INTUNE-004: Configuration profile inventory
- Platform
- Entra ID / M365
- Category
- Intune / Endpoint Management
- Severity
- Info
- Zero Trust pillar
- Devices (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Configuration profiles push security settings, restrictions, and feature configurations to enrolled devices. An incomplete inventory of configuration profiles can lead to security gaps where critical settings such as screen lock, Wi-Fi security, or certificate deployment are not applied. Understanding the full scope of configuration profiles is necessary for identifying coverage gaps across the device fleet.
Recommended value
Documented inventory of all configuration profiles with clear naming conventions and assignment documentation
Remediation
Export the complete list of configuration profiles from Intune and review each profile's purpose, platform target, and current assignment status. Identify any profiles that are unassigned, conflicting, or redundant and consolidate where appropriate. Establish a naming convention and documentation standard for all profiles to facilitate ongoing management and auditing.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-8