Intune policies

Intune Misunderstanding #1:

“Intune Pushes Policies to Devices”

A common explanation of Intune is:

“I assigned the policy, so Intune should push it to the device.”

That description is convenient, but it creates the wrong mental model for how Intune works—and how you should troubleshoot it.

What actually happens?

For Windows MDM management, think of Intune as maintaining the configuration that should apply to a device.

The device communicates with Intune through the MDM management channel and receives the configuration that applies to it. Windows then processes those instructions, often through Configuration Service Providers (CSPs).

The CSP applies the configuration locally in Windows. Depending on the setting, the resulting configuration or state may be represented in the registry, PolicyManager, a Windows component's own configuration store, or another system-managed location.

This is important: Intune itself is not running on the device enforcing every setting. Windows is.

A simplified flow is:

Assignment → Check-in → CSP/Windows processing → Local configuration → Enforcement → Reporting

Intune does use push notification services to tell devices that new management actions may be available. But the notification itself isn't the policy.

Think of the notification as:

“Something changed. Check in.” rather than: “Here is your new policy.”

Why does this matter?

Because these are different states:

Assigned ≠ Received ≠ Processed ≠ Enforced ≠ Reported

If you assign a policy and the setting doesn't appear on the device five minutes later, that doesn't automatically mean that “Intune failed to push it.”

The problem could be the assignment, device communication, MDM processing, the CSP responsible for the setting, the local Windows configuration, a conflict, or simply reporting latency.

This is also why repeatedly pressing Sync isn't a troubleshooting strategy. Sync can trigger communication, but it won't fix a configuration that Windows has already received and failed to process.

The better troubleshooting question

Instead of asking:

“Why didn't Intune push my policy?” ask: “Where in the management flow did it stop?”

Then work through:

Assignment → Check-in → Processing → Local configuration → Enforcement → Reporting

That small change in how you think about Intune makes troubleshooting much more systematic.

Key takeaway

Intune isn't simply a server pushing policies directly onto Windows devices.

Intune defines the desired configuration. The Windows MDM client receives it, CSPs and Windows components apply it locally, and Windows enforces it.

Understand that flow, and many seemingly random Intune problems become much easier to explain—and troubleshoot.