Allow and Block URLs in Intune

Intune evaluates URL settings per setting, not per “policy group,” and multiple policies that target the same Edge URL lists with different values will conflict. To implement the scenario, the configuration must be structured so that each user/device receives only one effective value for each of these settings:

• Define list of allowed URLs
• Block list of URLs

When multiple policies configure the same setting differently, Intune flags a conflict and may not apply the setting at all. This is expected behavior for configuration policies:

• When two or more configuration policies target the same setting with different values, the conflict is shown in Intune and must be resolved manually.
• All configuration policy types (Settings Catalog, baselines, endpoint security, etc.) have equal precedence; there is no automatic “last writer wins.”

To implement the desired logic without conflicts:

1. Use one configuration policy per setting per user group
   • For each user population (for example, “WhatsApp+Facebook users”, “Facebook+Instagram users”), create a single Edge configuration policy that defines the complete Allowed URLs and Blocked URLs lists for that population.
   • Do not split the same setting (Allowed URLs or Blocked URLs) across multiple policies that target the same users/devices.
2. Design groups around access patterns, not individual apps
   • Create Azure AD groups that represent the final access combination (e.g., Group A = WhatsApp+Facebook, Group B = Facebook+Instagram).
   • Assign one Edge policy to each group with the full, non-overlapping configuration for that group.
3. Avoid overlapping assignments for the same setting
   • Ensure that a user is not in two groups that each have a policy configuring the same Edge URL setting differently.
   • If overlapping membership is unavoidable, consolidate those settings into a single policy and assign that policy to all overlapping users.
4. Use reporting to detect and clean up conflicts
   • Use Intune reporting to identify which policies are applying to a device/user and which settings are in conflict, then adjust group membership or merge policies accordingly.

If URL control is needed at a more granular level (per app/category) but users can belong to multiple categories, the only supported way to avoid conflicts is to pre-compute the combined URL lists for each possible combination and ensure each user receives only one configuration per setting.

References:

• Common questions, answers, and scenarios with policies and profiles in Microsoft Intune
• Manage device security with endpoint security policies in Microsoft Intune
• Avoiding policy conflicts
• Manage Microsoft Edge on iOS and Android With Intune