From sign-in to your first policy.

Open app.cloudpolicypreferences.com and sign in with your work account. There is no separate registration — your Entra ID tenant is the account.

• The first person to sign in from your tenant becomes the initial Full Admin.
• Accept the end user licence agreement when prompted — it is recorded against your tenant.
• If somebody else set the tenant up first, ask them to grant you a role in User Management.

Cloud Policy Preferences resolves the display names of the users and groups you target. To do that it needs two read-only Microsoft Graph application permissions, granted once by a Global Administrator. Consent creates a service principal for the application in your own tenant — you can review or revoke it at any time from Entra ID.

Permissions requested

Cloud Policy Preferences cloudpolicypreferences.com · accepts permissions for your organisation

User.Read.All Read the profile of users in your directory, so a policy target shows a name instead of an object ID.

GroupMember.Read.All Read group memberships, so the platform can work out which devices and users a group policy applies to.

Accept Cancel Consent applies to the whole organisation

Illustration. The consent prompt is presented by Microsoft Entra ID, so what you see will follow Microsoft's own layout. The two permissions listed here are the only ones requested — both are read-only, and neither allows the platform to change anything in your directory.

Open User Management and add the people who need access. Three roles are available, and everyone else in your tenant has no access at all until you grant it.

• Full Admin — create, edit and delete policies, and manage access.
• Read Only Admin — see every policy, change nothing.
• Report Viewer — reports only, no access to policy settings.

Add a second Full Admin now if you intend to use Multi-Admin Approval later — it cannot be enabled until at least two Full Admins exist in the tenant.

Go to Settings → Security and generate your client authentication code. Devices present this code when they call the Device API, so nothing can collect your policy payloads without it. The code is written into the scripts you download in step 6, so generate it before you download them.

Illustration of the Client Authentication Code card. Your code will differ.

Still in Settings → Security, enable Device Data Encryption. A public and private key pair is generated for your tenant and stored in Azure Key Vault; devices encrypt what they send with the public key, and the service decrypts it with the private one. If you also want identifiers pseudonymised in reports, configure the Tenant Data Encryption Key under Privacy at the same time.

Open Settings → Deployment and download detection.ps1 and remediation.ps1. Both come pre-populated with your tenant ID and the client authentication code from step 4 — there is nothing to edit before you upload them.

Illustration of the Remediation Scripts card. Match these two switches to the Intune settings in the next step.

In the Microsoft Intune admin centre, go to Devices → Remediations and create a script package. Upload the detection and remediation scripts you just downloaded, then set the options to match what the portal showed you.

Illustration of the remediation settings. The Intune admin centre is Microsoft's, so the real screen will follow its own layout — the values are what matter.

• Assign the remediation to the device or user groups you want covered.
• An hourly schedule keeps devices close to their intended state without being noisy.
• If you enabled payload encryption, deploy the device setup script first.

Back in the portal, use Create a Policy. Pick a type, fill in the fields that type needs, and target an Entra ID group. A drive mapping or a single registry value makes a good first test, because you can confirm it on a device in seconds.

After the next remediation cycle, the device checks in and reports what it applied. Reports shows the check-in history and any drift, and What-If lets you confirm what would apply to a given user or device before you widen the targeting.