Config lists the Intune configuration profiles Eido has found in your tenants, such as settings catalog policies and device configuration profiles. For each one it shows how many devices and users it reaches and what share of them applied it successfully. From there you can open the devices behind the number, and from a device you can see the individual settings that are in error or in conflict.
It is under Policy & App Health in the sidebar. Everyone who signs in can open it. An administrator can block or filter the data behind it for a role.
What the list shows#
There is one row for each configuration profile in each Intune tenant, opening with the profiles that have the most unhealthy deployments.
| Column | What it means |
|---|---|
| Customer | The customer the tenant belongs to. Only shown when you look after several customers and have not picked one. |
| Intune Tenant | The tenant the profile lives in. |
| Policy Name | The profile’s name in Intune. |
| Assigned | Yes for every profile in the list. A profile appears here once at least one device or user is reporting a state for it. |
| Total Deployments | How many states Intune has reported. A profile can report once for the device and again for each user, so this can be more than your device count. |
| Device Deployments | The deployments reported for the device itself. |
| User Deployments | The deployments reported for a user on a device. |
| Healthy % | Healthy deployments as a share of Total Deployments, rounded to a whole number. Blank when there are no deployments. |
Healthy % is green at 90 or more, amber from 75 to 89, and red below 75.
What counts as healthy#
Eido turns the state Intune reports for each deployment into a status.
| Status | Icon | When |
|---|---|---|
| Healthy | Green tick | Intune reports succeeded or not applicable. |
| Medium | Amber triangle | Intune reports anything else, such as error, conflict or pending, and the profile’s severity is Medium. |
| High | Red triangle | The same, and the profile’s severity is High. |
| Unknown | Grey question mark | Intune sent no state for that deployment. |
A newly discovered configuration profile starts at Medium. An administrator can change each profile to Ignore, Medium or High in the tenant’s settings under Config Policies, or switch on Advanced to decide state by state. For example, you might treat pending as healthy for a profile that is slow to report. See Tenant settings.
A device’s Config status is the worst status of any configuration profile on it. A device that is Medium or High on a profile gets an issue for it.
Find a profile#
- Search… matches any part of the name.
- Add Filter narrows the list by Customer, Intune Tenant, Policy Name or Assigned.
- Press a column heading to sort.
- Columns opens Select Columns to show, hide and reorder columns. Reset to Defaults puts them back. Your layout is remembered.
- Export as CSV downloads every matching row with the columns you have showing.
See the devices behind a profile#
Press a profile to open its devices in a panel on the right.
| Column | What it means |
|---|---|
| Policy Name | The profile you opened. |
| Device | The device’s name. |
| User | The device’s primary user. |
| Assignment Status | The Eido status, as an icon. High comes first, then Medium, Healthy and Unknown. |
| Assignment Type | Device or User, depending on who the state was reported for. |
| Assignment State | The state exactly as Intune reported it, for example error or conflict. |
| First Seen | When Eido first saw this profile on this device. |
Press a row to open the device in Device details. Export as CSV takes the whole list.
See which setting is failing, or in conflict#
A profile can hold hundreds of settings, and usually one or two are the problem. To see them, open the device.
-
Open the device
Press its row in the profile’s device list.
-
Open Config Policies
In the device’s left-hand menu, choose Config Policies, then press the profile’s line to expand it.
-
Press a row inside the profile
A panel opens with the profile’s settings for this device, read from Intune at that moment.
Each setting shows its state, Intune’s explanation where there is one, and where available its value, error code, the user it applies to and the setting’s path. Errors and conflicts are red, non-compliant settings amber, and compliant ones green.
- Problems only is on when at least one setting is in error, in conflict or non-compliant. Switch it off to see every setting.
- Refresh asks Intune again. The line beside it shows when Eido retrieved the data and how old Intune’s own data is.
Nothing in this panel is stored, so it is always what Intune says now. There is more about it in Device details.
Which policies are fighting#
A setting in Conflict usually has an arrow beside its name. Press the setting to see Policies delivering this setting: every policy that sets it on this device, including the one you are looking at, which is marked (Current Policy).
| What you see | What it means |
|---|---|
| Value column | What each policy sets. It appears when Eido holds the settings of the policies involved. |
| “these policies set different values” | A real disagreement. Change one of the policies or its assignment. |
| “these policies all set the same value” | The policies agree, and Intune still reports a conflict because more than one of them delivers the setting. |
| Status column | Each policy’s own state for the setting, when the answer came from Intune. |
| “Reported by Intune for this device.” | Intune named the policies. |
| “From Eido’s synced policy settings, so this is policy intent rather than a device-reported fact.” | Intune could not name them for this type of policy, so Eido worked it out from the settings it holds for your policies. |
For Eido to hold your policies’ settings, Backup Policies must be on for the tenant. It is on by default. See Tenant settings.
Settings across every policy, and how they changed#
With Backup Policies on, Eido also keeps every setting of every policy, and its history. That is in Query Hub, as three views.
| View | Use it to |
|---|---|
| Policy Settings | Search the settings currently in force across all policies, for example to find every policy that sets a minimum password length. |
| Policy Settings History | See how a setting’s value has changed. Each row has Valid From, Valid To, Duration (days) and a Setting Status of Active or Historical. |
| Policy Setting Assignments | See settings as they land on devices. Policy Count is how many policies deliver the same setting to a device, and Value Count how many different values they set between them. |
The Intune Audit Logs view, also in Query Hub, shows who changed what in Intune and when. To put a policy back the way it was, an administrator can use Policy backups and templates.
In Query Hub you will also find Configuration Policies (this list, with Healthy, Unhealthy and Unknown counts) and Configuration Policy Detail (one row for each device and profile). Both are ready-made reports under Policy Health.
Why does it show that?#
A profile is failing everywhere, but only because it is still rolling out#
A deployment that Intune reports as pending is not healthy by default. Wait for devices to check in, or use Advanced on that profile to treat pending as healthy.
A profile is missing from the list#
A profile is listed once at least one device or user is reporting a state for it. If it is not here, either it is not assigned in Intune, or nothing has reported yet.
The conflict panel names no other policy#
The message says so: neither Intune nor Eido could name another policy delivering the setting. Intune’s report can lag a newly changed assignment, and Eido does not hold settings for every type of policy.
The setting panel says detail is not available#
| Message | What to do |
|---|---|
| Intune has no report for this policy on this device yet. It can take a while to appear after a policy is assigned. | Wait and press Refresh later. |
| Intune is rate limiting requests right now. Try again in a moment. | Wait a minute and press Refresh. |
| Eido does not have permission to read policy reports from this Intune tenant. | See Permissions Eido needs. |
| Intune does not publish a per-setting report for this policy type. | There is nothing more to show for this policy. |
The Policy Settings views are empty#
Backup Policies is off for the tenant, or the tenant has not finished a sync since it was switched on.
The list and Intune disagree#
Eido reads configuration states from Intune as part of syncing the tenant, about once an hour, and Intune’s reports can themselves lag the device. See What Eido syncs.