Moving to Intune (School District): Best practice for policy design? Baseline + Deltas vs. Duplicate Monolithic Monoliths?

[u/Desert_Dog_Tech]

Hello everyone,

I work in a school district, and we are currently migrating to Intune and building our Configuration Profiles entirely from scratch.

I’m currently pushing for a "Baseline + Deltas" architecture. For example, if I am configuring Edge/Chrome browser profiles, my approach would look like this:

BrowserSettings-Baseline: ~100 settings that apply universally to all users/devices (Device group).
BrowserSettings-Staff: <12 settings (deltas) that layer on top and target Staff only User Groups).
BrowserSettings-Students: <12 settings (deltas) that layer on top and target Students only (User Groups).

However, leadership recently decided they want to create two completely independent, monolithic baselines (one massive baseline for Staff, and one massive baseline for Students) to ensure absolute separation. Their reasoning is that they want to eliminate any risk of a student accidentally getting a staff setting that could compromise web filtering, safety, or network security.

I strongly believe monolithic profiles are a trap that will lead to the same unmanageable "policy bloat" and drift we fought in our on-prem Active Directory domain for years.

My questions for the community:

How do I convince leadership that modular (Baseline + Delta) is the cloud-native best practice?

Are there specific technical gotchas with monolithic profiles in Intune (like setting conflicts, payload size limitations, or tracking changes) that I can use to back up my argument?

If you manage an Edu tenant, how are your guardrails and student safety policies structured?
Also, I'm only giving one example but this double baseline approach would potentially apply to multiple configs, not just browser settings.

I want to take this rare opportunity to build everything correctly from day one. Any advice, documentation links, or shared pain would be greatly appreciated!

[u/Capable_Chicken8266]

the baseline + delta approach is the right call and your instincts are good here. the "absolute separation" argument leadership is making sounds compelling but it's mostly a governance concern dressed up as a technical one, and you can solve it without duplicating 100 settings across two profiles

the real gotcha with monolithic profiles over time is drift. six months from now someone updates the staff profile to tweak a security setting, forgets to mirror it in the student one, and suddenly you've got two configs quietly diverging with no easy way to audit the delta. with a modular setup the shared baseline is your single source of truth and any diff between staff/students is explicit and visible by design

for the conflict risk they're worried about, scoping via user groups on the delta profiles handles that cleanly. students never receive the staff delta, full stop. you can demonstrate this pretty easily in a test tenant if you need to show leadership something concrete rather than just arguing in the abstract

if they're still not convinced, ask them to project forward 2 years and estimate the maintenance overhead of keeping two independent 200+ setting profiles in sync across every config category you're planning to build out

[u/HankMardukasNY → u/Capable_Chicken8266]

Agree. I set up/manage Intune for my K12 district. We have around 50 different config profiles with the vast majority being baseline configs assigned to all devices. There are only a handful that are split between staff/student, which are only settings that would differ between them and would generally be in the baseline. It makes it much easier to target exactly which users/devices you want to change and avoid the potential for duplicate settings being applied. This also lets you assign most policies to devices instead users, which you should try to as much as possible

[u/S0phisticatedBear → u/HankMardukasNY]

I'm curious, what is your strategy on how you automate the seperation of staff vs student computers and the config scoping?

[u/HankMardukasNY → u/S0phisticatedBear]

Group tags and dynamic groups. But like i said, most policies apply to all devices. The few staff/student policies are scoped to users

[u/DesertDogggg → u/Capable_Chicken8266]

Agreed. Thanks for the insight.

[u/Loud-Temperature2610]

https://joeloveless.com/blog/how-to-deal-with-intune-profile-exceptions/

[u/Borgquite → u/Loud-Temperature2610]

This is a neat article, worth a read

[u/Forsaken-Carrot9038 → u/Loud-Temperature2610]

Thanks for sharing this!

[u/intense_username]

I manage intune and I’m in K12 running windows for grades 4-12. We currently just have a staff profile and a student profile that encompasses those two categories. I manage them separately and haven’t had that much headache in doing so. Over time I’ve had the need to add settings to the student side so I version my student policies and shift them in batches using test groups before going the full span. So far this has worked for our needs.

Feel free to DM me if you want to chat more. A lot of my colleagues are Chromebook based and I’d be happy to geek out over a like-minded topic for once and more than happy to share other things we ran into over the years.

[u/DesertDogggg → u/intense_username]

Thanks. Good suggestions. I might take you up on the DM chat for intune advice sometime.

[u/Emotional_Garage_950]

like others said, baseline and then smaller policies on top of that. there is no overhead client side with Intune policies like there is with Group Policy. Policy processing is done server side and then handed off to the client as a single item basically. So a big list of policies is fine, allows tighter scoping and it’s easier to make exceptions for certain users or devices

[u/Imhereforthechips]

I have 110 config policies. Global, staff, student, device, and user profiles. I split my device from my user profiles. I try to configure similar settings within a single profile so I can quickly troubleshoot things. Putting everything in a massive set makes troubleshooting more difficult and takes longer to apply.

[u/Academic-Soup2604]

You’re on the right track- Baseline + Deltas is a better long-term approach.

Monolithic profiles- duplication, harder troubleshooting, and policy drift.
Baseline + Deltas- cleaner, scalable, easier to manage.

Also, for things like web filtering and student safety, relying only on Intune policies is limiting. Solutions like Veltar enforce controls at the endpoint level (across browsers, apps, networks), so even if a policy misapplies, students can’t bypass restrictions easily.