Intune CSP Configuration Troubleshooting: Solve Custom Setting Issues

Table of Contents

Configuration Service Providers (CSPs) are essential components in managing Windows 10 devices enrolled in Microsoft Intune. They act as interfaces to configure various settings on these devices, enabling administrators to enforce policies and customize the user experience. Custom settings within Intune, leveraging CSPs, offer granular control beyond the built-in policy options. However, implementing and maintaining these custom settings can sometimes present challenges. This article provides comprehensive guidance for troubleshooting common issues encountered when deploying CSP custom settings to Windows 10 computers through Intune. Understanding the process of data collection and log analysis is crucial for effectively resolving any configuration discrepancies.

Collect Data from Intune¶

The initial phase of troubleshooting involves gathering pertinent information directly from the Intune platform. This systematic data collection helps pinpoint the source of configuration issues by providing insights into deployment statuses and setting-specific errors. By carefully examining the Intune admin center, administrators can gain a clear understanding of the scope and nature of any problems related to CSP custom profile deployments.

1. Determine the Status of CSP Custom Profile Deployment:

   Begin by navigating to the Microsoft Endpoint Manager admin center. Proceed to Device Configuration and then select Assignment Status. This section provides a high-level overview of all deployed configuration profiles, including custom CSP profiles. Key information displayed here includes:

   • Display Name: The name assigned to the custom profile, aiding in quick identification.
   • Type: Indicates the profile type, confirming it is a custom profile.
   • Devices with Errors: The number of devices encountering errors during profile application.
   • Devices Failed: The count of devices where profile deployment has failed entirely.
   • Devices Succeeded: The number of devices where the profile was successfully applied.

   

   This initial step allows for a broad assessment of the deployment success and highlights profiles requiring further investigation due to errors or failures. Focus on profiles with non-zero “Devices with Errors” or “Devices Failed” counts.

2. Access Profile Details for Error Analysis:

   Once you have identified a problematic profile from the Assignment Status, navigate to Device Configuration and then Profiles. Locate and select the specific custom profile displaying “Devices with Errors” or “Devices Failed”. Clicking on the profile name opens a detailed view, providing deeper insights into its deployment status.

3. Investigate Device Status (for Device Deployments):

   If the custom profile was deployed directly to devices, select the Device Status section within the profile overview under the Monitor category. This section offers granular device-level information, essential for pinpointing issues affecting specific machines. The following details are available:

   • Device: The name of the Windows 10 device.
   • User: The primary user of the device.
   • Deployment Status: The current status of the profile deployment on the device (e.g., Pending, Error, Success, Conflict). This is crucial for identifying devices where the profile application faltered.

   

   Examine the Deployment Status for devices listed here. Devices with “Error” or “Failed” statuses are prime candidates for further log investigation.

4. Examine User Status (for User Deployments):

   If the custom profile was assigned to users, access the User Status section under Monitor within the profile overview. This section provides a user-centric perspective on deployment, especially relevant when policies are targeted at user accounts rather than specific devices. The User Status section displays:

   • User: The username to whom the profile is assigned.
   • Device Count: The number of devices associated with the user that are targeted by the profile.
   • Deployment Status: The overall deployment status for the user, reflecting the profile application across their devices.
   • Last Check-in: The timestamp of the last successful communication between the user’s devices and Intune.

   

   User Status is particularly useful for identifying issues related to user assignments or situations where a policy should apply across all of a user’s devices, but is not doing so consistently.

5. Analyze Per-Settings Status for Granular Error Detection:

   Often, issues arise from specific custom settings within a profile. To investigate individual setting statuses, navigate to the Per-Settings status section, also located under Monitor within the profile overview. This provides a detailed breakdown of each custom setting within the profile and its application status. The following information is presented for each setting:

   • Setting: The name of the specific custom setting.
   • Description: A brief explanation of the setting’s purpose.
   • Remediation: Indicates if Intune is attempting to automatically remediate any detected non-compliance.
   • Conflict: Shows if the setting is conflicting with another policy or configuration.
   • Unknown: Indicates if the status of the setting is currently undetermined.
   • Error: Signifies that an error occurred while applying this specific setting.
   • Not Applicable: Shows if the setting is not applicable to certain devices (e.g., due to OS version or hardware).

   

   The Per-Settings status is invaluable for pinpointing problematic settings within a complex custom profile. Errors at this level often indicate issues with the CSP syntax, data type mismatches, or conflicts with other configurations.

After meticulously collecting data from Intune and identifying devices experiencing issues, the subsequent crucial step involves gathering logs directly from these Windows 10 computers. These logs contain detailed technical information necessary for in-depth troubleshooting.

Collect Logs from a Windows 10 Computer¶

Windows 10 devices maintain detailed event logs that record system activities, including the processing of Intune policies and CSP custom settings. These logs are indispensable for gaining a granular understanding of errors and statuses beyond what is visible in the Intune admin portal. To effectively troubleshoot CSP custom setting issues, collecting and reviewing these logs is essential.

