Microsoft Security | Intune | Configuration
Setting up and managing device configurations using Intune
Intune policy application depends on when the device checks in (syncs) with the Intune service. A delay of several hours is expected in many cases.
Key points:
- Normal (maintenance) check-ins
- All platforms have an estimated maintenance check-in of about every 8 hours.
- Independently of the client schedule, devices are only allowed one maintenance sync every 6.5 hours.
- Newly enrolled devices (after first enrollment they sync more frequently, then slow down):
- Windows / Android, AOSP: Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, then around every 8 hours.
- iOS/iPadOS / macOS: Every 15 minutes for 1 hour, then around every 8 hours.
- Change-based syncs
- When a policy/profile/app is assigned, updated, or deleted, Intune sends a push notification to online devices to sync.
- The notification can be immediate up to a few hours, and behavior varies by platform.
- If the device is offline or cannot reach the push-notification endpoints, it will only get the policy on its next scheduled check-in.
- Manual (single-device) sync
- Admins can trigger a device sync from the Intune admin center.
- End users can trigger a sync from the Company Portal app or website (for example, when checking compliance status).
- This forces a check-in so policy changes apply sooner instead of waiting for the next maintenance cycle.
- Reporting delay
- Even after the device receives and applies the policy, Intune reports can take additional time to show the latest status in the portal.
If a policy still appears not applied after several hours, verify that:
- The device is powered on and has network connectivity.
- Required push-notification endpoints are reachable (see Intune network endpoints).
- A manual sync has been attempted from either the Intune admin center or the Company Portal.
References: