Slow User Policies Applying via Intune – Anyone Else Experiencing This?

[IanT]

I’m currently in the early stages of deploying Windows 11 devices using Microsoft Intune (Entra joined), and I’ve started to notice some frustrating behavior around user policies applying very slowly or inconsistently.

When a user logs into a freshly deployed device for the first time (especially shared/student machines), the device itself is enrolled, apps install fine, and configurations eventually apply. However, the user policies – things like restricting PowerShell/CMD access, locking down settings, hiding control panel etc – either:

• Take several minutes to apply

• Or don’t apply until after a log out and log back in

• And in some cases, they don’t seem to apply at all on first use

 

This delay poses a concern, especially in an education setting, where a student could easily access critical system tools before the policy has kicked in.

 

We’re deploying mapped drives using ADMX-backed configuration profiles. These too sometimes don’t appear until a second logon, despite the config being correct and devices/users in scope.

 

Anyone has this?

 

 

[Steve21]

Pretty much InTune all over. The general summary is if it's something that's needed quickly it can't be a user policy and needs to be device based (Assuming not one-to-one where you could pre-apply user policies)

Steve

[IanT]

2 minutes ago, Steve21 said:

Pretty much InTune all over. The general summary is if it's something that's needed quickly it can't be a user policy and needs to be device based (Assuming not one-to-one where you could pre-apply user policies)

Steve

I'm just seeing so much inconsistency - we have a configuration policy which restricts the like of control panel etc.............you log on, it doesnt apply so the kids can start changing stuff.............10 minutes later its applied, this cannot be right surely with how slow it is?!

[Steve21]

Right is contextual in MS eyes... 

It's "right" that it takes a while as it's designed for businesses with 1:1 devices that will wait for things to apply

It's "wrong" in terms of it being useful for schools/where you have lots of minions trying to break things!

Look at a hundred threads on here and you'll find pretty much everyone references the same issues. The results are generally either use device policies for important stuff, risk the "delays", migrate to Chromebooks, or put some other bodge into place to speed up refreshes.

Steve

[IanT]

6 minutes ago, Steve21 said:

Right is contextual in MS eyes... 

It's "right" that it takes a while as it's designed for businesses with 1:1 devices that will wait for things to apply

It's "wrong" in terms of it being useful for schools/where you have lots of minions trying to break things!

Look at a hundred threads on here and you'll find pretty much everyone references the same issues. The results are generally either use device policies for important stuff, risk the "delays", migrate to Chromebooks, or put some other bodge into place to speed up refreshes.

Steve

yeah, it’s honestly becoming a bit of a joke now.

 

We’ve literally just applied some settings to our student policy — they applied fine on first login. Thought "brilliant, finally!"

Logged out, logged back in… nope. Gone. Not applied. What the hell is going on?

 

It's genuinely ridiculous. One minute it behaves, the next it forgets it even exists. I get that Microsoft thinks every device is a shiny 1:1 business laptop sitting idle waiting patiently for cloud magic to happen, but come on, this is a school. Kids aren’t waiting 10 minutes for policies to catch up. They’re launching Roblox, opening CMD, and trying to bypass everything before the poor IME even gets out of bed.

 

We're at the start of our rollout and already seeing how shaky this setup is for shared environments. It just doesn’t feel production-ready for education — at least not without a lot of duct tape and swearing.

[lparry]

The 'S' in Intune stands for speedy.

 

This is why we still have our local group policies for things like software restrictions even though we'd love to have everything done at Intune level - it's just not feasible at the minute for shared devices 😔

[DrCheese]

Honestly, it's a pile of garbage. But if you tell some of the MS drones on Twitter this, they just say you're "Stuck in the past" & "Don't like the cloud" which is utter nonsense as we've embraced everything else. I *would* embrace Intune, if the speed issue & 802.11x machine auth issue was fixed.

 

There's no excuse for how slow & inconsistent Intune is, despite all the rubbish excuses MS make. ChromeOS applies settings in seconds - COPY THAT.

 

I just can't lose the ability to make changes that are required for the business as quickly as I need to make them - GPO is applied seconds after I change it. Apps are installed consistently on next reboot. Intune... Between now & heat death of the universe

 

 

[Smokebomb]

We get around this exact situation using logon scripts. We store the powershell scripts in azure blob storage, then create a scheduled task (via a remediation script) that runs the script direct from that source at user logon. The scripts contain any reg values that we need in place straight away such as browser home pages, office settings, filter configuration, mapped drives, and printer mapping. 

