Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
MDM Wins Over GPO Group Policy Vs Intune Policy

MDM Wins Over GPO Group Policy Vs Intune Policy

Written By Vimal Das
Last Updated July 27, 2026
Posted In Intune
SHARE

Let’s check MDM wins over GPO options available as Intune policy. The Group Policy Vs. Intune Policy Who wins? Windows modern device management relies on CSP for security & other configurations.

Many discussions about whether CSP can replace Group Policy (GPO). By default, GPO has higher precedence over CSP when a setting conflict occurs.

However, starting with Windows 10 1803, this behavior is controllable with CSP “MDMWinsOverGP.” With this new Windows MDM CSP setting, we know Microsoft’s long-term roadmap for modern device management. Group Policy vs. Intune Policy: Who wins?

Let’s also find more details on migrating group policies (GPOs) to the Intune Settings Catalog policy. You don’t have to migrate every GPO to MDM, but you must review each GPO and then migrate it to MDM if needed.

Patch My PC

Prerequisite MDM Wins Over GPO

NOTE! This MDM wins over Group Policy CSP, but it doesn’t work for Windows Update for Business policies as well. Hence, when you use WUfB, ensure all the group policies related to Windows Update are removed.

Let’s check the prerequisites for MDM winning over GPO settings. This setting doesn’t work for any custom GPO out of ADMX, like Edge.

Prerequisite MDM Wins Over GPO
Windows 10 1803 version
Microsoft Intune
Active Directory Group Policy
MDM Wins Over GPO Group Policy Vs Intune Policy – Table 1

MDM Wins Over GPO – MDM CSP Details

In this post, we will go through the “MDMWinsOverGP” setting and the conflicting settings. I deployed different Home page URLs for the demo using Intune CSP and GPO. Finally, we will see who wins.

  • OMA-URI: ./Vendor/MSFT/Policy/Config/Browser/Homepages
  • Value (home page example): CSP.com
MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.1
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.1

For MDM CSP to override GP, we must enable the ” MDMWinsOverGP ” setting. The following are the values for this MDM Wins Over GPO policy.

  • 0 – (default) – GPO Wins over MDM?
  • 1 – The MDM policy is used, and the GP policy is blocked.

Option #1 (New Method) – Intune Settings Catalog | Create MDM Wins Over GPO Policy

As the following blog post explains, you can now create an Intune Settings Catalog policy to deploy MDM wins over GPO policy. For more details, see Create Intune Settings Catalog Policy.

  • Sign in to the Microsoft Endpoint Manager admin center (Endpoint.Microsoft.coom)
  • Select Devices -> Windows -> Configuration profiles > Create profile.
  • In Create Profile, You can select Platform: Windows 10 and later and Profile: Select Settings catalog (preview).
  • Click on the Create button.

In Configuration Settings, select Add Settings and use the following search keyword: “MDM Wins Over GP.” You need to choose the MDM Wins Over GP policy from the list.

Browse by category – “Control Policy Conflict.”
Category and Setting name = MDM Wins Over GP

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.2
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.2

Select the following option from the drop-down menu ->The MDM policy is used, and the GP policy is blocked.

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.3
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.3

Option #2 (Old) – Intune Configuration of “MDMWinsOverGP” – MDM Wins Over GP

Let’s follow the steps below to MDM Wins Over GPO.

  • Login to MEM Admin Center Portal.
  • Navigate Devices – Create a profile – Settings – Configure.
  • Custom OMA-URI Settings – Windows 10 and later – Add OMA-URI settings (as shown below)

./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.4
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.4

Validation of MDMWinsOverGP (CSP Policies Override Group Policy Settings)

Now we will observe the client-side events using the Event Viewer in the following location:

  • Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider
  • The value for “MdmWinsOverGp” is 0 before applying the CSP.

MdmWinsOverGp Policy value is (0x0)

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.5
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.5

The “MdmWinsOverGp” value changes from 0 to 1 after applying the CSP.

MdmWinsOverGp Policy value is (0x1)

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.6
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.6

The policy is set for MdmWinsOverGp. MdmWinsOverGp Policy is being set.

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.7
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.7

Group Policy Vs. Intune Policy, who will win, and Microsoft allows us to select who will win.

Registry Analysis of CSP Policies Override Group Policy Settings

The registry was created to set MDM as a higher precedence than GP.

