How to deploy Intune policies to multiple client tenants at once

In practice, you build and assign each Intune profile inside one client’s admin center, so deploying Intune policies to multiple tenants means repeating the work in every tenant. The settings catalog lets you export a policy as JSON and import it in the admin center, but you run the import while signed in to each client’s admin center. Automating that across tenants needs scripts that call Microsoft Graph, which someone has to write and maintain.

Augmentt Intune Autopilot saves the profile once as a template. It then deploys the template to each selected tenant from one console, without signing in to that client’s portal.

Microsoft’s cross-tenant route is the Microsoft 365 Lighthouse default baseline, which deploys recommended configurations including Intune settings. Its requirements are covered below.

Policies, enrolled devices, and compliance status all belong to each tenant, and the admin center works in the context of the tenant you signed in to. Every client needs its own consistent copy of these policy types, which Microsoft Learn’s assign-policies guide (linked below) lists as assignable in Intune:

• Configuration profiles
• Compliance policies
• App protection policies
• Enrollment policies, including Windows Autopilot deployment profiles

Rebuilding those policies by hand creates configuration drift. Two technicians build the same BitLocker or screen-lock profile with different values, and a setting missed in one tenant stays hidden until audit time. Augmentt covers the drift problem in more detail in its guide to managing Intune policies at scale.

For technicians, the work means portal-hopping and running the same wizard 40 times, one client at a time. For owners, it means senior technician hours absorbed by repeat work instead of the projects clients pay for.

The Microsoft 365 native way: one profile, one tenant, one wizard

Microsoft Learn documents the settings catalog policy steps for a single tenant. The procedure below follows that flow for one client and one Intune configuration profile per tenant.

1. Sign in to the Microsoft Intune admin center for the client tenant. Use an account with at least the Policy and Profile Manager role.
2. Select Devices > Manage devices > Configuration > Create > New policy.
3. Select the platform, for example Windows 10 and later. Select Settings catalog as the profile type. Select Create.
4. On Basics, enter the profile name and description. Select Next.
5. On Configuration settings, select Add settings. Select each setting. Set the value for each setting. Select Next.
6. On Scope tags, add scope tags if the tenant uses them. Select Next.
7. On Assignments, select the included and excluded groups. Select Next.
8. On Review + create, check the settings. Select Create.

The procedure has five wizard screens (Basics, Configuration settings, Scope tags, Assignments, and Review + create), plus sign-in and navigation. Microsoft Learn’s guide to assign Intune policies covers step 7, where you assign the policy to included or excluded Microsoft Entra groups.

Then you sign out, switch to the next client tenant, and repeat steps 1 to 8. Compliance policies and Autopilot profiles have their own wizards, so you repeat the cycle for every profile type too.

From practitioner experience, a fair estimate is about 10 to 15 minutes per profile per tenant. As an illustrative example, an MSP with 4 standard profiles and 30 tenants runs the wizard 120 times. At the estimated rate, those 120 runs add up to about 20 to 30 hours of technician time.

Each native workaround stops short of multi-tenant deployment:

• In the Intune admin center, each profile lives in the tenant you build it in.
• The settings catalog lets you export a policy as JSON and import it in the admin center. You run the import while signed in to each client’s admin center.
• Automating export and import across tenants needs scripts that call Microsoft Graph, which someone on your team writes and maintains.
• Microsoft 365 Lighthouse offers baselines and multi-tenant views, with eligibility limits that Microsoft sets.

Microsoft Graph documents list, get, create, and assign methods for Intune configuration policies in its Graph configuration policy API reference. Microsoft Graph requires an active Intune license for the tenant. That reference covers the beta API, which Microsoft says changes more often, and Microsoft recommends v1.0 where available. Teams build scripts on these methods to copy a policy between tenants, and someone has to maintain them.

Microsoft Learn’s Lighthouse baselines overview describes baselines as a repeatable way to manage Microsoft 365 security settings across multiple customer tenants. Microsoft Learn’s Lighthouse tenant requirements limit Lighthouse to partners in the CSP program. Each customer tenant must have no more than 2,500 licensed users and sit in the same geographic region as the partner.

The Augmentt way: build the template once, deploy it to every tenant

Augmentt Intune Autopilot is a paid add-on to Secure Autopilot in the Augmentt Autopilot family, which also includes Engage Autopilot. In the Augmentt app, its pages live under the Secure > Intune menu.

Intune Autopilot splits multi-tenant Intune management into a one-time template build and a short deploy flow per tenant, all from one console. The steps below follow the Augmentt Knowledge Base articles “Intune Policies – Creating Templates & Baselines” and “Deploying Intune Policies.”

Step 1. Capture the policy as a template (one time)

1. Build the policy in a connected Microsoft tenant, or use an Augmentt Default template.
2. Go to Intune Device Management > Configuration or Compliance. Open the Templates view.
3. Select Create New > Template.
4. Select the source tenant and the policy. Select Create.

