How to bulk-assign Intune configuration profiles

Bulk-assigning Intune configuration profiles is mostly a matter of deciding the assignment model once — a handful of broad groups narrowed by filters, with a standard exclusion group — and then applying it consistently, by hand for a few profiles or via Graph for many. The portal offers no multi-select; the win comes from having fewer, wider assignments rather than from clicking faster.

This page assumes profiles already exist and the question is how to get them onto the right devices. The design reasoning — what belongs in a baseline, why Settings catalog beats templates, and how compliance and Conditional Access hang off it — is in Microsoft Intune and device management; the Cloud PC variant is in Intune baseline for Cloud PCs.

Prerequisites

• Intune Administrator or Policy and Profile Manager role in Intune RBAC.
• Assignment groups agreed and created: at minimum INT-Devices-Windows-Pilot, INT-Devices-Windows-Prod (or the built-in All devices virtual group), and INT-Exclude-Baseline for the devices that must never receive the baseline (conference-room PCs, Teams Rooms, lab machines).
• Filters created under Intune → Tenant administration → Filters: Windows-Corporate ((device.deviceOwnership -eq "Corporate") and (device.osVersion -startsWith "10.0")), Windows-CloudPC (device.model -startsWith "Cloud PC"), macOS-All, and whatever your fleet needs. Filters are reusable across every policy type.
• For scripted assignment: Graph PowerShell SDK with DeviceManagementConfiguration.ReadWrite.All.

Steps

1. Decide the assignment for each profile

Write it down before touching the portal — a table of profile → include → filter → exclude. Two patterns cover most of it:

| Profile type | Include | Filter | Exclude | | --- | --- | --- | --- | | Device baseline (security, BitLocker, firewall, update rings) | All devices | Windows-Corporate (or per-OS) | INT-Exclude-Baseline | | User settings (OneDrive KFM, Office, user certificates) | All users | none, or Windows-Corporate in include mode | INT-Exclude-Users-Kiosk |

Pilot first: the same profile assigned to INT-Devices-Windows-Pilot for a week, then switch the include to All devices. Do not leave both assignments in place; identical settings from two assignments are harmless, but conflicting versions of the same profile are not.

2. Assign in the portal

Intune → Devices → Configuration → the profile → Properties → Assignments → Edit. Under Included groups: Add all devices (or a group), then the Filter link → Include filtered devices in assignment → choose the filter. Under Excluded groups: the exclusion group. Review + save.

Repeat per profile. Settings catalog profiles, endpoint security policies (Endpoint security → Antivirus / Disk encryption / Firewall), and compliance policies all use the same assignment pane.

3. Script it for many profiles

For each profile, collect its ID from the URL or via Graph, then assign. Settings catalog policies live under configurationPolicies; classic templates under deviceConfigurations. Example for a Settings catalog policy with All devices, a filter, and an exclusion group:

Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"
$policyId  = "<configurationPolicy id>"
$filterId  = "<filter id>"
$excludeId = "<exclusion group id>"
$body = @{
  assignments = @(
    @{ target = @{
        "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget"
        deviceAndAppManagementAssignmentFilterId   = $filterId
        deviceAndAppManagementAssignmentFilterType = "include" } },
    @{ target = @{
        "@odata.type" = "#microsoft.graph.exclusionGroupAssignmentTarget"
        groupId = $excludeId } }
  )
} | ConvertTo-Json -Depth 6
Invoke-MgGraphRequest -Method POST -Body $body -ContentType "application/json" `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/$policyId/assign"

Loop over a CSV of policy IDs. Note that assign replaces all assignments on the policy — include every target you want in one call. The Graph API basics guide explains the beta-vs-v1.0 choice; assignment endpoints are still beta for several policy types.

4. Force a check-in on pilot devices

Devices → the device → Sync, or Get-ScheduledTask -TaskName "PushLaunch" | Start-ScheduledTask on the device. Policy normally applies within the next check-in (roughly every 8 hours for configuration, faster for new enrolments).

Verify

• Devices → Configuration → the profile → Device status shows Succeeded climbing and no Conflict entries. A Conflict means two profiles set the same setting differently — fix the design, do not just reassign.
• On a device, Settings → Accounts → Access work or school → Info → Managed by lists the applied areas; Get-ChildItem HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device shows the CSP values.
• The Filters page shows evaluation results per filter, which is where a filter that matches nothing reveals itself.
• The Endpoint Analytics Device scores do not regress after the rollout.

Roll back

Change the assignment back to the pilot group (or remove it): Intune stops enforcing the settings, but most CSP settings stay at their last value on the device — removal is not an undo. To restore a setting, assign a profile that sets it explicitly to the previous value. Because assign replaces everything, a scripted rollback is the same script with the previous assignment set, which is a good reason to export current assignments to JSON before the bulk change.