Resolve policy conflicts

Windows Autopatch deploys Microsoft Intune policies to enrolled tenants, and continuously monitors the Microsoft Intune policies. Conflicts can happen when there are two policies in the tenant, and they update the same setting to different values. For Windows Autopatch to successfully deliver updates to registered devices, it's critical for the devices in the service to have the policy targeted and assigned successfully.

When the Windows Autopatch service detects policies in the tenant that conflict with a setting in another Intune device policy, this conflict is displayed. It's necessary to review the policies and their settings and manually resolve these conflicts.

With this feature, IT admins can view:

• A list of all Autopatch policies that conflict with other device policies in the tenant
• A summary view of conflicting policies, affected devices, and open alerts
• A detailed view of affected devices
• Alerts that include details of conflicting policies, the settings, and the Azure AD groups they're assigned to. Admins must take necessary action so the expected policy is successfully assigned to the device

Resolve policy conflicts overview

Alerts are raised when devices report policy conflicts. Autopatch policies are assigned to Autopatch groups. Devices that are members of Autopatch groups are expected to receive only Windows Autopatch policies.

Once you resolve the conflict, it can take effect on the device at the next Intune sync. This view is refreshed every 24 hours. It can take up to 72 hours after the conflict is resolved for the view to be updated.

Policy conflict view

This view includes the list of Windows Autopatch policies (Expected policies) that are assigned to various Windows Autopatch groups that include devices. When the Expected policy can't be successfully assigned to one or more devices, because of an equivalent setting in another Intune policy targeting the device, the conflict is detected, and reported as a Conflicting policy.

If the Expected policy conflicts with multiple Intune policies, each conflict is displayed in different lines in the Policy conflict view.

To view all policies conflicting with the Expected policies:

1. Go to the Microsoft Intune admin center.
2. Navigate to Devices > Managed updates > Windows Updates > Monitor > Policy health.
3. In the Policy conflicts tab, the list of expected policies and conflicting policies is displayed.
4. Select View alert and review the details of the Recommended action and alert details.

Policy conflict view alert details

All alerts displayed in this flyout include the following details. You must review the details and take action to resolve the conflict.

Affected devices view

This view includes the list of devices with policy conflicts with the Expected policy. It's possible for devices to have multiple conflicting policies, due to their membership in various groups.

You can navigate to this view from the Affected devices column link in the Policy conflicts view, or directly from Policy health blade. This page displays a filtered device list, when navigating from the Policy conflicts view. Affected devices only include devices that have a successful Intune sync status in the last 28 days.

To view the alert details and perform the recommended actions:

1. Go to the Microsoft Intune admin center.
2. Navigate to Windows Autopatch > Policy health > Affected devices tab.
3. Select View alert to see the alert details.

Affected devices view alert details

In this flyout, when the device is reporting conflicts due to multiple policies, each policy is displayed, as a separate section in this alert. This occurs when the device is a member of multiple groups, and each policy conflicts with the Expected Windows Autopatch policy.

Options