I have a conflict with two security baselines. I created an excluded group, but no all devices are updating.

Question

Devices are not clearing from previous security baselines.

Answer 1

@MarketShare, Thanks for posting in Q&A. From your description, it seems some devices are not working when we configure exclude in policy assignment. For the Include, it seems we configure All devices. For the exclude group, we need to configure a device group. Could you confirm if the exclude group is only with devices as the members?

After we set the exclude, then please go to the affected device side, Accounts->Access Work or School, find the account, info, choose Sync to see if it can sync successfully. After the sync is completed, wait some time to see if the conflict disappears in Intune portal.

Meanwhile, you mentioned "Devices are not clearing from previous security baselines.". Could you confirm if you mean the setting kept on the device side? If yes, this can be that the CSP keep the setting. In fact, Intune settings are based on the Windows configuration service provider (CSPs). The behavior depends on the CSP. Some CSPs remove the setting, and some CSPs keep the setting, also called tattooing.

https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#a-profile-is-deleted-or-no-longer-applicable

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.