[PrimaryNetMan]

34 minutes ago, Smokebomb said:

We get around this exact situation using logon scripts. We store the powershell scripts in azure blob storage, then create a scheduled task (via a remediation script) that runs the script direct from that source at user logon. The scripts contain any reg values that we need in place straight away such as browser home pages, office settings, filter configuration, mapped drives, and printer mapping. 

 

And to think, people complain Google Workplace is too simple. 🤣

[5tu]

19 hours ago, IanT said:

I’m currently in the early stages of deploying Windows 11 devices using Microsoft Intune (Entra joined), and I’ve started to notice some frustrating behavior around user policies applying very slowly or inconsistently.

When a user logs into a freshly deployed device for the first time (especially shared/student machines), the device itself is enrolled, apps install fine, and configurations eventually apply. However, the user policies – things like restricting PowerShell/CMD access, locking down settings, hiding control panel etc – either:

• Take several minutes to apply

• Or don’t apply until after a log out and log back in

• And in some cases, they don’t seem to apply at all on first use

 

This delay poses a concern, especially in an education setting, where a student could easily access critical system tools before the policy has kicked in.

 

We’re deploying mapped drives using ADMX-backed configuration profiles. These too sometimes don’t appear until a second logon, despite the config being correct and devices/users in scope.

 

Anyone has this?

 

 

Yep - welcome to Intune.

 

It's for this reason alone all our shared devices are hybrid joined with restriction policies managed by GPO.

 

Only our 1:1 devices are pure Inune managed / Entra joined only devices

[FN-GM]

On 18/07/2025 at 17:14, DrCheese said:

 802.11x machine auth issue was fixed.

 

What issue is this please? We have it running fine. Or is the Windows NPS limitation that only support on-premise AD joined devices?

[DrCheese]

6 hours ago, FN-GM said:

 

What issue is this please? We have it running fine. Or is the Windows NPS limitation that only support on-premise AD joined devices?

 

The NPS limitation. There are a few bodges you can do, but none are super reliable or have a long-term future. I know you can use user certs, but that's worthless on shared devices, or if you want devices to always connect regardless of user access

 

Aware you can buy in third party solutions, but they're all quite pricy. All MS need to do is create a basic add-in connector for NPS like they do already with MFA.

 

Edited July 20, 2025 by DrCheese

[IanT]

On 18/07/2025 at 15:17, 5tu said:

Yep - welcome to Intune.

 

It's for this reason alone all our shared devices are hybrid joined with restriction policies managed by GPO.

 

Only our 1:1 devices are pure Inune managed / Entra joined only devices

I made the decision on Friday to halt the Intune project. While it's suitable for 1:1 device deployments, it's proven to be a nightmare for shared devices. I'm not willing to implement a compromised solution or rely on hope for stability, it needs to be done properly or not at all.

[PotNoodleTech]

Did you know intune in french means "slug"    *

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

* i might have completely made that up.

[Mike_ITDept]

Sorry to revive an old thread but this is exactly the issue that I am concerned about when considering a move from onprem hybrid to full intune.

 

I can deal with the policy delay in terms of applying new policies might take a long time to hit the endpoints, but what I can't accept is that the policies won't always apply to the users every time.

 

Is it still the case that user policies deployed through Intune do not always get applied?

[itskdog]

20 minutes ago, Mike_ITDept said:

Sorry to revive an old thread but this is exactly the issue that I am concerned about when considering a move from onprem hybrid to full intune.

 

I can deal with the policy delay in terms of applying new policies might take a long time to hit the endpoints, but what I can't accept is that the policies won't always apply to the users every time.

 

Is it still the case that user policies deployed through Intune do not always get applied?

Policies should get applied shortly after login, and Microsoft are working on changes to improve the reliability, too, swapping WNS for the IC3 notification protocol used by Teams. (Announced in the first of their new Myth vs Reality segment in the monthly "What's New" blog: Speed where it matters: How Microsoft Intune helps IT prioritize time-sensitive actions)

 

What should happen is that Windows should reach out to Intune when the PC turns on, when a user logs in, when you make a change on the Intune side (triggered by a silent push notification), and every 8 hours as a fallback in case WNS is blocked.

 

The configuration we have puts most configuration & app deployment based on the device type (staff or student), to reduce the number of policies targeted at users. I think the only user-based policy we have is to set the correct filtering policy for staff vs students in Netsweeper, everything else is device-targeted.