Computer\HKEY_LOCAL_MACHINE_Microsoft\PolicyManager\current\device\ControlPolicyConflict

Registry Analysis of CSP Policies Override Group Policy Settings
Default – Value Not Set
MDMWinsOverGP – 0x000000001 (1)
MDMWinsOverGP_ProviderSet – 0x000000001 (1)
MDM Wins Over GPO Group Policy Vs Intune Policy – Table 2
MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.8
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.8

If a GPO and MDM CSP conflict occurs in a setting, the current GP value saved before CSP takes precedence.

Attempted to save existing GP Value. GP Location: (Software\Policies\Microsoft\MicrosoftEdge\Internet Settings), GP ValueName: (ProvisionedHomePages), Result: (The operation completed successfully.). Failures are expected if this location isn’t set.

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.9
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.9

GP value gets deleted. Example: GP value “ProvisionedHomePages” deleted

Attempted to delete existing GP Value. GP Location: (Software\Policies\Microsoft\MicrosoftEdge\Internet Settings), GP ValueName: (ProvisionedHomePages), Result: (The operation completed successfully.). Failures are expected if this location isn’t set.

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.10
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.10

A block record was created to ensure MDM wins over GP. GP enforcement for the home page value is blocked.

Created a blocking record. Record: (Software\Microsoft\MDMWins\device\Software/Policies/Microsoft/MicrosoftEdge/Internet Settings\ProvisionedHomePages).
Uri: (./Device/Vendor/MSFT/Policy/Config/Browser/Homepages

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.11
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.11

Result – Intune Policies Override Group Policy Settings – The Winner is here Group Policy Vs. Intune Policy

Finally, MDM CSP wins over GP. As shown below, MDM CSP configures the “Home Page” value.

HomePages – CSP.com

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.12
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.12

Verify the MDM Diagnostics report ( Section “Blocked Group Policies” ). This report gives detailed information on the list of GP values blocked by MDM CSP.

Blocked GP Entity – device\software/Policies/Microsoft/MicrosoftEdge/Internet Settings
Blocked GP value Name – ProvisionedHomePages
Blocked Value – http://GPO.com
MDM Uris Blocking GP – ./Device/Vendor/MSFT/Policy/Config/Browser/Homepages

MDM Wins Over GPO Group Policy Vs Intune Policy - Fig.13
MDM Wins Over GPO Group Policy Vs Intune Policy – Fig.13

We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.

Author

Vimal has more than 10 years of experience in SCCM device management solutions. His main focus is on Device Management technologies like Microsoft Intune, ConfigMgr (SCCM), OS Deployment, and Patch Management. He writes about SCCM, Windows 10, Microsoft Intune, and MDT.

Written by

Vimal has more than 10 years of experience in SCCM device management solution. His main focus is on Device Management technologies like Microsoft Intune, ConfigMgr (SCCM), OS Deployment,Patch Management. He writes about the technologies like SCCM, Windows 10, Microsoft Intune and MDT.

Discussion · 2 comments

  1. Hi Vimal,

    What will be your suggestion (GP or CSP) or for a closed Win10 (Version 1607) system with the intention to shut down all external connections at login and optional to enable the Eth/USB based on needs?

    Thanks.

    Regards,
    Frank

    Reply

  2. This settings doesn’t work for any custom GPO out of ADMX like Edge etc.. & it may likely be depreciated in future is what i understand from MS.

    Reply

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Intune

Simplify Windows Devices to Run Only the Required Applications using Intune

Key Takeaways Hey, let’s learn about Simplify Windows Devices to Run Only the Required Applications using Intune. This policy lets administrators replace the default windows shell with a custom or lightweight shell. it improves performance by using system resources and is useful for devices that run a dedicated application. If the policy is disabled or […]

AC Anoop C Nair 8 min read
Intune

Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune

Key Takeaways In this post we are discussing about Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune. Microsoft has announced the general availability of Custom Compliance Settings for macOS in Microsoft Intune. The feature helps organizations strengthen security controls while supporting many types of macOS management scenarios. […]

AC Anoop C Nair 4 min read
Intune

Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune

Key Takeaways In this post we are discussing Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune. Microsoft Intune has received a new update that expands firmware management capabilities for Samsung Galaxy devices through Firmware Versionsintegration. This enhancement gives IT administrators more control over firmware and operating system updates, helping them […]

AC Anoop C Nair 4 min read
Intune

MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys

Key Takeaways Microsoft Intune 2607 introduces Windows Registry Data collection in Device Inventory, allowing IT admins to verify actual device configurations without relying on custom discovery or remediation scripts. Using the Properties Catalog, admins can collect registry information through Single Value, All Values Under a Key (Non-Recursive), or Same Value Across Subkeys. MS Intune Adds […]

AC Anoop C Nair 5 min read