Question

You deploy the Microsoft Defender for Endpoint security baseline and, separately, a device configuration profile to the same group of Windows 11 devices. The baseline sets a firewall setting to 'Enabled', while the configuration profile leaves the same firewall setting configured as 'Not configured' but sets a different value for the same underlying CSP setting to 'Disabled'. In the Intune admin center, the affected devices report a conflict for that setting. What is the resulting state applied to the devices, and how should you resolve it?

Accepted Answer

The setting remains in an error/conflict state and is not reliably applied; you must remove the conflicting value from one policy so only a single policy configures that setting.

Answer

The security baseline always wins over device configuration profiles, so the setting is applied as 'Enabled' and no action is needed.

Answer

The most recently modified policy wins automatically, so the setting is applied as 'Disabled' with no further action required.

Answer

The device configuration profile always takes precedence over baselines, so the setting is applied as 'Disabled' and you should delete the baseline.