One Augmentt Default template is the CIS Microsoft Intune for Windows 11 Benchmark template. Templates are stored at the organization level and shared across all companies. There is no separate template library per customer.

Step 2. Group templates into a baseline (optional)

1. In the Templates view, select Create New > Baseline.
2. Select the templates to include. Select Create.

A baseline is your MSP Intune baseline in one object. You deploy the set to a tenant in one flow instead of one template at a time.

Step 3. Deploy the policy or baseline to a client tenant

1. Go to Intune Device Management > Configuration or Compliance for the selected tenant.
2. Select Deploy > Policy. To deploy a baseline, select Deploy > Baseline.
3. Select the platform and the template, or select the baseline. Select Next.
4. Select user or device assignments. Select the groups to include and the groups to exclude. Select Next.
5. Review the settings. Select Deploy Policy, or select Deploy Baseline for a baseline.

Repeat Step 3 for each selected tenant from the same Augmentt console. You never sign in to the client’s Intune portal, and you can edit deployed policies inline.

What else runs from the same console

Intune Autopilot covers more than configuration and compliance policies. The same console handles thess:

• Autopilot deployment profiles through Onboarding Templates, at Secure > Intune > Onboarding > Templates
• Augmentt Default “Self Deploying Autopilot” and “User Driven Autopilot” onboarding templates
• App and script deployment, including remediation scripts
• App configuration policies and iOS MDM policies
• Microsoft device compliance alerts aggregated across every tenant
• Tracking of where each policy is deployed

Before you deploy, check three prerequisites. Your Augmentt user needs the Manage permission on Intune, and each customer tenant needs an Intune license. For CSP child tenants, the GDAP relationship must include the Intune Administrator role.

The estimated time for the Augmentt flow is a few minutes for all selected tenants. You run the deploy flow for each selected tenant, one after another, from one console.

Microsoft native vs. Augmentt: side-by-side comparison

The table compares both methods for rolling one standard profile out across your client base. All times are estimates.

For a 30-tenant MSP, the native column means 30 sign-ins and 30 runs of five wizard screens for every profile. At the estimated 10 to 15 minutes per run, one profile costs about 5 to 7.5 hours across the client base.

The Augmentt column moves the build into one template and leaves a five-step deploy flow per tenant. Running that flow for each selected tenant from one console takes an estimated few minutes for all selected tenants. It also changes who does the work, because any technician with the Manage permission on Intune can run the deploy flow.

Why it matters for growing MSPs

Owners feel the difference in margin. Wizard runs grow with every new tenant, while a template is built once and reused. The senior hours that went to rebuilding profiles go back to project work.

For technicians, the change is delegation. The prompted deploy flow lets L1 and L2 technicians deploy the standard without improvising settings. The senior technician stops being the only person who can safely touch a client’s Intune configuration.

For Augmentt Partners, the same baseline in every tenant closes the gaps that Intune policy drift creates, with fewer surprises in audits and renewals.

FAQs about deploying Intune policies to multiple tenants

Can Intune natively deploy policies to multiple tenants at once?

Not from the Intune admin center, where each profile is built and assigned in one tenant. Cross-tenant reuse runs through scripts that call Microsoft Graph, the Lighthouse default baseline, or a multi-tenant platform.

What licenses do I need to manage Intune across multiple client tenants?

Each client tenant needs a license that includes Intune. Augmentt shows a “not authorized for this feature” message for tenants not licensed for Intune.

What admin roles are required?

In each tenant, you need at least the Intune Policy and Profile Manager role to create profiles. For Augmentt with CSP child tenants, the GDAP relationship needs the Intune Administrator role.

How do I use Microsoft 365 Lighthouse to push Intune baselines to multiple clients?

Lighthouse assigns baselines from Deployment > Baselines to CSP customer tenants that meet its requirements. Each tenant needs 2,500 licensed users or fewer and must sit in the same region as the partner.

How can I automate Intune policy deployment across tenants with Microsoft Graph?

Teams build scripts on Microsoft Graph methods to copy a policy between tenants. Someone on your team writes and maintains that script as Microsoft changes settings.

How do I detect and remediate Intune policy drift across multiple client tenants?

Native Intune requires checking each tenant one at a time. Augmentt aggregates Microsoft device compliance alerts across every tenant and tracks where each policy is deployed.

How do I manage Windows Autopilot profiles centrally for multiple client tenants?

In Augmentt, capture a deployment profile under Secure > Intune > Onboarding > Templates and deploy it to any tenant. Microsoft Learn’s Autopilot registration overview states that devices must be registered with the Windows Autopilot deployment service before deployment.

Conclusion

Book a demo to see Intune Autopilot capture a policy as a template and deploy it to each client tenant from one console. The live platform demo runs with an Augmentt specialist, who tailors the walkthrough to your MSP’s needs.

Cover Photo by Christian Wiediger on Unsplash