The Intune Policy Configuration Agent is gone. Microsoft retired it, along with the Change Review Agent, on August 31, 2026. It’s no longer available in the Intune admin center, so there’s nothing to set up or fix. If you used it to turn STIG, NIST, or internal baseline documents into settings catalog policies, the policies it created were ordinary Intune policies. Map new baselines yourself with the settings catalog, security baselines, and the Copilot tooltips that are still in Intune.
If you landed here because Agents > Policy Configuration Agent is missing from your tenant, or an old runbook points to it, this is why. Microsoft’s Policy Configuration Agent article now opens with the retirement notice. It tells admins to finish active runs before the date and to avoid building new dependencies on the agent.
What the agent did
The rest of this article is a record of how the agent worked, so you can replace it in your process. Per Microsoft Learn, the agent:
- Took an uploaded knowledge source (STIGs, NIST guidelines, internal policy documents) or a plain-language prompt, such as
All laptops must have BitLocker enabled with AES-256 encryption. - Used Security Copilot to parse each requirement and map it to a settings catalog setting and value.
- Showed each mapping with the original requirement text, the proposed value, and a confidence score. It labeled each one Supported or Unsupported.
- Created a draft settings catalog policy. The policy wasn’t enforced until you assigned it.
The documented limits were Windows only, public cloud only, one knowledge source at a time, and text files up to 25 KB. It also needed Intune Plan 1, Security Copilot with enough security compute units (SCUs), the Intune plugin, and Security Copilot plus Intune roles (Copilot owner to set up, Copilot Contributor to use, Policy and Profile manager to create policies). The agent was still listed as public preview when it was retired.
What happens to policies it created
Microsoft’s documentation says that “this settings catalog policy isn’t enforced until you assign it, just like any Intune policy you manually create,” and that once it’s created, “the policy is a normal Intune policy.” They show up under Devices > Configuration like any other settings catalog policy. You edit, assign, and retire them the usual way.
What you lose is the agent-side data: knowledge sources, saved mappings, and suggestion history. Microsoft’s removal guidance says that removing the agent deletes its suggestions and activities, while previously applied suggestions stay unchanged. The retirement notice doesn’t say whether agent data can still be exported. Assume it can’t.
Do these checks now:
- Find the agent-created policies. Search Devices > Configuration for the names you used, and confirm each one has an owner and a documented source baseline.
- Write down the requirement-to-setting mapping for any policy auditors care about. That trail used to live in the agent’s Knowledge tab.
- Update runbooks that tell admins to open Agents > Policy Configuration Agent.
How to map a baseline without the agent
Here’s what’s left, all documented on Microsoft Learn:
- Start from a Microsoft security baseline where one fits. Intune security baselines are groups of preconfigured Windows settings based on Microsoft security recommendations, and you can customize them. Change the settings your STIG or internal standard handles differently, rather than building from nothing.
- Fill the gaps in the settings catalog. Search the catalog for each remaining requirement. When you add a setting, the Copilot tooltip can answer questions like “Has this setting been configured in any other policies?” and “Does Microsoft recommend any particular value for this setting?” (Copilot in Intune). That covers one setting at a time; it doesn’t map a whole document.
- Use Summarize with Copilot on an existing policy to get a plain-language description of what it sets and who it’s assigned to. That makes a useful audit note.
- Keep an “unsupported” list yourself. The agent’s most useful output was the list of requirements Intune can’t enforce, like physical security and manual review procedures. Keep that list next to the policy so auditors see the gap was a decision, not something missed.
Pilot every new baseline policy on a small device group first, just as you would have with an agent-generated policy.
When compliance breaks after you deploy
Writing the policy is only half the job. If devices go noncompliant after a baseline rollout, work through AI-assisted Intune compliance troubleshooting. It covers reading per-setting compliance state and tracking down the setting that is failing.
For an overview of the Security Copilot agents that remain in Intune, see Security Copilot agents in Intune. It was written before this retirement, so treat what it says about the Policy Configuration Agent as historical.
FAQ
Is the Intune Policy Configuration Agent still available?
No. Microsoft retired it on August 31, 2026, and it’s no longer accessible in the Microsoft Intune admin center.
Do policies the agent created stop working?
Microsoft describes agent-created policies as normal settings catalog policies once they’re created. They’re managed like any other Intune policy. The retirement notice covers the agent experience, not your policies.
Was the Change Review Agent retired too?
Yes. The same notice retires the Change Review Agent on the same date.
What replaces it?
Microsoft hasn’t named a direct replacement in the retirement notice. Use Intune security baselines, the settings catalog, and the Copilot tooltips and policy summaries in Intune to do the mapping yourself.
Did it support macOS, iOS, or government clouds?
No. Microsoft documented it as Windows only and public cloud only.
Sources
- Learn about Policy Configuration Agent and set it up, Microsoft Learn (updated August 19, 2026, including the retirement notice)
- Use the Policy Configuration Agent to create policies, Microsoft Learn
- Microsoft Copilot in Intune, Microsoft Learn
- Security baselines in Intune, Microsoft Learn