1. Enable Debug Logs in Event Viewer:

   The Event Viewer is the primary tool for accessing Windows logs. To capture the most detailed information, including diagnostic and debug logs, you need to enable their visibility.

   • Open Event Viewer. You can search for “Event Viewer” in the Windows search bar.
   • In the Event Viewer menu, click on View and select Show Analytic and Debug Logs. This action makes the Debug logs, which are often hidden by default, accessible for collection.

   

   Enabling debug logs ensures that a more comprehensive set of events, crucial for detailed troubleshooting, is available.

2. Navigate to DeviceManagement-Enterprise-Diagnostic-Provider Logs:

   The specific logs relevant to Intune policy processing and CSP operations are located within the DeviceManagement-Enterprise-Diagnostic-Provider section of the Event Viewer.

   • In the Event Viewer, navigate through the console tree to Applications and Services Logs -> Microsoft -> Windows -> DeviceManagement-Enterprise-Diagnostic-Provider.

   

   This path leads to the log categories specifically designed for capturing events related to device management and enterprise diagnostics, including CSP processing.

3. Collect Admin Logs:

   Admin logs provide a high-level overview of significant events related to device management, including errors and warnings. They are often the first place to look for indications of problems.

   • Within the DeviceManagement-Enterprise-Diagnostic-Provider folder, right-click on the Admin node.
   • Select Save All Events As… from the context menu.
   • Choose a suitable location on the computer to save the log file. Enter a descriptive file name, for example, “AdminLogs.evtx”.
   • Click Save.
   • In the Display Information for these languages dialog, ensure English is selected. This ensures that the log messages are displayed in English, regardless of the system’s locale.
   • Click OK.

   

   Saving the Admin logs captures a valuable record of administrative events, which can be analyzed for error patterns and high-level issue identification.

4. Collect Debug Logs:

   Debug logs contain a much more detailed stream of events, including step-by-step processing information, which is invaluable for pinpointing the exact stage where an issue occurs. Due to their verbosity, debug logs are typically used for in-depth troubleshooting when Admin logs are insufficient.

   • Within the DeviceManagement-Enterprise-Diagnostic-Provider folder, right-click on the Debug node.
   • Select Save All Events As… from the context menu.
   • Choose a save location and enter a file name, such as “DebugLogs.evtx”.
   • Click Save.
   • Again, in the Display Information for these languages dialog, select English.
   • Click OK.

   

   Debug logs provide the most granular level of detail, allowing for precise analysis of CSP processing and error conditions. They are essential when dealing with complex or elusive issues.

After collecting both Admin and Debug logs from the affected Windows 10 computer, the next step is to carefully review these logs using Event Viewer or specialized log analysis tools. Look for error events, especially those related to CSP processing, policy application, and device management. The timestamps of errors in the logs should correlate with the times when issues were observed in Intune.

Collect Microsoft Entra Logs¶

In scenarios where issues appear to be related to device authentication, communication with Microsoft Entra ID (formerly Azure Active Directory), or workplace join processes, collecting Microsoft Entra logs becomes crucial. These logs provide insights into the identity and authentication aspects of device management, which are fundamental for Intune enrollment and policy application.

To collect Microsoft Entra logs, you will typically use the Azure portal, as these logs are centrally managed within the Azure environment. The process generally involves accessing the Azure Monitor service and querying the relevant logs for audit events, sign-in logs, and provisioning logs related to the affected devices or users.

While the exact steps for collecting Microsoft Entra logs can vary based on the specific log type and the Azure portal interface at the time, the general approach involves:

1. Accessing Azure Monitor or Microsoft Entra ID Audit Logs: Navigate to the Azure portal and locate the Azure Monitor service or directly access the Microsoft Entra ID section, looking for options related to monitoring, logs, or audit logs.

2. Selecting Relevant Log Categories: Within the log interface, filter or select log categories pertinent to your troubleshooting scenario. For Intune-related issues, categories like “Audit Logs,” “Sign-in logs,” and “Provisioning logs” are often relevant.

3. Applying Filters for Specific Devices or Users: Use filters to narrow down the logs to events related to the specific Windows 10 devices or users you are troubleshooting. This can involve filtering by device name, user principal name, or correlation IDs if available from Intune error messages.

4. Exporting or Analyzing Logs: Once you have filtered the logs, you can typically export them for offline analysis or use the Azure portal’s log query tools to examine the events directly. Look for error messages, failed authentication attempts, or provisioning failures that might indicate issues related to Microsoft Entra ID integration.

Microsoft Entra logs are particularly helpful in diagnosing problems such as:

• Device enrollment failures.
• Authentication issues preventing policy application.
• Workplace join errors.
• Conditional Access policy interference.
• Communication breakdowns between the device and Microsoft Entra ID.

By combining the data collected from Intune, Windows 10 device logs, and Microsoft Entra logs, administrators can build a comprehensive picture of the issue and effectively troubleshoot CSP custom setting problems. Remember to correlate timestamps across different log sources to establish event sequences and identify root causes.

If you have further questions or insights regarding troubleshooting Intune CSP custom settings, feel free to share them in the comments below! Your experiences and questions can help others facing similar challenges.