Hi let’s discuss Allow or block Font providers using Intune system Policy. As you all know, Microsoft Intune is a powerful cloud-based endpoint management solution that enables organizations to enforce security policies across devices. Font providers are leading major parts on System settings.
Font providers let Windows download extra fonts from the internet as needed. This makes more fonts available without manual installation. However, businesses may limit this feature to ensure security Windows has a setting that controls whether it can download fonts from the internet.
This affects how the system performs, stays secure, and improves user experience. Knowing how it works helps IT administrators and users manage fonts effectively. The Windows font download setting controls font availability, system performance, and security.
It works with Group Policy, MDM, and registry values, helping users and administrators manage fonts efficiently. When enabled, Windows checks online for new fonts, ensuring proper text display even if the fonts aren’t installed locally. When disabled, it only uses existing fonts, improving security and reducing network use.
Table of Contents
What happens When the “EnableFontProviders” Policy is Enabled or Disabled in Windows?
When the “EnableFontProviders” policy setting is enabled, Windows periodically queries an online font provider to check for new font catalogs, and it may download font data if necessary to format or render text. If the policy setting is disabled, Windows will not connect to any online font provider and will only use locally-installed fonts.
Allow or Block Font Providers- CSP Details
Above we discussed about Font Providers using Intune Security Policy. The “EnableFontProviders” policy setting in Windows controls whether the operating system is allowed to download fonts and font catalog data from an online font provider.
Configuration Service Providers (CSPs) enable Intune to manage settings on Windows devices, facilitating remote configuration through the Windows Registry.
./Device/Vendor/MSFT/Policy/Config/System/AllowFontProviders
| Property Name | Property Value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
- How to Create Intune Settings Catalog Policy
- List of Intune Settings Catalog Policies
- Fix Issue on USB Connected Dual-Mode Printers on Windows Client
Create Policy
To create a policy, start by signing in to the Microsoft Intune admin center with your credentials. Then, navigate to Devices > Configuration in the menu and click on the +Create option.
Next, select +New policy, and you will be prompted to choose a platform and profile type. In this section, select Windows 10 and later as the platform and set the profile type to Setting catalog.
Basics
The Basic details section is crucial. Here, you need to enter information like the name and an optional description. While the description isn’t mandatory, it’s helpful for understanding the policy later. Since the platform is already set to Windows, you don’t need to make any changes.
- Click on Next.
Once you’ve completed the basics, navigate to the configuration settings. Click on it, then select the “Add Setting” option, which appears in blue. After clicking on it, a settings picker window will open. In this window, use the search function to locate the “System” option. Once found, click on it, then select “Allow Font Providers.
- Now close the settings picker Window.
Allowed
After selecting allow of font providers, now, you can get 2 allowed option such as Not allowed– No traffic to fs.microsoft.com and only locally installed fonts are available. Allowed– There may be network traffic to fs.microsoft.com and downloadable fonts are available.
- Here Allowed-There may be network traffic to fs.microsoft.com and downloadable fonts are available is the defaulted option.
- If you want that click on the Next to proceed.
Not Allowed
If you want to select Not allowed– No traffic to fs.microsoft.com and only locally installed fonts are available, you can easily select that one. Then click on the next.
Scope Tags
Scope tags help categorize and associate your policy with a specific scope, making it easier to manage assignments for different environments. While adding a scope tag is optional, you can choose to do so if needed.
- For now, I will skip this section and click Next to proceed.
Assignments
The next step is the Assignment tab, which is crucial for deploying policies. In this section, you will define the groups to which the policy will be applied. To begin, I clicked on Add Groups under the Include Groups option. Once I selected the appropriate group, I clicked Next to continue with the policy setup.
Review + Create
Once the assignments are complete, you’ll reach the Review + Create stage, the final step in the policy creation process. At this point, you can review all the details of the policy, including the basic information, configuration settings, and assignments you’ve made.
- If everything with the settings IS Ok then, click the Create button to finalize and apply the policy.
Monitoring Status
When you create a new policy for a device, it usually takes up to 8 hours for the policy to apply automatically. However, you can speed up the process by manually syncing the device. After syncing, you can verify that the policy has been successfully applied by checking Intune.
- To do this, go to Devices > Configuration, and then select the policy to confirm its status.
Client Side Verification
To monitor Intune’s status, you can use Event Viewer. First, open the Start menu and type “Event Viewer.” Next, navigate to the following path:
Application and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
- In the right pane, click Filter Current Log, enter 813 in the Event IDs field, and then click OK. This will filter the logs to show relevant events related to Intune.
Delete Policy in Intune
In our previous post we shared some details of delete Intune policy. In this post discussing about the Allow Clipboard History Policy is one such policy that controls whether the clipboard contents can be stored in memory. This policy is no longer required, so it described how this policy is deleted. For more Info
See More : How to Delete Allow Clipboard History Policy in Intune Step by Step Guide
Remove Assigned Group
Also in our previous post we added some guidence for Remove Assigned Group in Intune. In this post we are remove an assigned group from the AVS Media Player App in Microsoft Intune. Sometimes, apps are mistakenly assigned to the wrong group or need reassignment for other reasons. This guide will give you through the process of removing an assigned group from the app in Intune.
See More : Learn How to Delete or Remove App Assignment from Intune using Step by Step Guide
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.