In recent months, Microsoft has been rolling out an important change that impacts how we configure Windows devices through Intune. If you’ve been using device configuration profiles based on the “Templates” (such as Endpoint Protection, Edition Upgrade, or Firewall settings), there’s now a shift underway: these settings are moving to the Settings Catalog templates as part of a broader unification effort.
In this blog we will use the new Delivery Optimization template as an example, we’ll dive into what’s happening, why it matters, and what you should do to stay ahead.
Why the Move?
Historically, managing device configuration in Intune was a bit fragmented. We had custom profiles, a growing Settings Catalog templates, and the older Templates, each with their own strengths and limitations. Microsoft is now aligning everything under the Settings Catalog, making it the single place to configure Windows policies moving forward. This isn’t just a UI change. Under the hood, it enables better consistency across platforms (Windows, macOS, iOS, Android), improves reporting, and simplifies policy targeting.
Microsoft officially announced that support for new templates in the “Templates” blade will stop, and the Settings Catalog template will be the path forward. Some templates already show a banner with a warning about this deprecation, so this is one of the things what will be happening with existing policies.
What Happens to Existing Profiles?
- Profiles created via Templates still work.
They will continue applying settings to devices for the time being. - No automatic migration.
You will need to manually recreate existing template-based policies using the Settings Catalog. - New features will only come to the Settings Catalog templates.
If you keep using old templates, you’ll miss out on new settings and improvements.
This gives admins time to plan migration properly. But delaying migration will eventually cause management gaps, especially as Windows evolves with new OS versions. One of the examples we can use is the Delivery optimization template.
The new Delivery Optimization template
With the release of the what’s new in Intune for Service release 2504, Microsoft released a new policy for Delivery optimization now using the Settings catalog template.
Configuring the new delivery optimization policy
When logging in into Intune we are able to use the new template. When going to Devices | Windows | Configuration and click on + Create, click on new profile and choose platform Windows 10 and later and profile type Templates. Click on Delivery Optimization
give the policy a name and description (if you like to use it), click Next
now we are seeing the new template for DO
In the next chapters we will go into how we can migrate this to our users/devices
How to Start Migrating
The first thing you should do is inventory your existing device configuration policies. Focus especially on profiles using these templates:
- Endpoint Protection
- Edition Upgrade and Mode Switch
- Firewall
- VPN
- Wi-Fi
- Certificates
When you rebuild them in the Settings Catalog, you’ll often find additional granularity or new options that weren’t available before.
Tip: Use policy targeting to limit risk. For example, assign the new Settings Catalog version only to a pilot group first before rolling it out widely.
Using Deployment Rings for Safe Migration
If you already have deployment rings in place great. If not, now’s the perfect moment to implement them. Following a deployment ring strategy helps control the rollout and reduces risk if issues arise.
The basic idea is simple: start small, validate, expand.
Here’s the visual overview:
| Ring | Description | Target | Goal |
|---|---|---|---|
| Ring 1 or 0 | Internal IT | Small group (IT admins, device management team) | Validate technical functionality and catch critical issues early |
| Ring 1 | Early Adopters | Handpicked users across departments | Validate real-world usage without impacting core business operations |
| Ring 2 | Pilot Production | 10-20% of overall userbase | Broader testing with limited business impact |
| Ring 3 | Full Production | All remaining users | Full rollout after successful validation in earlier rings |
Each ring should run for a specific validation period (e.g., 1-2 weeks) before promoting the policy to the next ring.
Only move forward if there are no critical issues identified.
Practical Migration Steps
- Create the new Settings Catalog template policies based on your inventory.
- Assign policies to Ring 0 (IT only) with filter-based targeting or separate dynamic groups.
- Monitor event logs, policy reports, and end-user feedback.
- Adjust if needed. Minor issues are easier to fix when the scope is still small.
- Expand gradually through Ring 1 and Ring 2, validating at each stage.
- Complete rollout to Ring 3 once confident.
Important:
During migration, avoid assigning both the old Template-based and the new Settings Catalog-based policies to the same devices, unless you know exactly what overlaps and conflicts can occur.
Conclusion
Final Thoughts
Microsoft’s move to unify device configuration through the Settings Catalog template isn’t a surprise, it’s been hinted at for a while. But now the time to act is here. Start planning migrations during regular maintenance cycles to avoid surprises later. And as always: test first, validate behavior across your device fleet, and don’t blindly assume every setting behaves exactly the same.
By combining careful inventory work with a structured deployment ring approach, you can make the transition smooth, controlled, and future-proof. At the end of the day, moving to the Settings Catalog will give you more control, more visibility, and a smoother management experience.
[…] Windows device configuration policies are moving to Settings catalog template. What you need to know […]