You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: intune/intune-service/configuration/device-profile-troubleshoot.md
+36-34Lines changed: 36 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Questions with policies and profiles in Microsoft Intune
3
3
description: Common questions, answers, and scenarios with device policies and profiles in Microsoft Intune. Learn more about profile changes not applying to users or devices, how long it takes for new policies to deploy, which settings apply when there are conflicts, what happens when you delete or remove a profile, and more.
4
4
author: MandiOhlinger
5
5
ms.author: mandia
6
-
ms.date: 04/28/2025
6
+
ms.date: 10/20/2025
7
7
ms.update-cycle: 180-days
8
8
ms.topic: troubleshooting
9
9
ms.reviewer:
@@ -29,54 +29,56 @@ This article applies to the following policies:
29
29
30
30
## Policy refresh intervals
31
31
32
-
When a device checks-in, it immediately checks for compliance, non-compliance and configuration for the current user/device context, receiving any pending actions, policies and apps assigned to it.
32
+
When a device syncs with Intune, it checks for configuration for the current user or device context, and receives any pending actions, policies, and apps assigned to it.
33
33
34
-
There are 4 main types of check-ins:
34
+
For app protection policy refresh intervals, go to [App Protection Policy delivery timing](../apps/app-protection-policy-delivery.md).
35
+
36
+
There are three main types of device syncs - change-based, client initiated, and single device.
35
37
36
-
**Scheduled check-ins** - These check-ins happen at predetermined intervals and can be initiated by the client or service depending on the platform. The check-ins are estimated as follows:
38
+
### Change-based
37
39
38
-
| Platform | Estimated refresh cycle|
39
-
| --- | --- |
40
-
| Android, AOSP | About every 8 hours |
41
-
| iOS/iPadOS | About every 8 hours |
42
-
| macOS | About every 8 hours |
43
-
| Windows PCs enrolled as devices | About every 8 hours |
40
+
These syncs happen when different actions trigger a notification for the device to sync. For example, a sync triggers when a policy, profile, or app is assigned (or unassigned), updated, or deleted. Or, when changes like Microsoft Entra group membership updates are made. Changes like adding an app as available don't cause an immediate notification to devices.
44
41
45
-
**End user driven check-ins** – These check-ins are driven by end users when they perform certain actions in the Company Portal app like going into **Devices** > **Check Status** or **Settings** > **Sync**to check for policy or profile updates or selecting an app for download.
42
+
Intune notifies online devices to sync with the Intune service. The notification times can vary from immediately up to a few hours. They can also vary between platforms. To learn more, see:
46
43
47
-
**Admin check-ins** - These check-ins are driven by admins when they perform certain actions on a single device from the Intune portal, like [device sync](../remote-actions/device-sync.md), [remote lock](../remote-actions/device-remote-lock.md) or [reset passcode](../remote-actions/device-passcode-reset.md). Other actions like [remotely assist users](../fundamentals/remote-help.md) do not cause a device check-in.
44
+
- Android - [Google Mobile Services (GMS) can affect policy refresh intervals](../apps/manage-without-gms.md#some-tasks-can-be-delayed)
45
+
- iOS/iPadOS - [Specific conditions can affect policy refresh intervals](/troubleshoot/mem/intune/device-configuration/2016341112-ios-device-is-currently-busy)
48
46
49
-
**Notification-based check-ins** - These check-ins happen through different actions that trigger a notification. For example, when a policy, profile, or app is assigned (or unassigned), updated, deleted, or when certain behind the scenes changes like Microsoft Entra group membership updates are made. Other changes don't cause an immediate notification to devices, like adding an app as available to your users.
47
+
An offline device, like when it's powered off, or a disconnected device, might not receive the notifications. In this case, the device gets the policy or profile on its next sync with Intune.
50
48
51
-
> [!IMPORTANT]
52
-
> To receive push notifications, devices must connect to specific network endpoints. For a list of network endpoints, see [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md#intune-dependencies).
49
+
> [!NOTE]
50
+
>
51
+
> - It can take more time for Intune reports to reflect the latest status of the policy on the device in the Intune portal.
52
+
> - To receive push notifications, devices must connect to specific network endpoints. For a list of network endpoints, see [Network endpoints for Microsoft Intune](../fundamentals/intune-endpoints.md#intune-dependencies).
53
53
>
54
-
> - For Windows, see [Windows dependencies](../fundamentals/intune-endpoints.md#windows-push-notification-services-wns-dependencies).
