⚙️🪟💻CP - Security - Config Refresh
A healing factor for your policies. Tamper with a setting and it knits itself back together within 30 minutes, whether the malware likes it or not.
What this policy is about 🔄
Normally a Windows device phones Intune home about every eight hours. In between, its policies are on the honour system: if someone, or something, flips a setting in the registry, it stays flipped until the next check-in wanders round. That is a long time to run on trust.
Config Refresh closes the gap. Every 30 minutes it does not just check the MDM policies, it re-applies them, so drift and tampering are reverted on a schedule measured in minutes instead of hours. It is Wolverine's healing factor for your baseline: cut it, and it stitches itself back before you have finished gloating.
The ordinary sync asks "any new policies?". Config Refresh asks nothing and simply re-writes the existing ones. That difference is the whole value: a setting an attacker disabled does not wait politely for the next sync, it comes back on its own.
Why this matters 🕵️
The gap between check-ins is attacker time, and attackers know it. Picture the classic move: malware disables BitLocker with a registry hack. Without Config Refresh the disk sits unencrypted for the six hours until the next sync, which is plenty of time to walk the data out and leave you explaining it to the CISO. With Config Refresh, BitLocker is back inside 30 minutes, the attacker is frustrated, and you are asleep. 😴
That is the difference between security policies that are best effort and security policies that actually stick. Hardening you cannot keep enforced is hardening on paper, and paper is exactly what a determined process on the box will edit.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → search Config Refresh.
| Setting | Value |
|---|---|
| Config Refresh Enabled | True |
| Config Refresh Cadence | 30 minutes |
| Assignment, include | All devices |
| Assignment, exclude | 🛡️🪟💻⛓️Group - Autopilot Devices - IoT |
30 minutes is the sweet spot and the floor. It is Microsoft's recommended value, fast enough to correct drift and light enough that nobody notices; 30 is also the minimum, so there is nowhere sensible to go but here. Only policies that have actually drifted get rewritten, so the CPU and disk cost is close to nothing.
There is nothing to stage here. This is a turn-it-on-and-leave-it-on policy: it changes no user-facing behaviour, it only makes the settings you already deployed refuse to stay disabled.
Caveats ⚠️
It refreshes MDM policy, not everything. Device restrictions, endpoint security, configuration profiles and administrative templates are all in scope. Apps, scripts and certificates are not, they run on their own lifecycles. Config Refresh keeps your settings honest, not your whole estate.
It complements sync, it does not replace it. Normal sync still fetches new and changed policies; Config Refresh only re-enforces what is already there. You want both: one brings the updates, the other stops them being quietly undone.
IoT and kiosks sit this one out. Signage, kiosks and single-purpose IoT builds often carry deliberate local tweaks that you do not want overwritten every half hour, which is why the Autopilot IoT group is excluded. Everything with a human at the keyboard stays in.
Monitoring lives on the device. The portal shows last sync, not Config Refresh specifically. To watch it directly, check Event Viewer under Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider. You will not see it as a user; the attacker, however, very much will. 😈
License and reversibility. Config Refresh is part of Intune (included in Business Premium) and needs Windows 11 22H2 or later. Clean-revert: unassign and devices fall back to the ordinary check-in cadence, which is exactly the drift-detection irony worth alerting on, the policy whose entire job is stopping drift, quietly drifting off.
🔗 Related
- 📚🪟💻Compliance - Device Health - Bitlocker: the encryption Config Refresh keeps from being switched back off.
- 🧱🪟💻ES - Attack Surface Reduction Rules: another hardening layer that benefits from settings that will not stay tampered with.
Turn it on, leave it on, and stop trusting a device that swears its policies are applied while quietly running whatever it was last talked into. 🔄