How to Migrate Intune Administrative Templates to Settings Catalog

Start by documenting all existing Administrative Templates policies in your Intune environment. Navigate to the Microsoft Intune admin center at endpoint.microsoft.com and sign in with your administrator credentials.

Go to Devices > Configuration > Policies and filter by profile type Administrative templates. You'll see a deprecation warning banner indicating these policies are no longer supported for new creation as of the December 2024 (2412) release.

# Optional: Export policy list using Graph API
$policies = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations" -Method GET
$adminTemplates = $policies.value | Where-Object { $_."@odata.type" -eq "#microsoft.graph.windows10CustomConfiguration" }

Document each policy's:

• Policy name and description
• Group assignments and filters
• Scope tags
• Configured settings and values
• Last modified date

Navigate to the free web-based converter tool at admintemplate.intunestuff.com. This third-party tool, released in February 2026, automates the migration process while preserving your existing assignments and configurations.

Click Sign in with Microsoft and authenticate using your Intune administrator credentials. The tool requires the same permissions as the Intune admin center to read and create policies.

Once authenticated, the tool will automatically discover and list all Administrative Templates policies in your tenant. You'll see a dashboard showing:

• Total number of Administrative Templates policies
• Policies eligible for conversion
• Policies with custom ADMX files (require manual migration)
• Estimated conversion time

In the converter tool interface, review the list of discovered policies. Select the policies you want to migrate by checking the boxes next to each policy name. Start with non-critical policies for your initial migration batch.

For each selected policy, click Review Settings to examine the conversion mapping. The tool shows:

• Original Administrative Template setting path
• Equivalent Settings Catalog setting
• Current configured value
• Any settings that cannot be automatically mapped

Configure migration options:

• Preserve Assignments: Keep existing group assignments and filters
• Add Suffix: Append "_SC" to new policy names for identification
• Scope Tags: Maintain existing scope tags or add new ones
• Pilot Mode: Create policies in disabled state for testing

Click Start Migration to begin the automated conversion process. The tool will:

1. Create new Settings Catalog policies with equivalent configurations
2. Apply the same group assignments and filters
3. Copy scope tags and descriptions
4. Generate a migration report

Monitor the migration progress in real-time. The tool displays:

• Current policy being processed
• Settings successfully mapped
• Any errors or warnings
• Estimated time remaining

Common migration statuses you'll see:

✓ Policy "Corporate Security Settings" - 15/15 settings migrated
⚠ Policy "Custom App Settings" - 12/14 settings migrated (2 manual review needed)
✗ Policy "Legacy ADMX" - Migration failed (custom ADMX not supported)

Return to the Microsoft Intune admin center and navigate to Devices > Configuration > Policies. Filter by profile type Settings catalog to view your newly created policies.

For each migrated policy:

1. Click the policy name to open its configuration
2. Review the Settings tab to verify all configurations were preserved
3. Check the Assignments tab to confirm group assignments and filters
4. Verify scope tags in the Scope (Tags) section

Compare a few key settings manually:

Original Administrative Template:
Computer Configuration > Administrative Templates > Windows Components > Internet Explorer
"Turn off Internet Explorer Enhanced Security Configuration" = Enabled

New Settings Catalog:
Internet Explorer > Turn off Enhanced Security Configuration = Enabled

Check the policy status and assignments:

• Status: Should show "Not assigned" if created in pilot mode
• Assignments: Should match original policy assignments
• Filters: Should preserve any device filters

Before deploying to production, test the migrated Settings Catalog policies with a small pilot group. Create a test device group or use an existing pilot group (like "Ring 0 - IT Department").

Enable and assign one migrated policy to your pilot group:

1. Open the Settings Catalog policy in Intune admin center
2. Go to Assignments tab
3. Click Add group and select your pilot group
4. Configure any necessary filters (e.g., Windows version)
5. Save the assignment

Monitor policy deployment and application:

# On a pilot device, check policy application status
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; ID=1000} | Select-Object TimeCreated, Message | Format-Table -Wrap

Verify settings are applied correctly on pilot devices:

• Check Group Policy Results (gpresult /r) for applied settings
• Verify registry values for specific configurations
• Test functionality affected by the policies
• Monitor Intune device compliance reports

Some Administrative Templates policies cannot be automatically migrated, particularly those using custom ADMX files or deprecated settings. For these policies, you'll need to perform manual migration.

Identify policies requiring manual migration from the converter tool report. Common scenarios include:

• Custom ADMX files imported into Intune
• Third-party application templates
• Deprecated Windows settings no longer supported

For custom ADMX files, first import them into Settings Catalog:

1. Go to Devices > Configuration > Import ADMX
2. Upload your custom ADMX and ADML files
3. Wait for processing (can take 15-30 minutes)

Create equivalent Settings Catalog policies manually:

1. Go to Devices > Configuration > Create > New policy
2. Select Platform: Windows 10 and later, Profile type: Settings catalog
3. Search for your imported ADMX settings or equivalent built-in settings
4. Configure values to match the original policy
5. Apply the same assignments, filters, and scope tags

Example manual mapping:
Original: Custom App ADMX > Enable Feature X = True
Settings Catalog: [Custom App] > Enable Feature X = Enabled

After successful pilot testing, gradually deploy the migrated Settings Catalog policies to production. Use a phased approach to minimize risk and allow for quick rollback if issues arise.

Deploy in phases:

1. Phase 1: IT department and early adopters (Week 1)
2. Phase 2: Department by department (Weeks 2-3)
3. Phase 3: Remaining users (Week 4)

For each phase, update the policy assignments:

1. Open the Settings Catalog policy
2. Go to Assignments tab
3. Add the next phase group(s)
4. Remove pilot group assignments if no longer needed

Monitor deployment through Intune reporting:

• Device configuration: Check policy assignment status
• Device compliance: Monitor for any compliance issues
• Endpoint analytics: Watch for performance impacts

Track key metrics:

Policy Application Success Rate: Target >95%
Device Check-in Frequency: Monitor for delays
User-reported Issues: Track helpdesk tickets
Compliance Status: Ensure no degradation

Once you've confirmed the Settings Catalog policies are working correctly in production, it's time to clean up the deprecated Administrative Templates policies. This final step completes your migration and removes the deprecation warnings from your Intune console.

Before deletion, create a final backup of your Administrative Templates policies:

1. Document all policy settings one final time
2. Export assignments and scope tags
3. Take screenshots of complex configurations
4. Note any policies still in use for reference

Disable Administrative Templates policies first (don't delete immediately):

1. Open each Administrative Templates policy
2. Go to Assignments tab
3. Remove all group assignments
4. Save the changes

Monitor for 1-2 weeks to ensure no unexpected issues arise. Then proceed with deletion:

1. Return to Devices > Configuration > Policies
2. Filter by Administrative templates
3. Select policies to delete (start with non-critical ones)
4. Click Delete and confirm

Alternatively, use the converter tool's cleanup feature:

• Return to admintemplate.intunestuff.com
• Navigate to the Cleanup section
• Select successfully migrated policies
• Choose Disable assignments or Delete policies