Endpoint management policy profiles

Detects endpoint-management policy profiles: Intune/MDM/GPO profile wording with machine policy artefacts (OMA-URI, payload keys, policy registry paths, Graph types) and populated profile fields. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a machine policy artefact (OMA-URI path, Apple payload key, com.apple domain, HKLM Policies path, Graph @odata.type) or a populated profile field (profile/policy name, assignment/groups, platform, scope tag, setting/value)), and 85 needs two distinct structures plus independent endpoint-control (BitLocker, Defender, firewall, USB, exclusions, ASR) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:Intune|MDM|Jamf|Workspace\s+ONE|MECM|SCCM)\s+(?:policy|profile|configuration\s+profile|compliance\s+policy|baseline)|configuration\s+profile|device\s+compliance\s+policy|endpoint\s+(?:management|security)\s+(?:policy|profile)|group\s+policy\s+object|GPO\s+report)\b

Corroborative evidence keywords

BitLocker, Defender, firewall, USB, exclusion, allowed, blocked, password length, conditional access, ASR

Proximity: 300 characters

Should match

The new configuration profile will be piloted with the ICT team first. — Discovery probe (65)
Intune configuration profile Profile name: WIN-Baseline-Finance Assigned groups: SG-Finance-Devices — Medium-tier probe (75) - populated profile fields
Intune configuration profile export Profile name: WIN-Baseline-Finance Assigned groups: SG-Finance-Devices OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Defender/AllowFullScanRemovableDriveScanning "@odata.type": "#microsoft.graph.windows10CustomConfiguration" Defender exclusion for C:\PayrollApp; USB storage blocked; BitLocker required. — High-tier probe (85) - OMA-URI and Graph artefacts, profile fields, control context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: every managed laptop receives the standard configuration profile at enrolment. — Policy text
Configuration profile template Profile name: ________ Assigned groups: [insert] — Blank template
Course module 4: an Intune configuration profile can set OMA-URI ./Device/Vendor/MSFT/Policy/Config/Camera/AllowCamera. — Training framing

Known false positives

Microsoft/Apple documentation quotes OMA-URI and payload examples. Mitigation: Guidance/training framing is excluded; 85 needs two artefacts plus populated profile fields and control context.