Migrating Default Domain Policy GPO Settings to an Intune Profile

MD-102 By islever Editorial Last updated

Plan and implement device configuration profiles Implement identity and compliance

Short answer

C Use the Device restrictions profile template in Intune, whose Password section carries over the Default Domain Policy password and account-lockout settings.

Question

Your network contains an on-premises Active Directory domain and an Azure AD tenant.
The Default Domain Policy Group Policy Object (GPO) contains the settings shown in the following table.
Exhibit: Migrating Default Domain Policy GPO Settings to an Intune Profile
You need to migrate the existing Default Domain Policy GPO settings to a device configuration profile.
Which device configuration profile type template should you use?
  1. Administrative Templates
  2. Endpoint protection
  3. Device restrictions Correct Answer
  4. Custom

Key Takeaways

The question tests which Intune profile template mirrors Default Domain Policy password/account-lockout settings; the trap is reflexively picking Administrative Templates simply because the source is a GPO.

When the on-premises Default Domain Policy GPO holds password, lockout and sign-in settings, those map to Intune's Device restrictions device configuration template, whose Password node exposes equivalent Windows settings. This page explains why Device restrictions is the correct template type rather than Administrative Templates, Endpoint protection, or Custom when migrating those specific GPO values.

Common mistake: Most learners pick A, Administrative Templates, assuming that any GPO migration must use the GPO-like template — but the Default Domain Policy carries password, lockout and Kerberos security settings, not ADMX-backed administrative template settings, and Administrative Templates profiles have largely been superseded by the Settings Catalog.

Expert Analysis

Why the Answer Is Correct

The Default Domain Policy is the container for the password policy, account lockout and related sign-in security settings shown in the exhibit, and Intune exposes those same knobs under the Device restrictions profile type on the Password page (minimum password length, complexity, history, lockout threshold and duration, and whether local Windows accounts are affected). Choosing the Device restrictions template therefore reproduces the migrated GPO values with a supported, non-custom profile that Microsoft still maintains. As krzysztofbr pointed out, "inside device restrictions, You have password settings" and the referenced Microsoft device-restrictions documentation lists exactly that Password section. That makes C the defensible answer for these specific Default Domain Policy settings.

Why the Other Options Are Wrong

A, Administrative Templates, is the intuitive but flawed pick: Administrative Templates profiles mirror ADMX-backed computer/user configuration settings (Windows components, explorer, system), while password and account lockout policies are Group Policy security settings that were never ADMX templates, and as ModernoDecor noted, "Today it is Settings Catalog (Administrative Templates is retired)." B, Endpoint protection, targets Defender Firewall, BitLocker, antivirus, Exploit Guard and Windows Hello for Business baselines — it has no general password-length or lockout controls. D, Custom, would require hand-building an OMA-URI payload, which is unnecessary and unsupported when a first-party template already provides the setting; custom profiles are a last resort, not a migration strategy.

Community Comment Notes

Commenters were split, with volto and krzysztofbr insisting on Device restrictions and pointing to the password documentation, while iTomi, LionelDerBoven, RomanV, HueCumber, 7a9c653, ModernoDecor and RJTW070 argued for Administrative Templates on the grounds that GPO migration flows start with Group Policy analytics. iTomi's process note is directionally useful — "Import and analyze your on-premises GPOs using Group Policy analytics" — but the analytics workflow actually produces Settings Catalog items, not the legacy Administrative Templates profile type, so it does not make A correct here. RomanV's emphasis on the word MIGRATE is well taken, yet migration intent does not change the fact that the exhibit's password settings live in the Device restrictions template.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the exhibit first: if it lists password, lockout or sign-in requirements, the mapping is the Device restrictions profile's Password node, not Administrative Templates. Reserve Administrative Templates for ADMX-backed Windows setting examples, Endpoint protection for security baselines, and Custom for settings no template covers.

Frequently Asked Questions

Why isn't Administrative Templates the right template for migrating the Default Domain Policy GPO?

Administrative Templates profiles mirror ADMX-backed settings, but Default Domain Policy holds password, lockout and Kerberos security settings, which are not ADMX templates — and those profiles have been superseded by the Settings Catalog.

Does the Device restrictions Password page cover account lockout as well as password length?

Yes. The Windows 10/11 Device restrictions template includes a Password node with minimum password length, complexity and history plus lockout threshold, duration and counter reset options.

