it improves performance by using system resources and is useful for devices that run a dedicated application. If the policy is disabled or […]

AC Anoop C Nair 8 min read
Intune

Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune

Key Takeaways In this post we are discussing about Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune. Microsoft has announced the general availability of Custom Compliance Settings for macOS in Microsoft Intune. The feature helps organizations strengthen security controls while supporting many types of macOS management scenarios. […]

AC Anoop C Nair 4 min read
Intune

Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune

Key Takeaways In this post we are discussing Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune. Microsoft Intune has received a new update that expands firmware management capabilities for Samsung Galaxy devices through Firmware Versionsintegration. This enhancement gives IT administrators more control over firmware and operating system updates, helping them […]

AC Anoop C Nair 4 min read
Intune

MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys

Key Takeaways Microsoft Intune 2607 introduces Windows Registry Data collection in Device Inventory, allowing IT admins to verify actual device configurations without relying on custom discovery or remediation scripts. Using the Properties Catalog, admins can collect registry information through Single Value, All Values Under a Key (Non-Recursive), or Same Value Across Subkeys. MS Intune Adds […]

AC Anoop C Nair 5 min read