To add a Scope Tag to a Configuration Profile – Manage, maintain, and protect devices

After you have created one or more scope tags, you can add them to your device configuration profile using these steps:

1. In the Microsoft Intune admin center, select Devices.
2. Under Policy, select Configuration profiles.
3. Click the link for the relevant profile.
4. On the Device configuration profiles page for your profile, next to Scope tags, select Edit.
5. You can now choose to remove the Scope tags or modify the tags by clicking the Select scope tags.
6. On the Select tags blade, under Name, choose the scope tag(s) you want to add to the profile, as shown in Figure 3-23.

FIGURE 3-23 Add Scope Tags

7. Click Select.
8. On the Device configuration profile page for your profile, click Review + save, and then click Save.

The Intune Service Administrator and Global Administrator roles have full admin access to all Intune features, regardless of the configured scope tags.
Monitor and troubleshoot configuration profiles
It’s important to understand whether profiles are being correctly assigned and applied. It’s also important to be aware of conflicts with configuration profiles that contain mismatched or overlapping settings. Intune provides numerous ways to review and troubleshoot the application of configuration profiles on your organization’s devices.

Monitoring and troubleshooting the application of profiles

When you sign in to the Microsoft Intune admin center, you can access your Dashboard from the navigation pane. This contains a summary of device enrollment, device compliance, and device configuration, among other things.

You can quickly review enrollment, compliance, and configuration issues from the dashboard by selecting the relevant tile, as shown in Figure 3-24.

FIGURE 3-24 Reviewing devices on the Intune dashboard

For example, selecting the Device configuration tile redirects the console to the Assignment failures page in Devices | Monitor. From the Monitor page, you can review the following configuration-related data:

• Assignment status
• Assignment failures
• Devices with restricted apps
• Encryption report
• Certificates

For example, as displayed in Figure 3-25, two device assignment failures are displayed.

FIGURE 3-25 Reviewing assignment failures

In this instance, the reason for the failure is identified as being a conflict. For further details, an administrator can click the Profile name link to find out more, as shown in Figure 3-26.

FIGURE 3-26 Reviewing a conflicting profile

Further analysis is possible by clicking through the provided links. For example, clicking the Intune link for a particular computer in conflict identifies the setting in conflict, as shown in Figure 3-27.

FIGURE 3-27 Determining the cause of the conflict

Selecting the Setting name that is in conflict provides additional information. After that, it’s a question of reviewing the policies in conflict and adjusting assignments or the settings being configured.

You can also review the assignment status of a configuration profile from the Devices | Configuration profiles page in Intune. Select the target profile, and then on the Summary page, review the details, as shown in Figure 3-28.

FIGURE 3-28 Reviewing the assignment status of a profile

From this page, you can review

• Device and user check-in details
• Access a report (see Figure 3-29)

FIGURE 3-29 Reviewing a configuration profile assignment report

• Device assignment status
• User assignment status
• Links to review or edit the following:
  • Basics
  • Assignments
  • Scope tags
  • Configuration settings
  • Applicability rules