More MD-102 FAQ →

Discussion 70 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 70

  1. volto 👍 32 Answered C
    Answer C is correct https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10#password
  2. iTomi 👍 14 Answered A
    In this question you are MIGRATING the EXISTING GPO settings from AD to Intune, not creating new one. Steps are: Import and analyze your on-premises GPOs using Group Policy analytics in Microsoft Intune https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics Create a Settings Catalog policy using your imported GPOs in Microsoft Intune (public preview) https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics-migrate Use Windows 10/11 templates to configure group policy settings in Microsoft Intune https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows
  3. LionelDerBoven 👍 8 Answered A
    The correct answer is A. Administrative Templates. Explanation: To migrate the existing Default Domain Policy GPO settings (like password policies, lockout settings, etc.) to Intune as a device configuration profile, Administrative Templates is the correct template type to use. Administrative Templates in Intune mirror many Group Policy Object (GPO) settings, making it the right choice for applying these specific configurations (like password length, complexity, and history). The settings shown in the image (such as MaximumPasswordAge, PasswordComplexity, etc.) are commonly found in Group Policies, which can be replicated in Intune via Administrative Templates. Other options such as Device Restrictions, Endpoint Protection, or Custom profiles do not cover the breadth of traditional GPO settings like password policies as well as Administrative Templates do. Thus, Administrative Templates is the correct profile type for this scenario.
  4. RomanV 👍 8
    You are so wrong. Read between the lines please or don't respond here... Answer is A! The question states: "You need to MIGRATE the existing Default Domain Policy GPO settings to a device configuration profile." So according to Microsoft and myself, as an Intune administrator, after you Import and analyze your on-premises GPOs using Group Policy analytics in Microsoft Intune, you CREATE the template. Which profile type? Administrative Templates!
  5. bigdaddyzaddy 👍 6
    Actually you’re wrong. Administrative template has been retired. The answer is c. Funny thing is you spoke so confidently as if you’re the sole authority on this. 😂😂
Show 25 more comments
  1. krzysztofbr 👍 5
    You are correct! so many wrong answers again! inside device restrictions, You have password settings. your link shows everything regarding password
  2. RJTW070 👍 3 Answered A
    Since the Default Domain Policy GPO typically contains Group Policy settings related to security, user experience, and system configurations, the best way to migrate these settings to Microsoft Intune is by using the Administrative Templates profile type. Why Use Administrative Templates? Administrative Templates in Intune mimic Group Policy Objects (GPOs) in Active Directory. They allow you to apply the same settings as traditional GPOs without requiring on-premises Active Directory. Many common GPO settings are already available in Intune Administrative Templates, making migration easier.
  3. Anonymous learner 👍 3
    The on-premises Active Directory domain GPO has hierarchy over Azure AD tenant thus will not change only with Custom configuration beside the question say “template “, I will go with D: Custom
  4. ModernoDecor 👍 3 Answered A
    Today it is Settings Catalog (Administrative Templates is retired) https://learn.microsoft.com/en-us/intune/intune-service/configuration/group-policy-analytics-migrate
  5. mhmyz 👍 3 Answered D
    "Device restrictions" cannot configure MinimumPasswordAge. So,Strict answer is D.Custom. But,I thnk Device restrictions is not so bad answer.
  6. HueCumber 👍 3 Answered A
    ✅ MD‑102 memory rule If the goal is to migrate existing Group Policy settings to Intune, use Administrative Templates first.
  7. ThePrutser 👍 3
    tried this, not possible. Certain settings from the password policy aren't compatible.
  8. Shawn_Chen 👍 3
    A is correct because this question is asking "migrate" GPO not creating a new policy
  9. 7a9c653 👍 3 Answered A
    A is the one to migrate a GPO policy.
  10. JP1900 👍 3
    You are correct, C it is.
  11. Alaeddine100 👍 2 Answered A
    A Lorsque le terme migration est utilisé, cela implique que vous prenez les paramètres existants d’Active Directory (GPO) et que vous les transférez dans Intune. Pour cela, la méthode appropriée est Administrative Templates (ou aujourd’hui Settings Catalog, car Administrative Templates est retiré pour la création de nouveaux profils).
  12. hieunm2411 👍 2 Answered C
    Starting with the December 2412 release, you can't create new Administrative Templates policies from the Templates > Administrative Templates profile type in the Intune admin center. https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows?tabs=template
  13. ToutouPapa 👍 2 Answered D
    Device Restrictions has a Password section but it does not contain a setting for lock (has one for wipe instead) and for minimum password age. Custom would be able to set all the required.
  14. wakka9876 👍 2 Answered C
    Answer is C - Device Restrictions Administrative templates has been deprecated by Microsoft and now shows as retired when you create a configuration profile
  15. Frank9020 👍 2 Answered A
    By using the Administrative Templates profile type, you can more effectively replicate and manage the settings from the Default Domain Policy GPO in Intune.
  16. frack 👍 2
    actually device lock can be configured as security baseline and minimum password age can be applied to configuration profiles. So admin templates I think
  17. letters1234 👍 2 Answered C
    Custom OMA-URI and ADMX are considered legacy by Microsoft, even if the option did exist, they would expect a Template or Settings Catalog configuration.
  18. Vlado123 👍 2
    A https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows?tabs=template#create-the-template
  19. Gr8Greet 👍 2 Answered D
    Custom https://danielchronlund.com/2018/11/27/how-to-replace-your-old-gpos-with-intune-configuration-profiles/
  20. RabbitB 👍 2 Answered C
    https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-configure
  21. Maclouis116 👍 2 Answered A
    You migrate your AD GPO's to administraive templates using the ADMX file
  22. MR_Eliot 👍 2 Answered C
    C is correct. I have done this multiple times.
  23. AleFCI1908 👍 2 Answered A
    it's a migration, vote for A
  24. JP1900 👍 2
    Correct answer is C
  25. Besxp 👍 1 Answered B
    The Endpoint protection profile in Intune includes password policies, account lockout settings, and local device security options. It is designed to replicate security baselines and common GPO security settings like those found in the Default Domain Policy. ❌ Why not the others? A. Administrative Templates -Used for importing GPO settings that exist in ADMX-backed format (e.g., Office or Windows registry-based policies), not password or lockout settings. C. Device restrictions -Used for UI settings (camera, Bluetooth, copy/paste, etc.), not password or account lockout policies. D. Custom -Used for OMA-URI or CSP-based settings not exposed directly in the UI. Not necessary here since built-in options cover the required settings. -Comments saying "Device restrictions" are either outdated or confusing it with mobile device PIN policies. -For your GPO migration with password and lockout policies, the correct and current profile type is: Endpoint protection.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide