Fix Intune Error 0x87D00692: A higher authority, normally a domain Group Policy, overrides the Windows Update settings ConfigMgr tries to apply, so software update scans fail.

Root causes

• A domain GPO sets "Specify intranet Microsoft update service location" and points the device at a different WSUS server than the ConfigMgr software update point.
• Local policy in registry.pol holds Windows Update settings that no longer match what ConfigMgr configures.
• The Windows Update workload is split between ConfigMgr and Intune, and the two sources set conflicting scan sources.

Step-by-step remediation

1. 1In WUAHandler.log find the line "Group policy settings were overwritten by a higher authority" and note the server it names.
2. 2Run gpresult /h gpresult.html and find which GPO sets the Windows Update server policy.
3. 3Remove or filter that GPO for ConfigMgr-managed devices so the software update point is the only source.
4. 4If local policy is the cause, back up and rename C:\Windows\System32\GroupPolicy\Machine\registry.pol, then run gpupdate /force.
5. 5Restart the SMS Agent Host service and run the Software Updates Scan and Deployment Evaluation cycles.
6. 6For co-managed devices, check the Windows Update policies workload slider and whether Intune also sets a scan source.