How to create 2 Wired Network profiles for 2 different authentication methods with no conflict

Intune wired network profiles are backed by the Windows WiredNetwork CSP, so multiple profiles that target the same interface and 802.1X configuration will conflict if they try to manage the same CSP nodes differently.

From the documentation:

• A wired network device configuration profile is created per platform and uses the WiredNetwork CSP for Windows.
• These settings are applied per device and per wired interface, not per physical switch port.

Because of this, configuring:

• One profile that enforces 802.1X with EAP‑TLS, and
• Another profile that disables 802.1X (or uses a different EAP method like PEAP)

on the same wired interface will result in a policy conflict when both profiles are assigned to the same device and interface. Intune will report a conflict when two profiles attempt to configure the same CSP path with different values.

To avoid conflict and allow both scenarios, the configuration must ensure that a single device and interface is not targeted by two mutually exclusive wired network configurations at the same time. Practically, this means:

1. Use separate device or user groups
   • Assign the EAP‑TLS 802.1X wired profile to one set of devices/groups.
   • Assign the non‑802.1X (or PEAP) wired profile to a different set of devices/groups.
   • Ensure no device that should use EAP‑TLS also receives the non‑802.1X/PEAP profile for the same interface.
2. Keep one effective wired profile per interface per device
   • For each device, only one wired network profile should configure 802.1X and EAP settings for a given wired adapter.
3. If different physical networks are required
   • Use group targeting and network design (for example, different VLANs or device roles) so that devices that must connect to the EAP‑TLS network are in one Intune group and devices that must connect to the non‑802.1X/PEAP network are in another.

Intune does not support having two conflicting wired network profiles (one enforcing 802.1X/EAP‑TLS and one not enforcing 802.1X/using PEAP) applied to the same device and interface without conflict. The supported approach is to scope each profile to distinct device/user groups so that each device has only one active wired network configuration for its interface.

References:

• Add and use wired networks settings on your macOS and Windows devices in Microsoft Intune
• Add wired network settings for Windows devices in Microsoft Intune
• Add wired network settings for macOS devices in Microsoft Intune
• Implementing 802.1x Authentication for Microsoft Teams Rooms on Windows
• PEAP Profile Sample