55
-
> - For Apple, see [Apple dependencies](../fundamentals/intune-endpoints.md#apple-dependencies).
56
-
> - For Android, see [Android dependencies](../fundamentals/intune-endpoints.md#android-aosp-dependencies).
Intune notifies online devices to check-in with the Intune service. The notification times vary from immediately up to a few hours.
59
-
These notification times also vary between platforms.
58
+
### Client initiated
60
59
61
-
- On Android devices, [Google Mobile Services (GMS) can affect policy refresh intervals](../apps/manage-without-gms.md#some-tasks-can-be-delayed).
60
+
The following client syncs happen in response to a device event or state change, like when a user signs into the device or if the malware status changes:
62
61
63
-
-On iOS devices, [Specific conditions can affect policy refresh intervals](/troubleshoot/mem/intune/device-configuration/2016341112-ios-device-is-currently-busy).
62
+
-**Maintenance syncs** - These syncs include a large number of client-initiated syncs and they occur at predetermined intervals. The client or service can initiate the sync, depending on the platform. The estimated check-in schedule for all platforms is about every 8 hours.
64
63
65
-
An offline device, such as a powered off, or a disconnected device, might not receive the notifications. In this case, the device gets the policy or profile on its next scheduled check-in with Intune.
64
+
Independent of the client schedule, devices are only allowed one maintenance sync every 6.5 hours.
66
65
67
-
> [!NOTE]
68
-
> It might take additional time for Intune reports to reflect the latest status of the policy on the device in the Intune portal.
66
+
-**Newly enrolled devices** - When devices first enroll, syncs run more frequently to run configuration, compliance, and noncompliance checks. The check-ins are estimated at:
69
67
70
-
Additionally, when devices first enroll, configuration check-ins run more frequently to perform configuration, compliance and non-compliance checks. The check-ins are estimated as follows:
68
+
| Platform | Estimated refresh cycle|
69
+
| --- | --- |
70
+
| Android, AOSP | Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours |
71
+
| iOS/iPadOS | Every 15 minutes for 1 hour, and then around every 8 hours |
72
+
| macOS | Every 15 minutes for 1 hour, and then around every 8 hours |
73
+
| Windows | Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours |
71
74
72
-
| Platform | Estimated refresh cycle|
73
-
| --- | --- |
74
-
| Android, AOSP | Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours |
75
-
| iOS/iPadOS | Every 15 minutes for 1 hour, and then around every 8 hours |
76
-
| macOS | Every 15 minutes for 1 hour, and then around every 8 hours |
77
-
| Windows PCs enrolled as devices | Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours |
75
+
### Single device
78
76
79
-
For app protection policy refresh intervals, go to [App Protection Policy delivery timing](../apps/app-protection-policy-delivery.md).
77
+
Admins or end users initiate these check-ins when they run certain actions on a single device:
78
+
79
+
-**End-users actions** - Includes actions made by users in the Company Portal website or app, like [checking the compliance status](../user-help/check-status-company-portal-website.md), syncing for policy or profile updates, or [installing apps](../user-help/manage-apps-cpweb.md#available-and-required-apps).
80
+
81
+
-**Admin actions** - Includes actions made by admins in the Intune admin center, like a [device sync](../remote-actions/device-sync.md), [remote lock](../remote-actions/device-remote-lock.md), or [reset passcode](../remote-actions/device-passcode-reset.md). Other actions like [remotely assist users](../fundamentals/remote-help.md) don't cause a device check-in.
80
82
81
83
## Company portal
82
84
@@ -178,7 +180,7 @@ For more information on dynamic groups, go to:
178
180
179
181
On Windows devices, when trying to sync in the **Settings** app > **Accounts** > **Access work or school**, you might see a `The sync could not be initiated (0x80072f9a)` error.
180
182
181
-
If the Trusted Platform Module (TPM) was reset to factory settings, then the device must reenrolled to resume syncing. The device's Microsoft Entra identity is stored in the TPM. So, if the ID is removed, then reenrollment is the only way to reestablish the Microsoft Entra identity.
183
+
If the Trusted Platform Module (TPM) was reset to factory settings, then the device must reenroll to resume syncing. The device's Microsoft Entra identity is stored in the TPM. So, if the ID is removed, then reenrollment is the only way to reestablish the Microsoft Entra identity.
0 commit comments